DWH.exe virus [Solved]

I had an infected usb and i used my antivirus to search for viruses and it found a lot starting with DWH and ending in .exe. My antivirus Symantec deleted them but every time I open my computer it shows up again. I notice that there were $recyclebin and system information with weird folders in each of my partition. I hope someone can help me figure out a way to delete these trojans.


OTL logfile created on: 4/20/2012 2:52:03 AM - Run 1
OTL by OldTimer - Version 3.2.40.0 Folder = C:\Users\Win\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.93 Gb Total Physical Memory | 5.63 Gb Available Physical Memory | 71.00% Memory free
15.85 Gb Paging File | 13.27 Gb Available in Paging File | 83.70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232.88 Gb Total Space | 31.37 Gb Free Space | 13.47% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 22.17 Gb Free Space | 9.52% Space Free | Partition Type: NTFS
Drive E: | 213.34 Gb Total Space | 21.58 Gb Free Space | 10.11% Space Free | Partition Type: NTFS
Drive F: | 232.88 Gb Total Space | 53.28 Gb Free Space | 22.88% Space Free | Partition Type: NTFS
Drive G: | 4.34 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: WIN-PC | User Name: Win | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Win\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Youdao\Dict4\5.0.33.3225\WordBook.exe (网易公司)
PRC - C:\Program Files (x86)\Youdao\Dict4\YodaoDict.exe (网易公司)
PRC - C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (Power Software Ltd)
PRC - C:\Windows\AsScrPro.exe (ASUS)
PRC - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Program Files (x86)\Ruijie Networks\Ruijie Supplicant\SuService.exe (锐捷网络)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
PRC - C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZtray.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZSvr.exe (NewTech Infosystems, Inc.)
PRC - C:\Windows\SysWOW64\D4Mon_ICBC.exe (Tendyron Corporation)
PRC - C:\Windows\SysWOW64\D4Svr_ICBC.exe (Tendyron Corporation)
PRC - C:\Windows\SysWOW64\D4Ser_ICBC.exe (Tendyron Corporation)
PRC - C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe (ASUSTek Computer Inc.)
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
PRC - F:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Users\Win\AppData\Local\Google\Chrome\Application\18.0.1025.162\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\Win\AppData\Local\Google\Chrome\Application\18.0.1025.162\pdf.dll ()
MOD - C:\Users\Win\AppData\Local\Google\Chrome\Application\18.0.1025.162\avutil-51.dll ()
MOD - C:\Users\Win\AppData\Local\Google\Chrome\Application\18.0.1025.162\avformat-53.dll ()
MOD - C:\Users\Win\AppData\Local\Google\Chrome\Application\18.0.1025.162\avcodec-53.dll ()
MOD - C:\Program Files (x86)\Youdao\Dict4\5.0.33.3225\WordStrokeHelper32.dll ()
MOD - C:\Program Files (x86)\Youdao\Dict4\stable\Acrobat2Dict.dll ()
MOD - C:\Program Files (x86)\Youdao\Dict4\5.0.33.3225\TextExtractorImpl32.dll ()
MOD - C:\Program Files (x86)\Youdao\Dict4\5.0.33.3225\CrashRpt.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\SysWOW64\D4Pinpad_ICBC.dll ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()
MOD - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()
MOD - C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\sqlite3.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore64.exe (SUPERAntiSpyware.com)
SRV:64bit: - (AFBAgent) – C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)
SRV:64bit: - (TurboBoost) – C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel® Corporation)
SRV:64bit: - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (XLServicePlatform) – C:\Program Files (x86)\Common Files\Thunder Network\ServicePlatform\XLSP.dll (ShenZhen Xunlei Networking Technologies,LTD)
SRV - (Creative ALchemy AL6 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (SmcService) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe (Symantec Corporation)
SRV - (SNAC) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\snac64.exe (Symantec Corporation)
SRV - (SepMasterService) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe (Symantec Corporation)
SRV - (RJSuService) – C:\Program Files (x86)\Ruijie Networks\Ruijie Supplicant\SuService.exe (锐捷网络)
SRV - (NTI BackupNowEZSvr) – C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZSvr.exe (NewTech Infosystems, Inc.)
SRV - (OnKey Service _ICBC) – C:\Windows\SysWOW64\D4Ser_ICBC.exe (Tendyron Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ATKGFNEXSrv) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (UNS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (ASLDRService) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ADSMService) – C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (esgiguard) – C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (NdisrdMP) – C:\Windows\SysNative\drivers\Ndisrd.sys (NT Kernel Resources)
DRV:64bit: - (Ndisrd) – C:\Windows\SysNative\drivers\Ndisrd.sys (NT Kernel Resources)
DRV:64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (Power Software Ltd)
DRV:64bit: - (AsDsm) – C:\Windows\SysNative\drivers\AsDsm.sys (ASUSTek Computer Inc)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\SymEFA64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\SymDS64.sys (Symantec Corporation)
DRV:64bit: - (SYMNETS) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\symnets.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\Ironx64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (taphss) – C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\saskutil64.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (PCASp50) – C:\Windows\SysNative\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (AiCharger) – C:\Windows\SysNative\drivers\AiCharger.sys (ASUSTek Computer Inc.)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (HECIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (L1C) NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (AmUStor) – C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (TurboB) – C:\Windows\SysNative\drivers\TurboB.sys ()
DRV:64bit: - (kbfiltr) – C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (btusbflt) – C:\Windows\SysNative\drivers\btusbflt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (SiSGbeLH) – C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) – C:\Windows\SysNative\drivers\snp2uvc.sys ()
DRV:64bit: - (RTHDMIAzAudService) – C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS)
DRV:64bit: - (NTIDrvr) – C:\Windows\SysNative\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV:64bit: - (UBHelper) – C:\Windows\SysNative\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (WimFltr) – C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (WDC_SAM) – C:\Windows\SysNative\drivers\wdcsam64.sys (Western Digital Technologies)
DRV - (BHDrvx64) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\BASHDefs\20120402.011\BHDrvx64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20120418.001\IDSviA64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\VirusDefs\20120419.002\EX64.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\VirusDefs\20120419.002\ENG64.SYS (Symantec Corporation)
DRV - (HWiNFO32) – C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS (REALiX™)
DRV - (PCASp50) – C:\Windows\SysWOW64\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/enterprise/securit…ponse/index.jsp

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/enterprise/securit…ponse/index.jsp

IE - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/enterprise/securit…ponse/index.jsp
IE - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BB 24 40 C0 0D B3 CC 01 [binary data]
IE - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall: C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall,version=1.0.0: %commonprogramfiles%\tencent\NPQSCALL\npqscall.dll File not found
FF - HKLM\Software\MozillaPlugins\@qq.com/QQPhotoDrawEx: F:\Program Files (x86)\Tencent\QQ\Plugin\Com.Tencent.Qzone\bin\QQPhotoDrawEx\npQQPhotoDrawEx.dll ()
FF - HKLM\Software\MozillaPlugins\@qq.com/QzoneMusic: F:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll File not found
FF - HKLM\Software\MozillaPlugins\@qq.com/TXSSO: C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll ()
FF - HKLM\Software\MozillaPlugins\@xunlei.com/DapCtrl: C:\Program Files (x86)\Common Files\Thunder Network\KanKan\npDapCtrl.3.1.0.4.(33).dll (ShenZhen Thunder Networking Technologies Ltd.)
FF - HKLM\Software\MozillaPlugins\@xunlei.com/npxunlei;version=1.0.0.1: F:\Program Files (x86)\Thunder Network\Thunder\data\npxunlei1.0.0.1.dll ( )
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Win\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Win\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@xunlei.com/npxunlei;version=1.0.0.1: F:\Program Files (x86)\Thunder Network\Thunder\data\npxunlei1.0.0.1.dll ( )
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\IPSFFPlgn\ [2012/04/20 02:49:23 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\Youdao\Dict4\stable\extensions\firefox [2012/03/25 13:14:20 | 000,000,000 | —D | M]


========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Win\AppData\Local\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Win\AppData\Local\Google\Chrome\Application\18.0.1025.162\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Win\AppData\Local\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Win\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: QQ2011 (Enabled) = C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll
CHR - plugin: NPTXSSO Dynamic Link Library (Enabled) = C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll
CHR - plugin: Thunder DapCtrl NPAPI Plugin (Enabled) = C:\Program Files (x86)\Common Files\Thunder Network\KanKan\npDapCtrl.3.1.0.4.(33).dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Win\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: npQQPhotoDrawEx (Enabled) = F:\Program Files (x86)\Tencent\QQ\Plugin\Com.Tencent.Qzone\bin\QQPhotoDrawEx\npQQPhotoDrawEx.dll
CHR - plugin: XunLei Plugin (Enabled) = F:\Program Files (x86)\Thunder Network\Thunder\data\npxunlei1.0.0.1.dll
CHR - Extension: \u6709\u9053\u8BCD\u5178Chrome\u9F20\u6807\u53D6\u8BCD\u63D2\u4EF6 = C:\Users\Win\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohddidmgooofkgohkbkaohadkolgejj\1.2_0\
CHR - Extension: YouTube = C:\Users\Win\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Win\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Users\Win\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/04/18 12:58:01 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (迅雷下载支持) - {004B0726-A010-4ABF-8556-FCDB7F1FCA1E} - F:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.2.6.3428.dll (深圳市迅雷网络技术有限公司)
O2:64bit: - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found.
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (ѸÀ×ÏÂÔØÖ§³Ö) - {889D2FEB-5411-4565-8998-1DD2C5261283} - F:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.2.6.3428.dll (深圳市迅雷网络技术有限公司)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [RunDLLEntry] C:\Windows\SysNative\AmbRunE.DLL (Creative Technology Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ASUS Ai Charger] C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage Sync\1.0.15.79\AsusWSPanel.exe (ASUS Cloud Corporation)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [BackupNowEZtray] C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZtray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [D4Svr_ICBC.exe] C:\Windows\SysWow64\D4Svr_ICBC.exe (Tendyron Corporation)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (Power Software Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Supplicant] C:\Program Files (x86)\Ruijie Networks\Ruijie Supplicant\RuijieSupplicant.exe ()
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKU\S-1-5-21-2644376346-2394491102-593013250-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKU\S-1-5-21-2644376346-2394491102-593013250-1000..\Run: [YodaoDict] C:\Program Files (x86)\Youdao\Dict4\RunDict.exe (网易公司)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 100
O7 - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-21-2644376346-2394491102-593013250-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: &使用&迅雷下载 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm ()
O8:64bit: - Extra context menu item: &使用&迅雷下载全部链接 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\getAllurl.htm ()
O8:64bit: - Extra context menu item: &使用&迅雷离线下载 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm ()
O8:64bit: - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found
O8:64bit: - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm ()
O8 - Extra context menu item: &使用&迅雷下载 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm ()
O8 - Extra context menu item: &使用&迅雷下载全部链接 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\getAllurl.htm ()
O8 - Extra context menu item: &使用&迅雷离线下载 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm ()
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found
O8 - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {060CA154-DF25-4F03-98AA-FBCDE9D27382} https://mybank.icbc.com.cn/icbc/ICBC_TDRDV.cab (TDRDV Class)
O16 - DPF: {0EB487C8-E9AC-43A6-8C4C-083999B0622F} https://mybank.icbc.com.cn/icbc/newperbank/certInStall.dll (InfosecCertInstall Class)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} https://mybank.icbc.com.cn/icbc/newperbank/…afeControls.cab (AxSubmitControl Class)
O16 - DPF: {B1FBC1AD-5644-4084-882A-0F8BA85E7506} https://mybank.icbc.com.cn/icbc/ICBC_NetSign.dll (InfoSecICBCNetSign Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0DDE52E2-D3C5-4844-88C4-6E0A310372FE}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6D160507-A189-4D3B-9C58-FE2465519371}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\SEP: DllName - (C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\WinLogoutNotifier.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*


Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler)
Drivers32: msacm.divxa32 - C:\Windows\SysWow64\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (http://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.VP60 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\SysWow64\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/04/20 01:34:42 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Roaming\FXTS2
[2012/04/20 01:34:37 | 000,000,000 | -H-D | C] – C:\ProgramData\{1C0BEEE7-57A2-48E1-8902-2FB027C1DE5E}
[2012/04/20 01:34:32 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FX Trading
[2012/04/20 01:34:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Candleworks
[2012/04/20 01:32:30 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Local\PackageAware
[2012/04/19 00:25:20 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Local\WMTools Downloaded Files
[2012/04/19 00:14:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Movie Maker 2.6
[2012/04/18 13:19:52 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Roaming\SUPERAntiSpyware.com
[2012/04/18 13:19:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012/04/18 13:19:01 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2012/04/18 13:19:01 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2012/04/18 13:16:27 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/04/18 13:03:20 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/04/18 12:37:43 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/04/18 12:37:43 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/04/18 12:37:43 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/04/18 12:37:33 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012/04/18 12:35:09 | 000,000,000 | —D | C] – C:\Qoobox
[2012/04/17 17:47:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Symantec Shared
[2012/04/17 02:05:11 | 000,081,840 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\FwsVpn.dll
[2012/04/17 02:05:11 | 000,042,632 | —- | C] (Symantec Corporation) – C:\Windows\SysNative\drivers\WGX64.SYS
[2012/04/17 01:57:32 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64
[2012/04/17 01:57:32 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\SEP
[2012/04/17 01:57:32 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\SEP\0C0103E8
[2012/04/17 01:57:32 | 000,000,000 | —D | C] – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105
[2012/04/17 00:44:26 | 000,000,000 | —D | C] – C:\ProgramData\regid.1992_12.com.symantec
[2012/04/15 00:41:06 | 000,000,000 | -H-D | C] – C:\Windows\PIF
[2012/04/14 00:09:40 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth Devices
[2012/04/09 02:21:44 | 000,000,000 | —D | C] – C:\Users\Win\Desktop\Digimon - Digital Card Battle [SLUS-01328]
[2012/04/07 02:32:22 | 000,000,000 | —D | C] – C:\Users\Win\Documents\OneNote Notebooks
[2012/04/07 02:27:18 | 000,000,000 | —D | C] – C:\Windows\SysWow64\RTCOM
[2012/04/07 02:25:54 | 002,605,400 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\WavesGUILib.dll
[2012/04/07 02:25:52 | 000,518,896 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSTSX64.dll
[2012/04/07 02:25:52 | 000,211,184 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSTSH64.dll
[2012/04/07 02:25:52 | 000,198,896 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSHP64.dll
[2012/04/07 02:25:52 | 000,155,888 | —- | C] (SRS Labs, Inc.) – C:\Windows\SysNative\SRSWOW64.dll
[2012/04/07 02:25:39 | 000,375,128 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEEP64A.dll
[2012/04/07 02:25:39 | 000,204,120 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEED64A.dll
[2012/04/07 02:25:39 | 000,101,208 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEEL64A.dll
[2012/04/07 02:25:39 | 000,078,680 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RTEEG64A.dll
[2012/04/07 02:25:37 | 000,310,104 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RP3DHT64.dll
[2012/04/07 02:25:37 | 000,310,104 | —- | C] (Dolby Laboratories, Inc.) – C:\Windows\SysNative\RP3DAA64.dll
[2012/04/07 02:25:28 | 002,131,288 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\MaxxAudioEQ.dll
[2012/04/07 02:25:27 | 000,978,776 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\MaxxAudioAPOShell64.dll
[2012/04/07 02:25:27 | 000,318,808 | —- | C] (Waves Audio Ltd.) – C:\Windows\SysNative\MaxxAudioAPO20.dll
[2012/04/07 02:25:17 | 002,528,832 | —- | C] (Fortemedia Corporation) – C:\Windows\SysNative\FMAPO64.dll
[2012/04/07 01:21:38 | 000,000,000 | —D | C] – C:\aws
[2012/04/07 01:21:28 | 000,000,000 | —D | C] – C:\Asus WebStorage
[2012/04/07 01:05:47 | 000,000,000 | —D | C] – C:\Users\Win\Documents\Asus WebStorage
[2012/04/07 01:05:41 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Roaming\ASUS WebStorage
[2012/04/07 01:05:37 | 000,000,000 | —D | C] – C:\ProgramData\ASUS WebStorage
[2012/04/05 00:32:49 | 000,000,000 | —D | C] – C:\ProgramData\QQPet
[2012/04/02 19:46:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Tencent
[2012/03/31 15:17:05 | 000,000,000 | —D | C] – C:\Users\Win\riotsGamesLogs
[2012/03/31 15:16:32 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Roaming\LolClient
[2012/03/31 14:06:37 | 000,000,000 | —D | C] – C:\Riot Games
[2012/03/31 14:06:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
[2012/03/31 13:00:01 | 000,000,000 | —D | C] – C:\Users\Win\Desktop\LeagueOfLegends
[2012/03/31 12:55:30 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Local\PMB Files
[2012/03/31 12:55:23 | 000,000,000 | —D | C] – C:\ProgramData\PMB Files
[2012/03/31 12:54:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\Pando Networks
[2012/03/30 11:37:41 | 000,000,000 | —D | C] – C:\Users\Win\Desktop\Introduction
[2012/03/28 23:51:57 | 000,000,000 | —D | C] – C:\Users\Win\Desktop\Catch.Me.If.You.Can[ENG][DVDRip]
[2012/03/28 00:42:48 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Local\BlueStacksSetup
[2012/03/28 00:42:48 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Local\BlueStacks
[2012/03/27 19:26:24 | 000,000,000 | —D | C] – C:\Users\Win\Documents\Wizards of the Coast
[2012/03/27 19:24:40 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Duels of the Planeswalkers 2012
[2012/03/27 19:15:28 | 000,000,000 | —D | C] – C:\DirectX
[2012/03/27 00:51:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Steam
[2012/03/26 12:36:42 | 000,000,000 | —D | C] – C:\Users\Win\AppData\Local\SKIDROW
[2012/03/26 02:13:46 | 000,000,000 | —D | C] – C:\Windows\SysWow64\directx
[2012/03/25 13:36:31 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Thunder Network
[2012/03/25 13:36:30 | 000,000,000 | —D | C] – C:\ProgramData\Xunlei
[2012/03/25 13:35:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\迅雷软件
[2012/03/25 13:35:07 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Thunder Network
[2012/03/25 13:35:05 | 000,000,000 | —D | C] – C:\ProgramData\Thunder Network
[2012/03/25 01:48:11 | 000,000,000 | —D | C] – C:\Users\Win\Desktop\Music
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/20 02:56:27 | 000,010,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/20 02:56:27 | 000,010,240 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/20 02:49:35 | 000,045,056 | —- | M] () – C:\Windows\SysNative\acovcnt.exe
[2012/04/20 02:49:14 | 000,411,845 | —- | M] () – C:\log_config.dat
[2012/04/20 02:49:01 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/04/20 02:48:46 | 2088,144,895 | -HS- | M] () – C:\hiberfil.sys
[2012/04/20 02:20:00 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2644376346-2394491102-593013250-1000UA.job
[2012/04/20 02:17:15 | 000,153,199 | —- | M] () – C:\Users\Win\Desktop\QQ截图20120420021710.jpg
[2012/04/20 01:34:35 | 000,000,970 | —- | M] () – C:\Users\Public\Desktop\FXCM Micro Trading Station II.lnk
[2012/04/19 23:34:43 | 000,034,726 | —- | M] () – C:\Users\Win\Documents\keyfile_u
[2012/04/19 23:34:43 | 000,000,016 | —- | M] () – C:\Users\Win\Documents\keyfile
[2012/04/19 02:02:48 | 000,011,776 | —- | M] () – C:\Users\Win\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/04/18 20:32:39 | 000,001,778 | —- | M] () – C:\Windows\SysNative\AutoRunFilter.ini
[2012/04/18 20:32:39 | 000,001,553 | —- | M] () – C:\Windows\SysNative\ServiceFilter.ini
[2012/04/18 13:55:40 | 000,726,316 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/04/18 13:55:40 | 000,616,182 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/04/18 13:55:40 | 000,106,562 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/04/18 13:19:06 | 000,001,810 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/04/18 12:58:01 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012/04/18 12:20:00 | 000,000,848 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2644376346-2394491102-593013250-1000Core.job
[2012/04/17 02:06:01 | 001,808,942 | —- | M] () – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\Cat.DB
[2012/04/17 02:05:12 | 000,058,288 | —- | M] (Symantec Corporation) – C:\Windows\SysNative\snacnp.dll
[2012/04/17 02:05:11 | 000,288,176 | —- | M] (Symantec Corporation) – C:\Windows\SysNative\SymVPN.dll
[2012/04/17 02:05:11 | 000,081,840 | —- | M] (Symantec Corporation) – C:\Windows\SysNative\FwsVpn.dll
[2012/04/17 02:05:11 | 000,042,632 | —- | M] (Symantec Corporation) – C:\Windows\SysNative\drivers\WGX64.SYS
[2012/04/17 01:58:59 | 000,174,200 | —- | M] (Symantec Corporation) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS
[2012/04/17 01:58:59 | 000,007,530 | —- | M] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.CAT
[2012/04/17 01:58:59 | 000,000,855 | —- | M] () – C:\Windows\SysNative\drivers\SYMEVENT64x86.INF
[2012/04/17 01:58:18 | 000,000,114 | —- | M] () – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\isolate.ini
[2012/04/16 23:10:35 | 000,000,824 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/16 22:54:36 | 000,035,191 | —- | M] () – C:\Users\Win\Desktop\bookmarks_4_16_12.html
[2012/04/15 14:22:45 | 000,002,351 | —- | M] () – C:\Users\Win\Desktop\Google Chrome.lnk
[2012/04/14 23:31:15 | 003,396,298 | —- | M] () – C:\Users\Win\Desktop\P1020855.JPG
[2012/04/14 23:16:50 | 003,313,894 | —- | M] () – C:\Users\Win\Desktop\P1020847.JPG
[2012/04/14 23:14:40 | 003,248,746 | —- | M] () – C:\Users\Win\Desktop\P1020854.JPG
[2012/04/14 23:14:22 | 003,300,586 | —- | M] () – C:\Users\Win\Desktop\P1020853.JPG
[2012/04/14 23:14:02 | 003,400,353 | —- | M] () – C:\Users\Win\Desktop\P1020852.JPG
[2012/04/14 23:13:48 | 003,324,029 | —- | M] () – C:\Users\Win\Desktop\P1020851.JPG
[2012/04/14 23:13:40 | 003,398,163 | —- | M] () – C:\Users\Win\Desktop\P1020850.JPG
[2012/04/14 23:13:26 | 003,402,451 | —- | M] () – C:\Users\Win\Desktop\P1020849.JPG
[2012/04/12 01:47:32 | 005,303,179 | —- | M] () – C:\Users\Win\Documents\gsgssg.wma
[2012/04/12 01:29:22 | 004,162,719 | —- | M] () – C:\Users\Win\Desktop\fafafa.wma
[2012/04/07 02:32:22 | 000,001,308 | —- | M] () – C:\Users\Win\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2012/04/07 01:05:38 | 000,001,249 | —- | M] () – C:\Users\Public\Desktop\WebStorage Sync.lnk
[2012/04/07 00:42:49 | 000,001,094 | —- | M] () – C:\Users\Public\Desktop\LifeFrame.lnk
[2012/04/02 19:41:14 | 000,018,760 | —- | M] () – C:\Windows\SysWow64\QQVistaHelper.dll
[2012/03/31 17:43:49 | 000,001,052 | —- | M] () – C:\Users\Win\Desktop\迅雷7.lnk
[2012/03/31 17:43:49 | 000,001,052 | —- | M] () – C:\Users\Win\Application Data\Microsoft\Internet Explorer\Quick Launch\迅雷7.lnk
[2012/03/31 14:12:03 | 000,001,722 | —- | M] () – C:\Users\Public\Desktop\Play League of Legends.lnk
[2012/03/31 12:34:38 | 000,456,936 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/03/27 19:47:02 | 000,001,181 | —- | M] () – C:\Users\Win\Application Data\Microsoft\Internet Explorer\Quick Launch\GOM Player.lnk
[2012/03/27 19:47:02 | 000,001,157 | —- | M] () – C:\Users\Public\Desktop\GOM Player.lnk
[2012/03/27 19:24:40 | 000,000,833 | —- | M] () – C:\Users\Win\Desktop\Duels of the Planeswalkers 2012.lnk
[2012/03/27 19:16:24 | 000,272,629 | —- | M] () – C:\Windows\SysNative\drivers\RTAIODAT.DAT
[2012/03/26 12:59:57 | 000,000,167 | —- | M] () – C:\Windows\SysWow64\config.cfg
[2012/03/25 13:35:55 | 000,000,488 | —- | M] () – C:\Users\Public\Desktop\迅雷高清影片免费下载.lnk
[2012/03/25 13:35:55 | 000,000,480 | —- | M] () – C:\Users\Public\Desktop\迅雷看看-免费高清电影.lnk
[2012/03/25 13:35:16 | 000,000,020 | —- | M] () – C:\Windows\SysWow64\pub_store.dat
[2012/03/23 01:43:45 | 000,000,531 | —- | M] () – C:\Users\Win\Desktop\gta_sa.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/20 02:17:15 | 000,153,199 | —- | C] () – C:\Users\Win\Desktop\QQ截图20120420021710.jpg
[2012/04/20 01:34:34 | 000,000,970 | —- | C] () – C:\Users\Public\Desktop\FXCM Micro Trading Station II.lnk
[2012/04/19 00:14:23 | 000,002,507 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Movie Maker 2.6.lnk
[2012/04/18 13:19:06 | 000,001,810 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/04/18 12:37:43 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/04/18 12:37:43 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/04/18 12:37:43 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/04/18 12:37:43 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/04/18 12:37:43 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/04/17 02:05:14 | 001,808,942 | —- | C] () – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\Cat.DB
[2012/04/17 01:58:18 | 000,000,114 | —- | C] () – C:\Windows\SysNative\drivers\SEP\0C0103E8\009D.105\x64\isolate.ini
[2012/04/16 22:54:35 | 000,035,191 | —- | C] () – C:\Users\Win\Desktop\bookmarks_4_16_12.html
[2012/04/14 23:30:41 | 003,396,298 | —- | C] () – C:\Users\Win\Desktop\P1020855.JPG
[2012/04/14 23:16:17 | 003,400,353 | —- | C] () – C:\Users\Win\Desktop\P1020852.JPG
[2012/04/14 23:16:16 | 003,402,451 | —- | C] () – C:\Users\Win\Desktop\P1020849.JPG
[2012/04/14 23:16:16 | 003,398,163 | —- | C] () – C:\Users\Win\Desktop\P1020850.JPG
[2012/04/14 23:16:16 | 003,324,029 | —- | C] () – C:\Users\Win\Desktop\P1020851.JPG
[2012/04/14 23:16:16 | 003,313,894 | —- | C] () – C:\Users\Win\Desktop\P1020847.JPG
[2012/04/14 23:16:16 | 003,300,586 | —- | C] () – C:\Users\Win\Desktop\P1020853.JPG
[2012/04/14 23:16:16 | 003,248,746 | —- | C] () – C:\Users\Win\Desktop\P1020854.JPG
[2012/04/12 01:47:32 | 005,303,179 | —- | C] () – C:\Users\Win\Documents\gsgssg.wma
[2012/04/12 01:29:22 | 004,162,719 | —- | C] () – C:\Users\Win\Desktop\fafafa.wma
[2012/04/07 02:32:22 | 000,001,308 | —- | C] () – C:\Users\Win\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2012/04/07 02:25:37 | 000,272,629 | —- | C] () – C:\Windows\SysNative\drivers\RTAIODAT.DAT
[2012/04/07 01:05:38 | 000,001,249 | —- | C] () – C:\Users\Public\Desktop\WebStorage Sync.lnk
[2012/04/07 00:42:49 | 000,001,094 | —- | C] () – C:\Users\Public\Desktop\LifeFrame.lnk
[2012/04/02 19:47:41 | 000,001,906 | —- | C] () – C:\Users\Win\Desktop\腾讯QQ.lnk
[2012/03/31 14:12:03 | 000,001,722 | —- | C] () – C:\Users\Public\Desktop\Play League of Legends.lnk
[2012/03/30 13:16:54 | 000,002,543 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint Viewer .lnk
[2012/03/27 18:07:35 | 000,000,833 | —- | C] () – C:\Users\Win\Desktop\Duels of the Planeswalkers 2012.lnk
[2012/03/26 02:00:52 | 000,000,167 | —- | C] () – C:\Windows\SysWow64\config.cfg
[2012/03/25 13:35:55 | 000,001,052 | —- | C] () – C:\Users\Win\Desktop\迅雷7.lnk
[2012/03/25 13:35:55 | 000,001,052 | —- | C] () – C:\Users\Win\Application Data\Microsoft\Internet Explorer\Quick Launch\迅雷7.lnk
[2012/03/25 13:35:55 | 000,000,488 | —- | C] () – C:\Users\Public\Desktop\迅雷高清影片免费下载.lnk
[2012/03/25 13:35:55 | 000,000,480 | —- | C] () – C:\Users\Public\Desktop\迅雷看看-免费高清电影.lnk
[2012/03/25 13:35:16 | 000,000,020 | —- | C] () – C:\Windows\SysWow64\pub_store.dat
[2012/03/23 01:43:45 | 000,000,531 | —- | C] () – C:\Users\Win\Desktop\gta_sa.lnk
[2012/03/14 00:15:33 | 000,051,270 | —- | C] () – C:\Users\Win\AppData\Roaming\room_v3.dat
[2012/02/10 23:21:27 | 000,000,012 | —- | C] () – C:\Windows\SysWow64\bdsecushr.dat
[2011/12/26 01:57:47 | 000,011,776 | —- | C] () – C:\Users\Win\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/19 14:56:52 | 000,001,769 | —- | C] () – C:\Windows\Language_trs.ini
[2011/12/06 13:47:21 | 000,650,752 | —- | C] () – C:\Windows\SysWow64\xvidcore.dll
[2011/12/06 13:47:21 | 000,243,200 | —- | C] () – C:\Windows\SysWow64\xvidvfw.dll
[2011/12/06 13:47:20 | 000,074,752 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2011/11/09 22:28:07 | 000,135,168 | —- | C] () – C:\Windows\SysWow64\SuEapPeerPeap.dll
[2011/11/09 22:28:06 | 000,045,056 | —- | C] () – C:\Windows\SysWow64\SuGina.dll
[2011/11/05 15:19:03 | 000,007,596 | —- | C] () – C:\Users\Win\AppData\Local\Resmon.ResmonCfg
[2011/11/05 15:05:18 | 000,018,760 | —- | C] () – C:\Windows\SysWow64\QQVistaHelper.dll
[2011/11/05 08:01:46 | 000,000,735 | —- | C] () – C:\Windows\FF05_Render_Spk_Hp.ini
[2011/11/05 08:01:46 | 000,000,508 | —- | C] () – C:\Windows\FF05_not_Spk_Hp.ini
[2011/11/05 07:58:58 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2011/11/05 07:58:58 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2011/11/05 07:54:38 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/11/04 23:05:01 | 000,175,616 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2011/10/21 23:07:18 | 001,636,480 | —- | C] () – C:\Windows\SysWow64\SubmitControl.dll
[2011/10/21 23:07:18 | 000,309,888 | —- | C] () – C:\Windows\SysWow64\InputControl.dll
[2011/10/12 16:16:30 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\OpenVideo.dll
[2011/09/14 11:47:40 | 000,053,760 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2011/03/18 01:51:44 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2010/05/25 10:35:12 | 000,348,160 | —- | C] () – C:\Windows\SysWow64\D4Pinpad_ICBC.dll

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/20 20:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2009/07/29 14:03:37 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2012/04/18 13:03:17 | 000,029,418 | —- | M] () – C:\ComboFix.txt
[2011/11/05 08:02:46 | 000,000,086 | —- | M] () – C:\creative.log
[2011/11/05 08:08:06 | 000,000,009 | —- | M] () – C:\Finish.log
[2010/01/05 16:11:30 | 002,097,152 | RH– | M] () – C:\G73Jh.BIN
[2010/01/05 22:03:51 | 000,000,018 | —- | M] () – C:\G73JH_WIN7.10
[2012/04/20 02:48:46 | 2088,144,895 | -HS- | M] () – C:\hiberfil.sys
[2011/11/05 08:04:19 | 000,458,896 | —- | M] () – C:\if.log
[2012/04/20 02:49:14 | 000,411,845 | —- | M] () – C:\log_config.dat
[2012/04/20 02:48:58 | 4215,853,055 | -HS- | M] () – C:\pagefile.sys
[2010/01/05 22:03:51 | 000,000,007 | —- | M] () – C:\RECOVERY.DAT
[2011/11/05 07:59:08 | 000,003,340 | —- | M] () – C:\RHDSetup.log
[2011/11/05 17:50:53 | 000,000,193 | —- | M] () – C:\setup.log
[2005/06/09 14:30:34 | 000,000,502 | —- | M] () – C:\uninst.iss

< %systemroot%\Fonts\*.com >
[2009/07/14 13:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 13:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 13:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 13:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 04:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 12:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >
[2009/02/26 14:50:32 | 000,000,176 | —- | M] () – C:\Windows\explorer.exe.config
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/11/08 13:36:02 | 000,000,221 | -HS- | M] () – C:\Users\Win\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/12/06 13:46:13 | 016,570,750 | —- | M] ( ) – C:\Users\Win\Desktop\K-Lite_Codec_Pack_800_Full.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

OTL Extras logfile created on: 4/20/2012 2:52:03 AM - Run 1
OTL by OldTimer - Version 3.2.40.0 Folder = C:\Users\Win\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.93 Gb Total Physical Memory | 5.63 Gb Available Physical Memory | 71.00% Memory free
15.85 Gb Paging File | 13.27 Gb Available in Paging File | 83.70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232.88 Gb Total Space | 31.37 Gb Free Space | 13.47% Space Free | Partition Type: NTFS
Drive D: | 232.88 Gb Total Space | 22.17 Gb Free Space | 9.52% Space Free | Partition Type: NTFS
Drive E: | 213.34 Gb Total Space | 21.58 Gb Free Space | 10.11% Space Free | Partition Type: NTFS
Drive F: | 232.88 Gb Total Space | 53.28 Gb Free Space | 22.88% Space Free | Partition Type: NTFS
Drive G: | 4.34 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: WIN-PC | User Name: Win | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
htmlfile [print] – rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htafile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot
"{19B62EDC-C108-4393-B3F1-8A813096CC8E}" = Symantec Endpoint Protection
"{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}" = Intel® Turbo Boost Technology Monitor
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5E11C972-1E76-45FE-8F92-14E0D1140B1B}" = iTunes
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6D90C794-8E0C-B534-5911-A275777709F7}" = AMD Media Foundation Decoders
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{765879BD-1A62-F2C4-A5FE-67EF9B6310F1}" = ccc-utility64
"{85EAC5AE-33E2-1794-8BCD-08D7B4E57EBB}" = AMD AVIVO64 Codecs
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}" = ASUS Power4Gear Hybrid
"{94CBEA74-DE51-FE55-8A0E-CFB5FC970517}" = AMD Catalyst Install Manager
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{D1829BE5-F305-4576-9593-C66FC7E0B008}" = iCloud
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"0E74EB10C05C955C24243E6D3120CDC972FC5B1D" = Windows Driver Package - Broadcom HIDClass (06/11/2009 6.2.0.9500)
"2AA10AB519DC7432D599A0E860206A7DDCC27764" = Windows Driver Package - Broadcom Bluetooth (07/29/2009 6.1.7100.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"CCleaner" = CCleaner
"F9FD5BBF579A4BFD40D38BE291F731666B27DC28" = Windows Driver Package - Broadcom Bluetooth (07/17/2009 6.2.0.9403)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"USB 2.0 2.0M UVC WebCam" = USB 2.0 2.0M UVC WebCam
"WinRAR archiver" = WinRAR 4.01 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}" = 腾讯QQ2012(安全防护)
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0E33EC53-22CE-426C-A88B-2AAC231BAC85}" = Catalyst Control Center - Branding
"{15770E26-E64B-3A81-25D0-A0A9DF261B2E}" = HydraVision
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1" = Geeks3D.com FurMark 1.9.1
"{2B81872B-A054-48DA-BE3B-FA5C164C303A}" = ASUS FancyStart
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{38F8D823-008D-4E5A-BBCE-867A86C2BF2B}" = Sound Blaster Audigy HD
"{494367EC-82A9-4C0D-A788-74A967998E8C}" = FXCM Micro Trading Station II
"{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7FB64E72-9B0E-4460-A821-040C341E414A}" = ASUS Ai Charger
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{8FEDDC74-F21D-5D88-D59A-8DF79816DBD4}" = Catalyst Control Center
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95140000-00AF-0409-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{95525636-6277-E383-3753-B8C5E3A05092}" = CCC Help English
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A0039608-8D3E-48CA-8E3E-CF2B6044D409}" = QQProtect
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AC76BA86-7AD7-1033-7B44-A90100000001}" = Adobe Reader 9.0.1
"{AC76BA86-7AD7-2447-0000-900000000003}" = Chinese Simplified Fonts Support For Adobe Reader 9
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5A5627C-0173-4DB2-ADA8-740479370F67}" = Express Gate
"{B72E80DB-DF9B-DE1E-8899-CC74B6B9456A}" = Catalyst Control Center InstallProxy
"{B9ECA41B-55CC-4654-B6B5-6731D009EC69}" = NTI Backup Now EZ
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C3BDCF00-CE03-35A1-D347-7DCD50E81A52}" = Catalyst Control Center Graphics Previews Common
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6B277FE-6F32-02E1-26F2-F77BB26C9D0E}" = Catalyst Control Center Localization All
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader
"{FA2092C5-7979-412D-A962-6485274AE1EE}" = ASUS Data Security Manager
"{FDB88DAF-8DA4-4226-855B-1D816F37AE58}" = Ruijie Supplicant
"AAAAAAAA-AF3F-431a-B683-A12C772E7251" = Tendyron 193D4_ICBC
"Adobe AIR" = Adobe AIR
"ASUS WebStorage" = ASUS WebStorage Sync
"ASUS_Notebook_G73" = ASUS_Notebook_G73 Screen Saver
"CoreAAC" = CoreAAC
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FXCM Micro Trading Station II" = FXCM Micro Trading Station II
"GOM Player" = GOM Player
"GTA San Andreas_is1" = GTA San Andreas
"HWiNFO32_is1" = HWiNFO32 Version 3.88
"im" = Garena Plus
"InstallShield_{B9ECA41B-55CC-4654-B6B5-6731D009EC69}" = NTI Backup Now EZ
"InstallShield_{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader
"KLiteCodecPack_is1" = K-Lite Codec Pack 8.0.0 (Full)
"MPEG2 Codec(libmpeg2/mad)" = MPEG2 Codec(libmpeg2/mad)
"PowerISO" = PowerISO
"QQ拼音输入法" = QQ拼音输入法4.4
"thunder_is1" = 迅雷7
"VLC media player" = VLC media player 1.1.11
"有道词典" = 有道词典
"迅雷看看播放器" = 迅雷看看播放器
"迅雷看看高清播放组件" = 迅雷看看高清播放组件

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2644376346-2394491102-593013250-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/19/2012 12:40:49 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: c:\users\win\appdata\local\temp\dwh5763.exe
by: Manual scan. Action: Quarantine succeeded. Action Description: The file was
quarantined successfully.

Error - 4/19/2012 12:51:13 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: c:\users\win\appdata\local\temp\dwha5f.exe
by: Manual scan. Action: Quarantine succeeded. Action Description: The file was
quarantined successfully.

Error - 4/19/2012 12:52:06 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: c:\users\win\appdata\local\temp\dwhdb09.exe
by: Manual scan. Action: Quarantine succeeded. Action Description: The file was
quarantined successfully.

Error - 4/19/2012 12:52:09 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: c:\users\win\appdata\local\temp\dwhe2c1.exe
by: Manual scan. Action: Quarantine succeeded. Action Description: The file was
quarantined successfully.

Error - 4/19/2012 12:52:25 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: c:\users\win\appdata\local\temp\dwhf809.exe
by: Manual scan. Action: Quarantine succeeded. Action Description: The file was
quarantined successfully.

Error - 4/19/2012 2:27:52 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: C:\Users\Win\AppData\Local\Temp\DWH89D4.exe
by: Auto-Protect scan. Action: Quarantine succeeded : Access denied. Action Description:
The file was quarantined successfully.

Error - 4/19/2012 2:28:48 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: C:\Users\Win\AppData\Local\Temp\DWHAB77.exe
by: Auto-Protect scan. Action: Quarantine succeeded : Access denied. Action Description:
The file was quarantined successfully.

Error - 4/19/2012 2:32:18 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: C:\Users\Win\AppData\Local\Temp\DWH8772.exe
by: Auto-Protect scan. Action: Quarantine succeeded : Access denied. Action Description:
The file was quarantined successfully.

Error - 4/19/2012 2:33:41 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: C:\Users\Win\AppData\Local\Temp\DWH977C.exe
by: Auto-Protect scan. Action: Quarantine succeeded : Access denied. Action Description:
The file was quarantined successfully.

Error - 4/19/2012 2:34:44 PM | Computer Name = Win-PC | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Trojan.Gen in File: C:\Users\Win\AppData\Local\Temp\DWH4604.exe
by: Auto-Protect scan. Action: Quarantine succeeded : Access denied. Action Description:
The file was quarantined successfully.

[ System Events ]
Error - 1/27/2012 3:55:25 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 1/27/2012 3:55:29 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 1/27/2012 3:55:33 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 1/27/2012 3:55:37 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 1/27/2012 3:55:45 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 1/27/2012 3:55:49 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 1/27/2012 3:55:53 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 1/27/2012 3:55:57 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 1/27/2012 3:56:00 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 1/27/2012 3:56:05 PM | Computer Name = Win-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.


< End of report >

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:18:06 AM, on 4/20/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\Youdao\Dict4\YodaoDict.exe
C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Windows\SysWOW64\D4Svr_ICBC.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
C:\Windows\AsScrPro.exe
C:\Program Files (x86)\Youdao\Dict4\5.0.33.3225\wordbook.exe
C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZtray.exe
C:\Users\Win\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Win\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Win\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Win\Downloads\HiJackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\bin\IPS\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - F:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.2.6.3428.dll
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [D4Svr_ICBC.exe] D4Svr_ICBC.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup
O4 - HKLM\..\Run: [Supplicant] C:\Program Files (x86)\Ruijie Networks\Ruijie Supplicant\RuijieSupplicant.exe -tip
O4 - HKLM\..\Run: [ASUS Ai Charger] C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BackupNowEZtray] "C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZtray.exe" -k
O4 - HKLM\..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage Sync\1.0.15.79\AsusWSPanel.exe /S
O4 - HKCU\..\Run: [YodaoDict] "C:\Program Files (x86)\Youdao\Dict4\RunDict.exe" -hide
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: FancyStart daemon.lnk = ?%SystemRoot%\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe
O8 - Extra context menu item: &使用&迅雷下载 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &使用&迅雷下载全部链接 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: &使用&迅雷离线下载 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O8 - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&X;) - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {060CA154-DF25-4F03-98AA-FBCDE9D27382} (TDRDV Class) - https://mybank.icbc.com.cn/icbc/ICBC_TDRDV.cab
O16 - DPF: {0EB487C8-E9AC-43A6-8C4C-083999B0622F} (InfosecCertInstall Class) - https://mybank.icbc.com.cn/icbc/newperbank/certInStall.dll
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/newperbank/…afeControls.cab
O16 - DPF: {B1FBC1AD-5644-4084-882A-0F8BA85E7506} (InfoSecICBCNetSign Class) - https://mybank.icbc.com.cn/icbc/ICBC_NetSign.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: SEP - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\WinLogoutNotifier.dll (file missing)
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NTI BackupNowEZSvr - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZSvr.exe
O23 - Service: OnKey Service _ICBC - Tendyron Corporation - C:\Windows\SysWOW64\D4Ser_ICBC.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: RJ Supplicant Service (RJSuService) - 锐捷网络 - C:\Program Files (x86)\Ruijie Networks\Ruijie Supplicant\SuService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - F:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Symantec Endpoint Protection (SepMasterService) - Symantec Corporation - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\snac64.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TurboBoost - Intel® Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 11900 bytes

.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by [removed] at 3:19:32.26 on 04/20/2012 Fri
Internet Explorer: 9.0.8112.16421
Microsoft Windows 7 Home Premium 6.1.7601.1.936.86.1033.18.8117.5710 [GMT 8:00]
.
AV: Symantec Endpoint Protection *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Symantec Endpoint Protection *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Ruijie Networks\Ruijie Supplicant\SuService.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\FBAgent.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZSvr.exe
C:\Windows\SysWOW64\D4Ser_ICBC.exe
C:\Windows\system32\svchost.exe -k regsvc
C:\Windows\SysWOW64\D4MON_ICBC.exe
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\SysWOW64\svchost -k XLServicePlatform
F:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Windows\SysWOW64\ACEngSvr.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Youdao\Dict4\YodaoDict.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Windows\SysWOW64\D4Svr_ICBC.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Intel\TurboBoost\TurboBoost.exe
C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Youdao\Dict4\5.0.33.3225\wordbook.exe
C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZtray.exe
C:\Program Files (x86)\ASUS\ASUS WebStorage Sync\1.0.15.79\AsusWSPanel.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Youdao\Dict4\5.0.33.3225\YoudaoEH.exe
C:\Program Files (x86)\Youdao\Dict4\5.0.33.3225\YoudaoWSH.exe
C:\Program Files (x86)\ASUS\ASUS WebStorage Sync\1.0.15.79\AsusWSService.exe
C:\Users\Win\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Win\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Win\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\notepad.exe
C:\Windows\notepad.exe
C:\Windows\system32\taskhost.exe
C:\Users\Win\Downloads\HiJackThis.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Users\Win\Downloads\dds.scr
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.symantec.com/enterprise/security_response/index.jsp
mStart Page = about:blank
uInternet Settings,ProxyOverride =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\bin\IPS\IPSBHO.DLL
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: ??à×?????§3?: {889d2feb-5411-4565-8998-1dd2c5261283} - F:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.2.6.3428.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [YodaoDict] "C:\Program Files (x86)\Youdao\Dict4\RunDict.exe" -hide
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [VolPanel] "C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe" /r
mRun: [UpdReg] C:\Windows\UpdReg.EXE
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [D4Svr_ICBC.exe] D4Svr_ICBC.exe
mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup
mRun: [Supplicant] C:\Program Files (x86)\Ruijie Networks\Ruijie Supplicant\RuijieSupplicant.exe -tip
mRun: [ASUS Ai Charger] C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [BackupNowEZtray] "C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZtray.exe" -k
mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage Sync\1.0.15.79\AsusWSPanel.exe /S
StartupFolder: C:\Users\Win\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &使用&迅雷下载 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
IE: &使用&迅雷下载全部链接 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
IE: &使用&迅雷离线下载 - F:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
IE: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm
IE: 导出到 Microsoft Excel(&X;) - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
DPF: {060CA154-DF25-4F03-98AA-FBCDE9D27382} - hxxps://mybank.icbc.com.cn/icbc/ICBC_TDRDV.cab
DPF: {0EB487C8-E9AC-43A6-8C4C-083999B0622F} - hxxps://mybank.icbc.com.cn/icbc/newperbank/certInStall.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://mybank.icbc.com.cn/icbc/newperbank/AxSafeControls.cab
DPF: {B1FBC1AD-5644-4084-882A-0F8BA85E7506} - hxxps://mybank.icbc.com.cn/icbc/ICBC_NetSign.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Notify: SEP - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\WinLogoutNotifier.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: 迅雷下载支持: {004B0726-A010-4ABF-8556-FCDB7F1FCA1E} - F:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.2.6.3428.dll
BHO-X64: XunleiBHO - No File
BHO-X64: {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No File
TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [RunDLLEntry] C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry
mRun-x64: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
.
============= SERVICES / DRIVERS ===============
.
R0 AiCharger;ASUS Charger Driver;C:\Windows\System32\drivers\AiCharger.sys [2012-2-6 14592]
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\SEP\0C0103E8\009D.105\x64\SymDS64.sys [2011-10-30 451192]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\SEP\0C0103E8\009D.105\x64\SymEFA64.sys [2011-10-30 931448]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\BASHDefs\20120402.011\BHDrvx64.sys [2012-4-2 1160824]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver;C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [2011-11-15 30080]
R1 IDSVia64;IDSVia64;C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20120418.001\IDSviA64.sys [2012-4-19 488568]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-23 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-13 12368]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\SEP\0C0103E8\009D.105\x64\Ironx64.sys [2011-10-30 171128]
R1 SYMNETS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\SEP\0C0103E8\009D.105\x64\symnets.sys [2011-10-30 386168]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-14 59904]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-12 140672]
R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-11-5 379520]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-10-13 204288]
R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]
R2 NTI BackupNowEZSvr;NTI BackupNowEZSvr;C:\Program Files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZSvr.exe [2010-9-17 45312]
R2 OnKey Service _ICBC;OnKey Service _ICBC;C:\Windows\SysWOW64\D4Ser_ICBC.exe [2010-5-25 58672]
R2 RJSuService;RJ Supplicant Service;C:\Program Files (x86)\Ruijie Networks\Ruijie Supplicant\SuService.exe [2011-11-9 57344]
R2 SBSDWSCService;SBSD Security Center Service;F:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2012-1-28 1153368]
R2 SepMasterService;Symantec Endpoint Protection;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe [2011-10-30 137224]
R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\drivers\TurboB.sys [2009-8-6 13784]
R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-11-5 2314240]
R2 XLServicePlatform;XLServicePlatform;C:\Windows\system32\svchost -k XLServicePlatform –> C:\Windows\system32\svchost -k XLServicePlatform [?]
R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2011-10-13 10207232]
R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2011-10-13 317952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-4-17 138360]
R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2011-11-5 56344]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\System32\drivers\L1C62x64.sys [2011-11-5 62464]
R3 NdisrdMP;NdisrdMP;C:\Windows\System32\drivers\Ndisrd.sys [2012-1-23 27648]
R3 TurboBoost;TurboBoost;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2009-8-6 118672]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2009-8-21 44032]
S3 btusbflt;Bluetooth USB Filter;C:\Windows\System32\drivers\btusbflt.sys [2011-11-5 52264]
S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2011-11-5 35104]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-11-5 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-11-5 79360]
S3 Ndisrd;WinpkFilter Service;C:\Windows\System32\drivers\Ndisrd.sys [2012-1-23 27648]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-11 56832]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-11-6 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-8-2 51712]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-14 17920]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-12-25 1255736]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
.
=============== Created Last 30 ================
.
2012-04-19 17:34:42 ——– d—–w- C:\Users\Win\AppData\Roaming\FXTS2
2012-04-19 17:34:37 ——– dc-h–w- C:\PROGRA~3\{1C0BEEE7-57A2-48E1-8902-2FB027C1DE5E}
2012-04-19 17:34:32 ——– d—–w- C:\Program Files (x86)\Candleworks
2012-04-19 17:32:30 ——– d—–w- C:\Users\Win\AppData\Local\PackageAware
2012-04-18 16:25:20 ——– d—–w- C:\Users\Win\AppData\Local\WMTools Downloaded Files
2012-04-18 16:14:23 ——– d—–w- C:\Program Files (x86)\Movie Maker 2.6
2012-04-18 05:19:52 ——– d—–w- C:\Users\Win\AppData\Roaming\SUPERAntiSpyware.com
2012-04-18 05:19:01 ——– d—–w- C:\Program Files\SUPERAntiSpyware
2012-04-18 05:19:01 ——– d—–w- C:\PROGRA~3\SUPERAntiSpyware.com
2012-04-18 05:16:27 ——– d-sh–w- C:\$RECYCLE.BIN
2012-04-18 04:37:43 98816 —-a-w- C:\Windows\sed.exe
2012-04-18 04:37:43 518144 —-a-w- C:\Windows\SWREG.exe
2012-04-18 04:37:43 256000 —-a-w- C:\Windows\PEV.exe
2012-04-18 04:37:43 208896 —-a-w- C:\Windows\MBR.exe
2012-04-17 09:47:24 ——– d—–w- C:\Program Files (x86)\Common Files\Symantec Shared
2012-04-16 18:05:11 81840 —-a-w- C:\Windows\System32\FwsVpn.dll
2012-04-16 18:05:11 42632 —-a-w- C:\Windows\System32\drivers\WGX64.SYS
2012-04-16 17:57:32 ——– d—–w- C:\Windows\System32\drivers\SEP\0C0103E8\009D.105\x64
2012-04-16 17:57:32 ——– d—–w- C:\Windows\System32\drivers\SEP\0C0103E8\009D.105
2012-04-16 17:57:32 ——– d—–w- C:\Windows\System32\drivers\SEP\0C0103E8
2012-04-16 17:57:32 ——– d—–w- C:\Windows\System32\drivers\SEP
2012-04-16 16:44:26 ——– d—–w- C:\PROGRA~3\regid.1992_12.com.symantec
2012-04-14 16:41:06 ——– d–h–w- C:\Windows\PIF
2012-04-12 09:51:03 5559152 —-a-w- C:\Windows\System32\ntoskrnl.exe
2012-04-12 09:51:01 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-04-12 09:50:59 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-04-12 09:47:46 23408 —-a-w- C:\Windows\System32\drivers\fs_rec.sys
2012-04-12 09:47:45 81408 —-a-w- C:\Windows\System32\imagehlp.dll
2012-04-12 09:47:44 159232 —-a-w- C:\Windows\SysWow64\imagehlp.dll
2012-04-12 09:47:36 172544 —-a-w- C:\Windows\SysWow64\wintrust.dll
2012-04-12 09:47:35 5120 —-a-w- C:\Windows\SysWow64\wmi.dll
2012-04-12 09:47:35 5120 —-a-w- C:\Windows\System32\wmi.dll
2012-04-12 09:47:35 220672 —-a-w- C:\Windows\System32\wintrust.dll
2012-04-06 18:27:18 ——– d—–w- C:\Windows\SysWow64\RTCOM
2012-04-06 18:24:57 5632 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
2012-04-06 17:21:38 ——– d—–w- C:\aws
2012-04-06 17:21:28 ——– d—–w- C:\Asus WebStorage
2012-04-06 17:05:41 ——– d—–w- C:\Users\Win\AppData\Roaming\ASUS WebStorage
2012-04-06 17:05:37 ——– d—–w- C:\PROGRA~3\ASUS WebStorage
2012-04-04 16:32:49 ——– d—–w- C:\PROGRA~3\QQPet
2012-04-02 11:46:55 ——– d—–w- C:\Program Files (x86)\Tencent
2012-04-02 11:45:05 61440 —-a-r- C:\Users\Win\AppData\Roaming\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe
2012-04-02 11:45:05 61440 —-a-r- C:\Users\Win\AppData\Roaming\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe
2012-04-02 11:45:05 106496 —-a-r- C:\Users\Win\AppData\Roaming\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe
2012-03-31 07:17:05 ——– d—–w- C:\Users\Win\riotsGamesLogs
2012-03-31 07:16:32 ——– d—–w- C:\Users\Win\AppData\Roaming\LolClient
2012-03-31 06:12:00 467984 —-a-w- C:\Windows\SysWow64\d3dx10_39.dll
2012-03-31 06:12:00 1493528 —-a-w- C:\Windows\SysWow64\D3DCompiler_39.dll
2012-03-31 06:11:58 3851784 —-a-w- C:\Windows\SysWow64\D3DX9_39.dll
2012-03-31 06:06:37 ——– d—–w- C:\Riot Games
2012-03-31 04:55:30 ——– d—–w- C:\Users\Win\AppData\Local\PMB Files
2012-03-31 04:55:23 ——– d—–w- C:\PROGRA~3\PMB Files
2012-03-31 04:54:26 ——– d—–w- C:\Program Files (x86)\Pando Networks
2012-03-27 16:42:48 ——– d—–w- C:\Users\Win\AppData\Local\BlueStacksSetup
2012-03-27 16:42:48 ——– d—–w- C:\Users\Win\AppData\Local\BlueStacks
2012-03-27 11:15:28 ——– d—–w- C:\DirectX
2012-03-27 10:00:59 506728 —-a-w- C:\Windows\System32\d3dx10_34.dll
2012-03-26 16:51:22 ——– d—–w- C:\Program Files (x86)\Common Files\Steam
2012-03-26 04:36:42 ——– d—–w- C:\Users\Win\AppData\Local\SKIDROW
2012-03-25 18:13:52 ——– d–h–w- C:\Windows\msdownld.tmp
2012-03-25 18:13:46 ——– d—–w- C:\Windows\SysWow64\directx
2012-03-25 05:36:30 ——– d—–w- C:\PROGRA~3\Xunlei
2012-03-25 05:35:07 ——– d—–w- C:\Program Files (x86)\Common Files\Thunder Network
2012-03-25 05:35:05 ——– d—–w- C:\PROGRA~3\Thunder Network
.
==================== Find3M ====================
.
2012-04-19 18:49:35 45056 —-a-w- C:\Windows\System32\acovcnt.exe
2012-04-16 18:05:12 58288 —-a-w- C:\Windows\System32\snacnp.dll
2012-04-16 18:05:11 288176 —-a-w- C:\Windows\System32\SymVPN.dll
2012-04-16 17:58:59 174200 —-a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2012-04-02 11:41:14 18760 —-a-w- C:\Windows\SysWow64\QQVistaHelper.dll
2012-03-27 09:03:36 4015592 —-a-w- C:\Windows\System32\drivers\RTKVHD64.sys
2012-03-20 02:47:20 3608680 —-a-w- C:\Windows\System32\RtkAPO64.dll
2012-03-19 11:01:20 102504 —-a-w- C:\Windows\System32\RCoInstII64.dll
2012-03-16 08:25:58 2670696 —-a-w- C:\Windows\System32\RtPgEx64.dll
2012-03-13 03:21:10 1251432 —-a-w- C:\Windows\System32\RTCOM64.dll
2012-03-08 03:47:24 108640 —-a-w- C:\Windows\System32\AERTAR64.dll
2012-03-08 03:47:08 202336 —-a-w- C:\Windows\System32\AERTAC64.dll
2012-03-07 03:09:28 824424 —-a-w- C:\Windows\System32\RtkApi64.dll
2012-02-28 06:56:48 2311168 —-a-w- C:\Windows\System32\jscript9.dll
2012-02-28 06:49:56 1390080 —-a-w- C:\Windows\System32\wininet.dll
2012-02-28 06:48:57 1493504 —-a-w- C:\Windows\System32\inetcpl.cpl
2012-02-28 06:42:55 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2012-02-28 01:18:55 1799168 —-a-w- C:\Windows\SysWow64\jscript9.dll
2012-02-28 01:11:21 1427456 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-02-28 01:11:07 1127424 —-a-w- C:\Windows\SysWow64\wininet.dll
2012-02-28 01:03:16 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2012-02-21 11:45:40 2605400 —-a-w- C:\Windows\System32\WavesGUILib.dll
2012-02-21 06:26:00 2528832 —-a-w- C:\Windows\System32\FMAPO64.dll
2012-02-17 06:38:26 1031680 —-a-w- C:\Windows\System32\rdpcore.dll
2012-02-17 05:34:22 826880 —-a-w- C:\Windows\SysWow64\rdpcore.dll
2012-02-17 04:58:24 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-02-17 04:57:32 23552 —-a-w- C:\Windows\System32\drivers\tdtcp.sys
2012-02-13 14:35:54 978776 —-a-w- C:\Windows\System32\MaxxAudioAPOShell64.dll
2012-02-10 06:36:07 1544192 —-a-w- C:\Windows\System32\DWrite.dll
2012-02-10 05:38:43 1077248 —-a-w- C:\Windows\SysWow64\DWrite.dll
2012-02-07 03:02:40 1070352 —-a-w- C:\Windows\SysWow64\MSCOMCTL.OCX
2012-02-03 04:34:34 3145728 —-a-w- C:\Windows\System32\win32k.sys
2012-01-25 06:38:39 77312 —-a-w- C:\Windows\System32\rdpwsx.dll
2012-01-25 06:38:38 149504 —-a-w- C:\Windows\System32\rdpcorekmts.dll
2012-01-25 06:33:30 9216 —-a-w- C:\Windows\System32\rdrmemptylst.exe
2012-01-23 15:03:14 27648 —-a-w- C:\Windows\System32\drivers\Ndisrd.sys
.
============= FINISH: 3:20:24.00 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 11/4/2011 10:18:22 PM
System Uptime: 4/20/2012 2:48:23 AM (1 hours ago)
.
Motherboard: ASUSTeK Computer Inc. | | G73Jh
Processor: Intel® Core™ i7 CPU Q 720 @ 1.60GHz | Socket 989 | 1600/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 30.922 GiB free.
D: is FIXED (NTFS) - 233 GiB total, 22.167 GiB free.
E: is FIXED (NTFS) - 213 GiB total, 21.578 GiB free.
F: is FIXED (NTFS) - 233 GiB total, 53.285 GiB free.
G: is CDROM (UDF)
H: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Virtual WiFi Miniport Adapter
Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&4240F00&0&01
Manufacturer: Microsoft
Name: Microsoft Virtual WiFi Miniport Adapter
PNP Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&4240F00&0&01
Service: vwifimp
.
Class GUID: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Description: Generic Bluetooth Adapter
Device ID: USB\VID_0B05&PID;_1788\1C4BD60551EE
Manufacturer: GenericAdapter
Name: Generic Bluetooth Adapter
PNP Device ID: USB\VID_0B05&PID;_1788\1C4BD60551EE
Service: BTHUSB
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: ASInsHelp
Device ID: ROOT\LEGACY_ASINSHELP\0000
Manufacturer:
Name: ASInsHelp
PNP Device ID: ROOT\LEGACY_ASINSHELP\0000
Service: ASInsHelp
.
==== System Restore Points ===================
.
RP129: 4/20/2012 2:56:47 AM - OTL Restore Point - 4/20/2012 2:56:47 AM
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Acrobat.com
Adobe AIR
Adobe Reader 9.0.1
Alcor Micro USB Card Reader
Apple Application Support
Apple Software Update
ASUS Ai Charger
ASUS Data Security Manager
ASUS FancyStart
ASUS LifeFrame3
ASUS SmartLogon
ASUS Splendid Video Enhancement Technology
ASUS Virtual Camera
ASUS WebStorage Sync
ASUS_Notebook_G73 Screen Saver
ATK Package
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
CCC Help English
Chinese Simplified Fonts Support For Adobe Reader 9
ControlDeck
CoreAAC
Creative MediaSource 5
Express Gate
FXCM Micro Trading Station II
Garena Plus
Geeks3D.com FurMark 1.9.1
GOM Player
Google Chrome
GTA San Andreas
HWiNFO32 Version 3.88
HydraVision
Intel® Management Engine Components
K-Lite Codec Pack 8.0.0 (Full)
League of Legends
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft PowerPoint Viewer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft WSE 3.0 Runtime
MPEG2 Codec(libmpeg2/mad)
NTI Backup Now EZ
Pando Media Booster
PowerISO
QQProtect
QQ拼音输入法4.4
QuickTime
Realtek High Definition Audio Driver
Ruijie Supplicant
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Skype? 5.5
Sound Blaster Audigy HD
Spybot - Search & Destroy
Tendyron 193D4_ICBC
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2598306) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VLC media player 1.1.11
Windows Movie Maker 2.6
WinFlash
Wireless Console 3
有道词典
腾讯QQ2012(安全防护)
迅雷7
迅雷看看播放器
迅雷看看高清播放组件
.
==== Event Viewer Messages From Past Week ========
.
4/20/2012 2:49:17 AM, Error: Service Control Manager [7000] - The ASInsHelp service failed to start due to the following error: The system cannot find the file specified.
4/18/2012 12:51:44 PM, Error: Service Control Manager [7023] - The Windows Defender service terminated with the following error: The specified module could not be found.
4/18/2012 12:50:08 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
4/18/2012 12:48:51 PM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
4/18/2012 12:37:23 PM, Error: Service Control Manager [7031] - The XLServicePlatform service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
4/18/2012 12:34:54 PM, Error: Service Control Manager [7031] - The XLServicePlatform service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
4/17/2012 2:06:48 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SRTSP
4/17/2012 2:05:20 AM, Error: volsnap [25] - The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
4/16/2012 6:40:21 PM, Error: Service Control Manager [7031] - The Symantec Endpoint Protection service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
4/16/2012 11:42:06 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
4/16/2012 11:42:06 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
4/16/2012 11:42:06 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
4/16/2012 11:41:46 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
4/16/2012 11:41:46 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
4/16/2012 10:49:08 PM, Error: Ntfs [137] - The default transaction resource manager on volume I: encountered a non-retryable error and could not start. The data contains the error code.
4/15/2012 12:42:15 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR7.
4/15/2012 1:07:28 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR3.
4/14/2012 5:12:20 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
4/14/2012 11:26:37 PM, Error: Disk [11] - The driver detected a controller error on \…\DR2.
.
==== End Of File ===========================

ComboFix 12-04-20.03 - Win 1/2012 Sat 11:15:48.2.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.936.86.1033.18.8117.6089 [GMT 8:00] 执行位置: c:\users\Win\Downloads\ComboFix.exe AV: Symantec Endpoint Protection *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Symantec Endpoint Protection *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * 成功创造新还原点 . Error: Cfiles.dat . ((((((((((((((((((((((((((((((((((((((( 被删除的档案 ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\TMP1A00.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1A4F.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1A8E.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp1AAF.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\TMP67FF.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp7356.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpD60F.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\TMPEF5E.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpF142.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpF163.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpF1A2.tmp c:\users\Win\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmpFD00.tmp . . ((((((((((((((((((((((((( 2012-03-21 至 2012-04-21 的新的档案 ))))))))))))))))))))))))))))))) . . 2012-04-21 04:34 . 2012-04-21 04:34 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-04-21 03:11 . 2012-04-21 03:11 418464 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-04-19 17:34 . 2012-04-19 17:36 ——– d—–w- c:\users\Win\AppData\Roaming\FXTS2 2012-04-19 17:34 . 2012-04-19 17:34 ——– dc-h–w- c:\programdata\{1C0BEEE7-57A2-48E1-8902-2FB027C1DE5E} 2012-04-19 17:34 . 2012-04-19 17:34 ——– d—–w- c:\program files (x86)\Candleworks 2012-04-19 17:32 . 2012-04-19 17:32 ——– d—–w- c:\users\Win\AppData\Local\PackageAware 2012-04-18 16:25 . 2012-04-18 18:58 ——– d—–w- c:\users\Win\AppData\Local\WMTools Downloaded Files 2012-04-18 16:14 . 2012-04-18 16:14 ——– d—–w- c:\program files (x86)\Movie Maker 2.6 2012-04-18 05:19 . 2012-04-18 05:19 ——– d—–w- c:\users\Win\AppData\Roaming\SUPERAntiSpyware.com 2012-04-18 05:19 . 2012-04-18 05:19 ——– d—–w- c:\program files\SUPERAntiSpyware 2012-04-18 05:19 . 2012-04-18 05:19 ——– d—–w- c:\programdata\SUPERAntiSpyware.com 2012-04-17 09:47 . 2012-04-17 09:47 ——– d—–w- c:\program files (x86)\Common Files\Symantec Shared 2012-04-16 18:05 . 2012-04-16 18:05 81840 —-a-w- c:\windows\system32\FwsVpn.dll 2012-04-16 18:05 . 2012-04-16 18:05 42632 —-a-w- c:\windows\system32\drivers\WGX64.SYS 2012-04-16 17:57 . 2012-04-16 17:57 ——– d—–w- c:\windows\system32\drivers\SEP 2012-04-16 16:44 . 2012-04-16 16:44 ——– d—–w- c:\programdata\regid.1992_12.com.symantec 2012-04-14 16:41 . 2012-04-14 16:41 ——– d–h–w- c:\windows\PIF 2012-04-12 09:51 . 2012-03-06 06:53 5559152 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-04-12 09:51 . 2012-03-06 05:59 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-04-12 09:50 . 2012-03-06 05:59 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-04-12 09:47 . 2012-03-01 06:46 23408 —-a-w- c:\windows\system32\drivers\fs_rec.sys 2012-04-12 09:47 . 2012-03-01 06:33 81408 —-a-w- c:\windows\system32\imagehlp.dll 2012-04-12 09:47 . 2012-03-01 05:33 159232 —-a-w- c:\windows\SysWow64\imagehlp.dll 2012-04-12 09:47 . 2012-03-01 05:37 172544 —-a-w- c:\windows\SysWow64\wintrust.dll 2012-04-12 09:47 . 2012-03-01 06:38 220672 —-a-w- c:\windows\system32\wintrust.dll 2012-04-12 09:47 . 2012-03-01 06:28 5120 —-a-w- c:\windows\system32\wmi.dll 2012-04-12 09:47 . 2012-03-01 05:29 5120 —-a-w- c:\windows\SysWow64\wmi.dll 2012-04-06 18:27 . 2012-04-06 18:27 ——– d—–w- c:\windows\SysWow64\RTCOM 2012-04-06 18:24 . 2005-11-13 15:19 5632 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe 2012-04-06 17:21 . 2012-04-06 17:21 ——– d—–w- C:\aws 2012-04-06 17:21 . 2012-04-06 17:21 ——– d—–w- C:\Asus WebStorage 2012-04-06 17:05 . 2012-04-21 03:07 ——– d—–w- c:\users\Win\AppData\Roaming\ASUS WebStorage 2012-04-06 17:05 . 2012-04-06 17:05 ——– d—–w- c:\programdata\ASUS WebStorage 2012-04-04 16:32 . 2012-04-04 16:32 ——– d—–w- c:\programdata\QQPet 2012-04-02 11:46 . 2012-04-02 11:46 ——– d—–w- c:\program files (x86)\Tencent 2012-04-02 11:45 . 2012-04-02 11:45 61440 —-a-r- c:\users\Win\AppData\Roaming\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe 2012-04-02 11:45 . 2012-04-02 11:45 61440 —-a-r- c:\users\Win\AppData\Roaming\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe 2012-04-02 11:45 . 2012-04-02 11:45 106496 —-a-r- c:\users\Win\AppData\Roaming\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe 2012-03-31 07:17 . 2012-03-31 08:59 ——– d—–w- c:\users\Win\riotsGamesLogs 2012-03-31 07:16 . 2012-03-31 07:16 ——– d—–w- c:\users\Win\AppData\Roaming\LolClient 2012-03-31 06:12 . 2008-07-12 00:18 467984 —-a-w- c:\windows\SysWow64\d3dx10_39.dll 2012-03-31 06:12 . 2008-07-12 00:18 1493528 —-a-w- c:\windows\SysWow64\D3DCompiler_39.dll 2012-03-31 06:11 . 2008-07-12 00:18 3851784 —-a-w- c:\windows\SysWow64\D3DX9_39.dll 2012-03-31 06:06 . 2012-03-31 06:06 ——– d—–w- C:\Riot Games 2012-03-31 04:55 . 2012-03-31 10:43 ——– d—–w- c:\users\Win\AppData\Local\PMB Files 2012-03-31 04:55 . 2012-03-31 10:43 ——– d—–w- c:\programdata\PMB Files 2012-03-31 04:54 . 2012-03-31 04:54 ——– d—–w- c:\program files (x86)\Pando Networks 2012-03-27 16:42 . 2012-03-27 16:42 ——– d—–w- c:\users\Win\AppData\Local\BlueStacks 2012-03-27 11:15 . 2012-03-27 11:15 ——– d—–w- C:\DirectX 2012-03-27 10:00 . 2007-05-16 08:45 506728 —-a-w- c:\windows\system32\d3dx10_34.dll 2012-03-26 16:51 . 2012-03-26 16:59 ——– d—–w- c:\program files (x86)\Common Files\Steam 2012-03-26 04:36 . 2012-03-27 09:44 ——– d—–w- c:\users\Win\AppData\Local\SKIDROW 2012-03-25 18:13 . 2012-03-27 06:19 ——– d–h–w- c:\windows\msdownld.tmp 2012-03-25 05:36 . 2012-03-25 05:36 ——– d—–w- c:\programdata\Xunlei 2012-03-25 05:35 . 2012-03-26 16:37 ——– d—–w- c:\users\Public\Thunder Network 2012-03-25 05:35 . 2012-03-25 05:35 ——– d—–w- c:\program files (x86)\Common Files\Thunder Network 2012-03-25 05:35 . 2012-03-25 05:35 ——– d—–w- c:\programdata\Thunder Network . . . (((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-21 03:11 . 2011-11-04 19:42 70304 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-20 08:12 . 2011-12-27 05:12 45056 —-a-w- c:\windows\system32\acovcnt.exe 2012-04-16 18:05 . 2010-07-01 08:26 58288 —-a-w- c:\windows\system32\snacnp.dll 2012-04-16 18:05 . 2010-08-05 11:10 288176 —-a-w- c:\windows\system32\SymVPN.dll 2012-04-16 17:58 . 2011-11-04 15:29 174200 —-a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS 2012-04-02 11:45 . 2011-11-05 07:07 106496 —-a-r- c:\users\Win\AppData\Roaming\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe 2012-04-02 11:45 . 2011-11-05 07:07 106496 —-a-r- c:\users\Win\AppData\Roaming\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut31_2F252077BA3F4362913955273A708467.exe 2012-04-02 11:41 . 2011-11-05 07:05 18760 —-a-w- c:\windows\SysWow64\QQVistaHelper.dll 2012-02-17 06:38 . 2012-03-15 09:22 1031680 —-a-w- c:\windows\system32\rdpcore.dll 2012-02-17 05:34 . 2012-03-15 09:22 826880 —-a-w- c:\windows\SysWow64\rdpcore.dll 2012-02-17 04:58 . 2012-03-15 09:22 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-02-17 04:57 . 2012-03-15 09:22 23552 —-a-w- c:\windows\system32\drivers\tdtcp.sys 2012-02-10 06:36 . 2012-03-15 09:33 1544192 —-a-w- c:\windows\system32\DWrite.dll 2012-02-10 05:38 . 2012-03-15 09:33 1077248 —-a-w- c:\windows\SysWow64\DWrite.dll 2012-02-07 03:02 . 2012-02-07 03:02 1070352 —-a-w- c:\windows\SysWow64\MSCOMCTL.OCX 2012-02-03 04:34 . 2012-03-15 09:33 3145728 —-a-w- c:\windows\system32\win32k.sys 2012-01-25 06:38 . 2012-03-15 09:22 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-01-25 06:38 . 2012-03-15 09:22 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-01-25 06:33 . 2012-03-15 09:22 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-01-23 15:03 . 2012-01-23 15:03 27648 —-a-w- c:\windows\system32\drivers\Ndisrd.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-04-18_04.58.11 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-14 04:54 . 2012-04-19 15:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2012-04-16 16:07 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-04-19 15:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-04-16 16:07 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-04-19 15:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-04-16 16:07 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-11-04 23:57 . 2012-04-20 08:14 72086 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-04-21 03:08 43900 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-11-04 14:27 . 2012-04-21 03:08 19702 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2644376346-2394491102-593013250-1000_UserData.bin - 2011-11-05 00:54 . 2012-04-16 18:27 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-11-05 00:54 . 2012-04-20 14:15 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-11-05 00:54 . 2012-04-16 18:27 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-11-05 00:54 . 2012-04-20 14:15 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-04-20 14:15 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-04-16 18:27 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-04-21 03:06 . 2012-04-21 03:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-04-18 04:51 . 2012-04-18 04:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-04-18 04:51 . 2012-04-18 04:51 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-04-21 03:06 . 2012-04-21 03:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-04-21 03:11 . 2012-04-21 03:11 353440 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_233_ActiveX.exe + 2012-04-21 03:11 . 2012-04-21 03:11 424608 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_233_ActiveX.dll + 2012-04-21 03:11 . 2012-04-21 03:11 253088 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe - 2009-07-14 02:36 . 2012-04-18 04:24 616182 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-04-20 13:03 616182 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-04-20 13:03 106562 c:\windows\system32\perfc009.dat - 2009-07-14 02:36 . 2012-04-18 04:24 106562 c:\windows\system32\perfc009.dat + 2012-04-21 03:11 . 2012-04-21 03:11 630944 c:\windows\system32\Macromed\Flash\FlashUtil64_11_2_202_233_ActiveX.exe + 2012-04-21 03:11 . 2012-04-21 03:11 462496 c:\windows\system32\Macromed\Flash\FlashUtil64_11_2_202_233_ActiveX.dll - 2009-07-14 05:01 . 2012-04-18 04:50 422752 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2012-04-20 17:22 422752 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-04-19 17:34 . 2012-04-19 17:34 316928 c:\windows\Installer\74e529.msi + 2011-11-05 09:51 . 2012-04-20 17:22 2109416 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2011-11-05 09:51 . 2012-04-18 04:50 2109416 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2012-04-18 16:13 . 2012-04-18 16:13 7357440 c:\windows\Installer\cc7c57.msi + 2012-04-18 16:14 . 2012-04-18 16:14 3274752 c:\windows\Installer\{B3DAF54F-DB25-4586-9EF1-96D24BB14088}\MOVIEMK.exe + 2011-11-08 08:18 . 2012-04-20 17:22 29438756 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2644376346-2394491102-593013250-1000-8192.dat + 2011-11-09 14:22 . 2012-04-20 17:22 10413708 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2644376346-2394491102-593013250-1000-12288.dat . ((((((((((((((((((((((((((((((((((((( 重要登入点 )))))))))))))))))))))))))))))))))))))))))))))))))) . . *注意* 空白与合法缺省登录将不会被显示 REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AAADesktopTips] @="{4562B511-62E9-4533-B7B2-56A8BB10B482}" [HKEY_CLASSES_ROOT\CLSID\{4562B511-62E9-4533-B7B2-56A8BB10B482}] 2012-02-21 10:32 247408 —-a-w- c:\program files (x86)\Common Files\Thunder Network\Kankan\xappex.1.1.1.38.(33).dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1] @="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}" [HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}] 2007-06-01 09:08 143360 —-a-w- c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "YodaoDict"="c:\program files (x86)\Youdao\Dict4\RunDict.exe" [2011-10-25 399040] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-03-07 4785536] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "VolPanel"="c:\program files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe" [2008-12-29 237693] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-12 343168] "ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2011-07-21 5716608] "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624] "HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "D4Svr_ICBC.exe"="D4Svr_ICBC.exe" [2010-05-25 62768] "PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2011-11-15 312376] "Supplicant"="c:\program files (x86)\Ruijie Networks\Ruijie Supplicant\RuijieSupplicant.exe" [2010-12-20 28672] "ASUS Ai Charger"="c:\program files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe" [2010-05-10 465536] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736] "BackupNowEZtray"="c:\program files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZtray.exe" [2010-09-28 577792] "ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage Sync\1.0.15.79\AsusWSPanel.exe" [2012-03-23 4687712] . c:\users\Win\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-3 1080608] FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe [2011-11-5 12862] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SEP] c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\WinLogoutNotifier.dll [BU] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804] IME File REG_SZ IMSC12.IME . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0210804] Ime File REG_SZ QQPINYIN.IME . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 253088] R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x] R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-11-05 79360] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-11-05 79360] R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] R3 GGSAFERDriver;GGSAFER Driver;f:\garena plus\Room\safedrv.sys [x] R3 GPU-Z;GPU-Z;c:\users\Win\AppData\Local\Temp\GPU-Z.sys [x] R3 Ndisrd;WinpkFilter Service;c:\windows\system32\DRIVERS\ndisrd.sys [x] R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [x] S0 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [x] S0 SymDS;Symantec Data Store;c:\windows\system32\Drivers\SEP\0C0103E8\009D.105\x64\SYMDS64.SYS [x] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\Drivers\SEP\0C0103E8\009D.105\x64\SYMEFA64.SYS [x] S1 BHDrvx64;BHDrvx64;c:\programdata\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\BASHDefs\20120413.011\BHDrvx64.sys [2012-04-02 1160824] S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files (x86)\HWiNFO32\HWiNFO64A.SYS [2011-09-22 30080] S1 IDSVia64;IDSVia64;c:\programdata\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Definitions\IPSDefs\20120419.001\IDSvia64.sys [2012-03-16 488568] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\Drivers\SEP\0C0103E8\009D.105\x64\Ironx64.SYS [x] S1 SYMNETS;Symantec Network Security WFP Driver;c:\windows\system32\Drivers\SEP\0C0103E8\009D.105\x64\SYMNETS.SYS [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672] S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416] S2 NTI BackupNowEZSvr;NTI BackupNowEZSvr;c:\program files (x86)\NewTech Infosystems\Backup Now EZ\BackupNowEZSvr.exe [2010-09-17 45312] S2 OnKey Service _ICBC;OnKey Service _ICBC;c:\windows\SysWOW64\D4Ser_ICBC.exe [2010-05-25 58672] S2 RJSuService;RJ Supplicant Service;c:\program files (x86)\Ruijie Networks\Ruijie Supplicant\SuService.exe [2010-12-20 57344] S2 SBSDWSCService;SBSD Security Center Service;f:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S2 SepMasterService;Symantec Endpoint Protection;c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe [2011-10-30 137224] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2314240] S2 XLServicePlatform;XLServicePlatform;c:\windows\system32\svchost [x] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-02-03 138360] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x] S3 NdisrdMP;NdisrdMP;c:\windows\system32\DRIVERS\ndisrd.sys [x] S3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] XLServicePlatform REG_MULTI_SZ XLServicePlatform . ‘计划任务’ 文件夹 里的内容 . 2012-04-21 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 03:11] . 2012-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2644376346-2394491102-593013250-1000Core.job - c:\users\Win\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 19:00] . 2012-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2644376346-2394491102-593013250-1000UA.job - c:\users\Win\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 19:00] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{004B0726-A010-4ABF-8556-FCDB7F1FCA1E}] 2012-03-15 03:22 627888 —-a-w- f:\program files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.2.6.3428.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1] @="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}" [HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}] 2007-06-01 08:52 159744 —-a-w- c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B] @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}" [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}] 2012-03-13 09:23 1500672 —-a-w- c:\program files (x86)\ASUS\ASUS WebStorage Sync\1.0.15.79\AsusWSShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O] @="{64174815-8D98-4CE6-8646-4C039977D808}" [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}] 2012-03-13 09:23 1500672 —-a-w- c:\program files (x86)\ASUS\ASUS WebStorage Sync\1.0.15.79\AsusWSShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_U] @="{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D}" [HKEY_CLASSES_ROOT\CLSID\{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D}] 2012-03-13 09:23 1500672 —-a-w- c:\program files (x86)\ASUS\ASUS WebStorage Sync\1.0.15.79\AsusWSShellExt64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "RunDLLEntry"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568] "AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584] . ——- 而外的扫描 ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.symantec.com/enterprise/security_response/index.jsp mStart Page = about:blank mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = IE: &使用&迅雷下载 - f:\program files (x86)\Thunder Network\Thunder\BHO\geturl.htm IE: &使用&迅雷下载全部链接 - f:\program files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm IE: &使用&迅雷离线下载 - f:\program files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm IE: Google Sidewiki… - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html IE: 使用迅雷看看播放器播放 - c:\users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm IE: 导出到 Microsoft Excel(&X) - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = [removed] [removed] DPF: {060CA154-DF25-4F03-98AA-FBCDE9D27382} - hxxps://mybank.icbc.com.cn/icbc/ICBC_TDRDV.cab DPF: {0EB487C8-E9AC-43A6-8C4C-083999B0622F} - hxxps://mybank.icbc.com.cn/icbc/newperbank/certInStall.dll DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://mybank.icbc.com.cn/icbc/newperbank/AxSafeControls.cab DPF: {B1FBC1AD-5644-4084-882A-0F8BA85E7506} - hxxps://mybank.icbc.com.cn/icbc/ICBC_NetSign.dll . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\SepMasterService] "ImagePath"="\"c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\ccSvcHst.exe\" /s \"Symantec Endpoint Protection\" /m \"c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin\sms.dll\" /prefetch:1" – . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\SmcService] "ImagePath"="\"c:\program files (x86)\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Bin64\Smc.exe\" /prefetch:1" . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\SPBBCDrv] "ImagePath"="" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-2644376346-2394491102-593013250-1000\Software\Microsoft\Internet Explorer\MenuExt\&*O(u&*艔鳀N}廬 @="f:\\Program Files (x86)\\Thunder Network\\Thunder\\BHO\\geturl.htm" "Name"="xl_geturl" "Contexts"=dword:00000022 . [HKEY_USERS\S-1-5-21-2644376346-2394491102-593013250-1000\Software\Microsoft\Internet Explorer\MenuExt\&*O(u&*艔鳀N}廻Q钀] @="f:\\Program Files (x86)\\Thunder Network\\Thunder\\BHO\\GetAllUrl.htm" "Name"="xl_getallurl" "Contexts"=dword:000000f3 . [HKEY_USERS\S-1-5-21-2644376346-2394491102-593013250-1000\Software\Microsoft\Internet Explorer\MenuExt\&*O(u&*艔鳀粂縹N}廬 @="f:\\Program Files (x86)\\Thunder Network\\Thunder\\BHO\\OfflineDownload.htm" "Name"="xl_offlinedownload" "Contexts"=dword:00000022 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\1] @="131473" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Symantec\Symantec Endpoint Protection\CurrentVersion] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Q*Q*黚髼搹eQ誰] "DisplayName"="QQ拼音输入法4.4" "UninstallString"="f:\\Program Files (x86)\\Tencent\\QQPinyin\\4.4.1116.400\\uninst.exe" "DisplayIcon"="f:\\Program Files (x86)\\Tencent\\QQPinyin\\4.4.1116.400\\QQPinyin.ico" "DisplayVersion"="4.4" "Publisher"="腾讯公司" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . 完成时间: 2012-04-21 12:39:23 ComboFix-quarantined-files.txt 2012-04-21 04:39 ComboFix2.txt 2012-04-18 05:03 . Pre-Run: 40,142,135,296 bytes free Post-Run: 39,949,529,088 bytes free . - - End Of File - - 7A7590C4177A06A5511E003579D99C7A