Spyware / Malware / Virus Removal

Window getting hijacked by spyware/malware, [Solved]

27 min read

Looking for the outcome? Ask AI

Edwinnnn Topic Starter

Post #1December 24, 2012, 5:15 PM UTC

Well , yesterday i just surfing the net and suddenly my computer just went crazy . and my antivirus cease to function . i tried dl-ing other Spyware removal programmes but the spyware/malware just simply deleted it . it messed up my IE , System32 files and alot stuffs which i have no knowledge of . my knowledge of IT stuffs are almost as 0% .I can't download the three tools to post the logs as the spyware/malware simply refuse to let me do so . Thanks in advance for kind-hearted souls that are willing to help ! .

oldman960

Post #2December 24, 2012, 5:41 PM UTC

Hi Edwinnnn, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Are the downloads being blocked or are you unable to access the sites that are hosting te tools?

Edwinnnn

Post #3December 24, 2012, 5:57 PM UTC

The tools automatically deleted upon download .., thanks for the quick response when it's christmas:D

oldman960

Post #4December 24, 2012, 6:03 PM UTC

Hi Edwinnnn,

Please note I will be away from the computer off and on today but will try my best to keep the delays as short as possible.

We'll try it this way.

Please download the attached file, help.zip, and save it to your desktop.

Extract the contents to your desktop. You should now have 2 files on your desktop, OTL.exe and scan.txt.

Double click on the OTL icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic
📎help.zip

Edwinnnn

Post #5December 24, 2012, 6:09 PM UTC

wow , tried downloading it but i think the spyware/malware doesn't let me to download programmes . serious problem :X

Edwinnnn

Post #6December 24, 2012, 6:18 PM UTC

P.S. any files that i download it will say XXX.zip contained a virus and was deleted

oldman960

Post #7December 24, 2012, 6:50 PM UTC last edited December 24, 2012, 6:52 PM UTC

Hi Edwinnnn,

Are you able to boot to Safe Mode with networking? It's possible this critter won't be running in Safe Mode.

Please then reboot your computer in Safe Mode with networking by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the option, to run Windows in Safe Mode with networking, then press "Enter".
Choose your usual account.

Try downloading the zip file again. If successful you can run the tool while in safe mode.

BTW do you have access to another computer we can use if necessary?

Edwinnnn

Post #8December 24, 2012, 7:05 PM UTC last edited December 24, 2012, 7:09 PM UTC

still the same D: … automatically deleted upon download .. i could borrow my sis lappy if necessary though.. btw is my problem complicated? . :x

oldman960

Post #9December 24, 2012, 11:41 PM UTC

Hi Edwinnnn, I can't really say how serious the problem is until we get a log. I don't know if the .exe in the zip file is being targeted or just files in general. I'll attach another zip. The instructions will be the same but I will rename OTL.exe to mirror.scr. If you can manage to download the zip just procede as instructed previously. You may need to right click mirror.scr and click "Run as Administrator" to run it. If no joy we will try to transfer the zip to the infected computer. If you can borrow a laptop it will be fine. I prefer you to use a CD to transfer the tools. Download the zip file and save it to a Cd with the laptop. Extract the files to the sick computer's desktop and follow the instructions for running the tool. 📎mirror.zip

Edwinnnn

Post #10December 25, 2012, 7:51 AM UTC

Yesssssss! . i used another browser and successfully dl-ed the programme . like finally D:

OTL logfile created on: 25/12/2012 3:37:38 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kun Jin\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

7.91 Gb Total Physical Memory | 5.89 Gb Available Physical Memory | 74.38% Memory free
15.82 Gb Paging File | 13.57 Gb Available in Paging File | 85.78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453.16 Gb Total Space | 286.34 Gb Free Space | 63.19% Space Free | Partition Type: NTFS

Computer Name: KUNJIN-VAIO | User Name: Kun Jin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Kun Jin\Desktop\mirror.scr (OldTimer Tools)
PRC - C:\Users\Kun Jin\Desktop\Garena Plus\GarenaMessenger.exe ()
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\GarenaTalkOverlay.exe ()
PRC - C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\liebao.exe (Kingsoft Corporation)
PRC - C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\knbcenter.exe (Kingsoft Corporation)
PRC - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCTray.exe (Tencent)
PRC - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCRTP.exe (Tencent)
PRC - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Program Files\TENCENT\AddrUpdate\AddrUpdate.exe (Tencent)
PRC - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe ()
PRC - C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Care\listener.exe (Sony of America Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Users\Kun Jin\Desktop\Garena Plus\xim\plugin_xmpp.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\xim\plugin_yahoo.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\xim\plugin_msn.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\GaFileTransfer.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\XLL.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\TaskManagerLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\StatsPlugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\PluginNews.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\PlatformPlugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\ggplugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\DailyTaskPlugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\xIM.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\VersionModule.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ggspawn.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\GarenaMessenger.exe ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\Overlay.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\GarenaTalkOverlay.exe ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\GarenaTalkPlugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\CxImage.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\Http.dll ()
MOD - C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\avcodec-53.dll ()
MOD - C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\avformat-53.dll ()
MOD - C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\avutil-51.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\FileSender.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ImageModule.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\DibModule.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\FileLoader.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\PluginKernel.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\PluginModule.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\TSWebMon.dat ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\libjpegturbo.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\tinyxml.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\zlib.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\sqlite.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\libexpatw.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\libpng.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\arkGraphic.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\UILayout.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\XmlUIModule.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ggdownloader.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\libzmq.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\ClientTcp.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\UdtLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\fs\YYFileSystem.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\MediaEngine.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\AudioMixerLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ServerMemAlloc.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\RSALib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\sqlite3.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\CommonLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\PluginKernel.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ggcode.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\MP3Module.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\CommonLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lame_enc.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (TBUpdate) – C:\Program Files\Tencent\barupdate\TBUpdate.exe (Tencent)
SRV:64bit: - (ARUpdate) – C:\Program Files\TENCENT\AddrUpdate\AddrUpdate.exe (Tencent)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (VCService) – C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation)
SRV:64bit: - (SampleCollector) – C:\Program Files\Sony\VAIO Care\VCPerfService.exe (Sony Corporation)
SRV:64bit: - (VSNService) – C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation)
SRV:64bit: - (VUAgent) – C:\Program Files\Sony\VAIO Update Common\VUAgent.exe (Sony Corporation)
SRV:64bit: - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV:64bit: - (VAIO Power Management) – C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
SRV:64bit: - (VcmIAlzMgr) – C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV:64bit: - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV:64bit: - (VcmXmlIfHelper) – C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe (Sony Corporation)
SRV:64bit: - (VcmINSMgr) – C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe (Sony Corporation)
SRV:64bit: - (SpfService) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe (Sony Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (kxescore) – c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe (Kingsoft Corporation)
SRV - (Skype C2C Service) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (knbcenter) – C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\knbcenter.exe (Kingsoft Corporation)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (NOBU) – C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
SRV - (QQPCRTP) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCRTP.exe (Tencent)
SRV - (AVP) – C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe ()
SRV - (HssWd) – C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe ()
SRV - (HssSrv) – C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (VAIO Event Service) – C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (Sony Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (IAStorDataMgrSvc) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (PMBDeviceInfoProvider) – C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (BBSvc) – C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (uCamMonitor) – C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
SRV - (SOHCImp) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe (Sony Corporation)
SRV - (SOHDs) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe (Sony Corporation)
SRV - (VCFw) – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (kisknl) – C:\Windows\SysNative\drivers\kisknl.sys (Kingsoft Corporation)
DRV:64bit: - (TFsFlt) – C:\Windows\SysNative\drivers\TFsFltX64.sys (Tencent)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (KLIF) – C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (kneps) – C:\Windows\SysNative\drivers\kneps.sys (Kaspersky Lab)
DRV:64bit: - (klmouflt) – C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab)
DRV:64bit: - (HaozipVirtualCDBus) – C:\Windows\SysNative\drivers\HaoZipVirtualCDBus.sys (Shanghai RuiChuang)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (kl1) – C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kltdi) – C:\Windows\SysNative\drivers\kltdi.sys (Kaspersky Lab)
DRV:64bit: - (klkbdflt) – C:\Windows\SysNative\drivers\klkbdflt.sys (Kaspersky Lab)
DRV:64bit: - (taphss) – C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (intelkmd) – C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (risdsnpe) – C:\Windows\SysNative\drivers\risdsnxc64.sys (REDC)
DRV:64bit: - (rimspci) – C:\Windows\SysNative\drivers\rimssne64.sys (REDC)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (BTWAMPFL) – C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (NETwNs64) – C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (nusb3xhc) – C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) – C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (SFEP) – C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (e1yexpress) – C:\Windows\SysNative\drivers\e1y60x64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ArcSoftKsUFilter) – C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)
DRV - (QqNetflpwControl) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QMNetflow764.sys (tencent)
DRV - (TFsFlt) – C:\Windows\SysWOW64\drivers\TFsFltX64.sys (Tencent)
DRV - (TcHardWare) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCHW-x64.sys (Tencent)
DRV - (TsFltMgr) – C:\Windows\SysWOW64\drivers\TsFltMgr.sys (Tencent)
DRV - (QQSysMonX64) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQSysMonX64.sys (Tencent)
DRV - (TSCPM) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\tscpm64.sys (Tencent)
DRV - (TCSafeBox) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\TCSafeBox64.sys (Tencent)
DRV - (KDHacker) – c:\Program Files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker64.sys (Kingsoft Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://123.duba.net/?f=dbsj
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sony.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.sony.com.sg/microsite/vaio/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {3c35ad63-af1d-4e21-b484-b6651a8efcf9} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {1FF7973D-AB0A-496d-82C1-4EADBBA11E7B}
IE - HKCU\..\SearchScopes\{0067C841-E764-4961-8A21-B159D051DBA9}: "URL" = http://www.bing.com/search?FORM=UP22DF&…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{1FF7973D-AB0A-496d-82C1-4EADBBA11E7B}: "URL" = http://www.soso.com/q?sc=web&cid;=th.ub…;unc=y400372_95
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@kingsfot.com/npkws: C:\Program Files (x86)\kingsoft\kingsoft antivirus\npkws.dll (Kingsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@kingsoft.com/npkvip: c:\program files (x86)\kingsoft\kingsoft antivirus\npkvip.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall: C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/QQlive: C:\Program Files (x86)\Tencent\QQLive\LiveOcx\npQQLive.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/QQPCMgr: C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\npQMExtensionsMozilla.dll (Tencent Technology (Shenzhen) Company Limited)
FF - HKLM\Software\MozillaPlugins\@qq.com/QQPhotoDrawEx: C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll ()
FF - HKLM\Software\MozillaPlugins\@qq.com/QzoneMusic: C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/TXSSO: C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll ()
FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodInsert: C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll (Shenzhen QVOD Technology Co.,Ltd)
FF - HKLM\Software\MozillaPlugins\@RadioRage_4j.com/Plugin: C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll (MindSpark)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/12/24 19:19:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\4jffxtbr@RadioRage_4j.com: C:\Program Files (x86)\RadioRage_4j\bar\1.bin [2012/12/13 01:37:43 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[removed]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[removed]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[removed]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[removed]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\[removed]

========== Chrome ==========

CHR - homepage: http://www.google.com
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}
CHR - homepage: http://www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QQ2011 (Enabled) = C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll
CHR - plugin: NPTXSSO Dynamic Link Library (Enabled) = C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U5 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: QvodInsert (Enabled) = C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll
CHR - plugin: MindSpark Toolbar Platform Plugin Stub (Enabled) = C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Media Go Detector (Enabled) = C:\Program Files (x86)\Sony\Media Go\npmediago.dll
CHR - plugin: \u817E\u8BAF\u89C6\u9891 (Enabled) = C:\Program Files (x86)\Tencent\QQLive\LiveOcx\npQQLive.dll
CHR - plugin: QQMusic (Enabled) = C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll
CHR - plugin: npQQPhotoDrawEx (Enabled) = C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Kingsoft@Firefox ActiveX Comm (Enabled) = c:\program files (x86)\kingsoft\kingsoft antivirus\npkvip.dll
CHR - plugin: Kingsoft Internet Security (Enabled) = c:\program files (x86)\kingsoft\kingsoft antivirus\npkws.dll
CHR - Extension: Kingsoft WebShield Chrome Plugin = C:\Users\Kun Jin\AppData\Local\Google\Chrome\User Data\Default\Extensions\inpnflhagjindbjmegfmdbomaeblalmd\1.0.0.5_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Kun Jin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\

O1 HOSTS File: ([2012/12/21 23:41:49 | 000,000,000 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll File not found
O2:64bit: - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll File not found
O2:64bit: - BHO: (QQ电脑管家网页防火墙) - {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\TSWebMon64.dat (Tencent)
O2:64bit: - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll File not found
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll File not found
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll File not found
O2 - BHO: (IE Search Helper) - {5816DEEA-1962-7AF5-8444-8FB1EB633FE2} - C:\Program Files (x86)\Tencent\SOSOAddr\ieaddr.dll (腾讯)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (电脑管家网页防火墙) - {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\TSWebMon.dat ()
O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll File not found
O2 - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D297} - C:\Program Files (x86)\QvodPlayer\QvodExtend.dll (Shenzhen QVOD Technology Co.,Ltd)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll File not found
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ QQPCTray] C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCTray.exe (Tencent)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe ()
O4 - HKLM..\Run: [Dolby Home Theater v4] C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe (Dolby Laboratories Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [kxesc] c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe (Kingsoft Corporation)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [QvodTerminal] C:\Program Files (x86)\QvodPlayer\QvodTerminal.exe (Shenzhen QVOD Technology Co.,Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [PC Cleaner] C:\Program Files (x86)\PC Cleaner\PCCLauncher.exe (PC Help Soft)
O4 - HKCU..\Run: [QQ2009] C:\Program Files (x86)\Tencent\QQ\Bin\QQ.exe (Tencent)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Domains: qq.com ([cache.tv] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([qqlivecaption] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([qqlivehabit] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([qqlivesearch] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([video_1] http in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB0026D1-9ACC-4583-938F-F56066697B99}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "C:\Users\Kun Jin\AppData\Local\xws.exe" -a "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "C:\Users\Kun Jin\AppData\Local\xws.exe" -a "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
System Restore Service not available.

========== Files/Folders - Created Within 30 Days ==========

[2012/12/25 15:34:42 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Kun Jin\Desktop\mirror.scr
[2012/12/25 01:32:06 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\iolo
[2012/12/24 18:29:25 | 000,000,000 | —D | C] – C:\Windows\ELAMBKUP
[2012/12/24 18:28:42 | 000,000,000 | —D | C] – C:\ProgramData\Kaspersky Lab
[2012/12/24 18:28:19 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2012/12/24 17:50:14 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2013
[2012/12/24 17:49:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Kaspersky Lab
[2012/12/24 17:49:09 | 000,611,160 | —- | C] (Kaspersky Lab) – C:\Windows\SysNative\drivers\klif.sys
[2012/12/24 17:49:09 | 000,089,432 | —- | C] (Kaspersky Lab) – C:\Windows\SysNative\drivers\klflt.sys
[2012/12/24 17:33:34 | 169,850,464 | —- | C] (Kaspersky Lab) – C:\Users\Kun Jin\Desktop\kis13.0.1.4190en_trial.exe
[2012/12/24 17:17:24 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2012/12/24 17:17:24 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\MFAData
[2012/12/24 17:17:24 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2012/12/24 17:17:24 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\Avg2013
[2012/12/24 17:07:25 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\PC Cleaner
[2012/12/24 17:07:21 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2012/12/24 17:07:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Cleaner
[2012/12/24 17:07:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\PC Cleaner
[2012/12/24 16:47:10 | 133,334,048 | —- | C] (COMODO) – C:\Users\Kun Jin\Desktop\cfw_installer.exe
[2012/12/24 16:46:55 | 000,937,232 | —- | C] (Crawler.com ) – C:\Users\Kun Jin\Desktop\SpywareTerminatorSetup.exe
[2012/12/24 16:43:59 | 003,318,416 | —- | C] (PC Help Soft ) – C:\Users\Kun Jin\Desktop\pc-cleaner-335.exe
[2012/12/24 16:38:52 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\ElevatedDiagnostics
[2012/12/24 14:39:10 | 000,525,792 | —- | C] (Microsoft Corporation) – C:\Windows\DIFxAPI.dll
[2012/12/24 14:39:10 | 000,232,272 | —- | C] (Trend Micro Inc.) – C:\Windows\TmNSCIns.dll
[2012/12/24 13:20:39 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}
[2012/12/24 13:02:44 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{204A7560-72B6-43F5-976A-E28701AC22E1}
[2012/12/23 12:33:46 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{BCEC7246-5B8A-442C-8C95-196082AA57E2}
[2012/12/22 13:52:10 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{B0A2F42F-D880-44AF-964C-36F36695BF76}
[2012/12/22 00:55:48 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{2A0EDD02-FCA5-4250-9927-3E1E168F61FD}
[2012/12/21 23:41:35 | 000,000,000 | —D | C] – C:\ProgramData\KRSHistory
[2012/12/21 23:40:48 | 000,000,000 | —D | C] – C:\ProgramData\ksrbm
[2012/12/21 12:55:24 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{F82AAA1F-F1BC-407C-8F84-2081F0269FB5}
[2012/12/21 07:42:47 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/21 07:42:46 | 000,367,616 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/21 07:42:46 | 000,295,424 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/21 07:42:46 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/21 00:55:01 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{6C501E4F-A6C5-469B-9C31-87F473931601}
[2012/12/20 09:10:39 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{059ED6B3-2546-4297-BFCF-DA00C401881A}
[2012/12/19 16:48:50 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\ELEX
[2012/12/19 16:03:26 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\HaoZip
[2012/12/19 16:03:22 | 000,000,000 | —D | C] – C:\Program Files\HaoZip
[2012/12/19 14:52:27 | 000,000,000 | —D | C] – C:\Users\Kun Jin\Documents\eCatalogues
[2012/12/19 14:52:27 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\DNAML
[2012/12/19 14:52:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF2PageTurn
[2012/12/19 14:28:44 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{A28A1782-4D2D-4CD3-9A6A-8109AA73F118}
[2012/12/19 02:07:52 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{443B49A9-F27E-4256-BDCA-D77FFF2CFA61}
[2012/12/18 13:03:12 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{96E630BD-EFE3-4CAE-928D-E242D58904C3}
[2012/12/18 01:02:48 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{4BDEA9C9-6431-4943-B7D1-61637B33E0E1}
[2012/12/17 12:26:43 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{8E59F50E-43DE-4498-8A1D-BAD76BFC2EBF}
[2012/12/16 17:16:33 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{E48AEDD8-9A0E-4516-9176-E3B72537BF77}
[2012/12/15 13:43:15 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\AutoGG
[2012/12/15 12:47:42 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{76BDB65F-AE9A-4CD6-B939-72C37BE4A9EB}
[2012/12/14 13:17:45 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{4C6E2C20-6A07-4742-A896-DC7CCB6CE70D}
[2012/12/14 01:00:11 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{C0F23098-03AA-4027-8FF7-CAE74F913237}
[2012/12/13 11:53:26 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{5732AF26-0062-4F16-B31C-720F79D97A0C}
[2012/12/13 01:10:09 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2012/12/13 01:10:09 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2012/12/13 01:10:08 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2012/12/13 01:10:07 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2012/12/13 01:10:07 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2012/12/13 01:10:07 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2012/12/13 01:10:07 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2012/12/13 01:10:07 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2012/12/13 01:10:06 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2012/12/13 01:10:06 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2012/12/13 01:10:06 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2012/12/13 01:10:06 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2012/12/13 01:10:04 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2012/12/13 01:10:04 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2012/12/13 01:10:04 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2012/12/12 21:11:51 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2012/12/12 21:11:51 | 000,424,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2012/12/12 21:11:51 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2012/12/12 21:11:50 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2012/12/12 21:11:50 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2012/12/12 21:11:50 | 000,243,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2012/12/12 21:11:50 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2012/12/12 21:11:50 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2012/12/12 21:11:50 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2012/12/12 21:11:50 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2012/12/12 21:11:50 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2012/12/12 21:11:50 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 21:11:50 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 21:11:50 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012/12/12 21:11:50 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2012/12/12 21:11:50 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 21:11:50 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 21:11:50 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012/12/12 21:11:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 21:11:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/12/12 21:11:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 21:11:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 21:11:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 21:11:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 21:11:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012/12/12 21:11:49 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/12/12 21:11:49 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/12/12 21:11:49 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012/12/12 21:11:49 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 21:11:49 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 21:11:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012/12/12 21:11:49 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2012/12/12 21:11:27 | 000,478,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dpnet.dll
[2012/12/12 21:11:27 | 000,376,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dpnet.dll
[2012/12/12 15:19:37 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{CC3E7648-A149-40FC-96BD-E66992F8B5A1}
[2012/12/11 11:57:43 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{7B453AD7-48F6-4B62-BFC5-E806655E2D09}
[2012/12/10 19:22:24 | 000,000,000 | —D | C] – C:\Download
[2012/12/10 08:58:40 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{73859F94-1EFA-409B-BDD5-69C9429EF85C}
[2012/12/09 09:45:29 | 000,000,000 | —D | C] – C:\Users\Kun Jin\Desktop\Law Paper
[2012/12/09 09:24:07 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{01E3A7CE-6413-4827-BA9D-CB215A074EE8}
[2012/12/08 09:45:39 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{9D492B60-13A2-45A3-9513-74DB8D45E89C}
[2012/12/07 13:45:59 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{E5135BEF-F4BD-45B9-BE96-C87872A92CA5}
[2012/12/07 01:45:32 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{901026C1-A32A-44A6-9D13-18250DEECB92}
[2012/12/06 13:20:41 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{F378A05F-FC02-484C-9091-FD7AEAB1D4A6}
[2012/12/05 12:51:19 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{4DF2232D-E804-4BD7-B2CF-8718B8FD8A83}
[2012/12/04 09:46:01 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{B5E70262-F0B1-4B7D-955C-59CBBE6D840B}
[2012/12/03 11:01:17 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{68A3CA2D-7C2B-4910-9269-F59C564A1E42}
[2012/12/02 20:53:28 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{D0C1886A-A9C1-446B-90F2-9D897963D7CE}
[2012/12/02 08:53:03 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{24B5285A-52B6-439E-A639-AE5BB29501E1}
[2012/12/01 15:43:44 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{C64F4C01-5B4F-4CBB-ADF2-14C91BF3E194}
[2012/12/01 11:32:32 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\xim
[2012/12/01 00:51:52 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{8C3FCE3A-F2F1-47A3-93B0-AAE7203930CA}
[2012/11/30 11:58:02 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{461F1A2B-98D0-43C4-BD41-8AD5E2646C73}
[2012/11/29 11:59:34 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{6000DE7A-BB23-423E-91E8-F3D7A26782F0}
[2012/11/28 15:42:15 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{FE09B298-74DD-460E-9291-F55002BB081F}
[2012/11/27 16:15:38 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\Skype
[2012/11/27 16:15:30 | 000,000,000 | R–D | C] – C:\Program Files (x86)\Skype
[2012/11/27 16:15:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012/11/27 16:15:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2012/11/27 16:15:23 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2012/11/27 08:18:00 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{BFFD7731-644F-4DB5-A556-2412FE95DE38}
[2012/11/26 18:27:46 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{0538B3D0-F2C0-432D-8624-AC90EDFE9F80}
[2012/11/26 01:29:04 | 000,081,568 | —- | C] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\knbdrv.sys
[2012/11/26 01:29:04 | 000,049,312 | —- | C] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\KNBDrv64.sys
[2012/11/26 01:28:51 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\liebao
[2012/11/26 01:23:28 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{78C15A02-C597-4220-BED4-B0CBB7FC639D}

========== Files - Modified Within 30 Days ==========

[2012/12/25 15:21:11 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/25 15:13:44 | 000,020,928 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/25 15:13:44 | 000,020,928 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/25 15:12:56 | 000,794,862 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/12/25 15:12:56 | 000,676,512 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/12/25 15:12:56 | 000,129,556 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/12/25 15:06:25 | 000,000,384 | —- | M] () – C:\Windows\tasks\RNUpgradeHelperLogonPrompt_Kun Jin.job
[2012/12/25 15:06:22 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/25 15:06:12 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/12/25 15:06:09 | 2077,597,695 | -HS- | M] () – C:\hiberfil.sys
[2012/12/25 11:23:04 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/12/25 01:33:05 | 000,453,952 | —- | M] () – C:\test.xml
[2012/12/25 00:32:28 | 000,000,374 | —- | M] () – C:\Windows\tasks\ReclaimerUpdateXML_Kun Jin.job
[2012/12/24 17:42:17 | 169,850,464 | —- | M] (Kaspersky Lab) – C:\Users\Kun Jin\Desktop\kis13.0.1.4190en_trial.exe
[2012/12/24 17:07:18 | 000,001,030 | —- | M] () – C:\Users\Kun Jin\Desktop\PC Cleaner.lnk
[2012/12/24 16:56:06 | 133,334,048 | —- | M] (COMODO) – C:\Users\Kun Jin\Desktop\cfw_installer.exe
[2012/12/24 16:47:09 | 000,937,232 | —- | M] (Crawler.com ) – C:\Users\Kun Jin\Desktop\SpywareTerminatorSetup.exe
[2012/12/24 16:45:22 | 005,154,304 | —- | M] () – C:\Users\Kun Jin\Desktop\WindowsDefender.msi
[2012/12/24 16:44:07 | 003,318,416 | —- | M] (PC Help Soft ) – C:\Users\Kun Jin\Desktop\pc-cleaner-335.exe
[2012/12/24 13:41:29 | 000,001,447 | —- | M] () – C:\Users\Kun Jin\Desktop\Internet Explorer.lnk
[2012/12/24 13:22:04 | 000,011,862 | -HS- | M] () – C:\Users\Kun Jin\AppData\Local\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl
[2012/12/24 13:13:56 | 000,219,328 | -HS- | M] () – C:\Users\Kun Jin\AppData\Local\xeb.exe
[2012/12/24 13:12:48 | 000,219,328 | -HS- | M] () – C:\Users\Kun Jin\AppData\Local\yaw.exe
[2012/12/24 13:10:58 | 000,001,364 | -HS- | M] () – C:\ProgramData\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl
[2012/12/24 13:10:38 | 000,219,328 | -HS- | M] () – C:\Users\Kun Jin\AppData\Local\pmu.exe
[2012/12/24 13:10:38 | 000,219,328 | -HS- | M] () – C:\Users\Kun Jin\AppData\Local\boy.exe
[2012/12/24 09:44:26 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Kun Jin\Desktop\mirror.scr
[2012/12/23 20:42:03 | 000,000,378 | —- | M] () – C:\Windows\tasks\ReclaimerUpdateFiles_Kun Jin.job
[2012/12/21 23:41:49 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.ics
[2012/12/21 23:41:49 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012/12/21 12:21:52 | 000,301,392 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/19 14:52:22 | 000,001,011 | —- | M] () – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\PDF2PageTurn.lnk
[2012/12/17 01:11:22 | 000,046,080 | —- | M] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2012/12/16 22:45:03 | 000,367,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2012/12/16 22:13:28 | 000,295,424 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2012/12/16 22:13:20 | 000,034,304 | —- | M] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2012/12/15 01:17:30 | 000,045,270 | —- | M] () – C:\Users\Kun Jin\AppData\Roaming\room_v3.dat
[2012/12/12 17:51:23 | 000,697,272 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/12/12 17:51:23 | 000,073,656 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/12/10 18:23:27 | 000,000,522 | —- | M] () – C:\Users\Kun Jin\Desktop\GsNJNwuI-UM.gif
[2012/11/30 12:05:48 | 000,018,296 | —- | M] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\kusbquery64.sys
[2012/11/30 12:05:48 | 000,014,200 | —- | M] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\kusbquery.sys
[2012/11/27 16:15:30 | 000,002,515 | —- | M] () – C:\Users\Public\Desktop\Skype.lnk
[2012/11/27 11:01:14 | 000,274,432 | —- | M] () – C:\Windows\SysWow64\SkinX.dll
[2012/11/26 01:29:04 | 000,049,312 | —- | M] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\KNBDrv64.sys
[2012/11/26 01:29:03 | 000,081,568 | —- | M] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\knbdrv.sys
[2012/11/25 23:28:44 | 000,031,848 | —- | M] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\kavbootc64.sys
[2012/11/25 23:28:41 | 000,027,240 | —- | M] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\kavbootc.sys

========== Files Created - No Company Name ==========

[2012/12/24 17:07:18 | 000,001,030 | —- | C] () – C:\Users\Kun Jin\Desktop\PC Cleaner.lnk
[2012/12/24 16:45:10 | 005,154,304 | —- | C] () – C:\Users\Kun Jin\Desktop\WindowsDefender.msi
[2012/12/24 14:39:10 | 000,001,740 | —- | C] () – C:\Windows\TmTdi.inf
[2012/12/24 13:41:29 | 000,001,447 | —- | C] () – C:\Users\Kun Jin\Desktop\Internet Explorer.lnk
[2012/12/24 13:13:56 | 000,219,328 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\xeb.exe
[2012/12/24 13:12:48 | 000,219,328 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\yaw.exe
[2012/12/24 13:10:58 | 000,011,862 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl
[2012/12/24 13:10:58 | 000,001,364 | -HS- | C] () – C:\ProgramData\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl
[2012/12/24 13:10:38 | 000,219,328 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\pmu.exe
[2012/12/24 13:10:38 | 000,219,328 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\boy.exe
[2012/12/19 14:52:22 | 000,274,432 | —- | C] () – C:\Windows\SysWow64\SkinX.dll
[2012/12/19 14:52:22 | 000,001,011 | —- | C] () – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\PDF2PageTurn.lnk
[2012/12/17 23:35:03 | 000,000,384 | —- | C] () – C:\Windows\tasks\RNUpgradeHelperLogonPrompt_Kun Jin.job
[2012/12/17 23:35:02 | 000,000,378 | —- | C] () – C:\Windows\tasks\ReclaimerUpdateFiles_Kun Jin.job
[2012/12/17 23:35:02 | 000,000,374 | —- | C] () – C:\Windows\tasks\ReclaimerUpdateXML_Kun Jin.job
[2012/12/10 23:12:42 | 000,000,522 | —- | C] () – C:\Users\Kun Jin\Desktop\GsNJNwuI-UM.gif
[2012/11/27 16:15:30 | 000,002,515 | —- | C] () – C:\Users\Public\Desktop\Skype.lnk
[2012/10/07 22:17:17 | 000,000,001 | —- | C] () – C:\Windows\SysWow64\SI.bin
[2012/06/18 09:01:19 | 000,000,419 | —- | C] () – C:\Windows\BRWMARK.INI
[2012/06/18 09:01:19 | 000,000,027 | —- | C] () – C:\Windows\BRPP2KA.INI
[2012/04/15 22:06:47 | 000,018,760 | —- | C] () – C:\Windows\SysWow64\QQVistaHelper.dll
[2012/01/06 23:36:54 | 000,000,243 | —- | C] () – C:\ProgramData\MusicStation.xml
[2011/12/22 19:19:02 | 000,045,270 | —- | C] () – C:\Users\Kun Jin\AppData\Roaming\room_v3.dat
[2011/08/10 09:57:07 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/08/10 09:53:22 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblup.dat
[2011/07/28 09:26:00 | 000,963,116 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2011/07/28 09:25:59 | 013,906,944 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll
[2011/07/28 09:25:59 | 000,218,304 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2011/07/28 09:25:59 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/07/28 09:25:59 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2011/07/28 09:25:59 | 000,028,732 | —- | C] () – C:\Windows\SysWow64\ativvsny.dat
[2011/07/28 09:25:59 | 000,026,936 | —- | C] () – C:\Windows\SysWow64\ativvsnl.dat
[2011/07/28 09:25:58 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/06/30 23:01:52 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2011/06/29 09:44:43 | 000,066,856 | —- | C] () – C:\Windows\SysWow64\SynTPEnhPS.dll
[2011/02/15 08:47:22 | 000,780,986 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI

========== ZeroAccess Check ==========

[2009/07/14 12:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 13:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 12:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 09:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/21 11:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 09:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2012/04/24 21:50:49 | 000,000,090 | -HS- | M] () – C:\desktop.ini
[2012/12/25 15:06:09 | 2077,597,695 | -HS- | M] () – C:\hiberfil.sys
[2012/12/25 15:06:10 | 4201,787,391 | -HS- | M] () – C:\pagefile.sys
[2011/08/10 09:50:01 | 000,002,569 | —- | M] () – C:\RHDSetup.log
[2011/12/20 20:58:18 | 000,000,075 | -H– | M] () – C:\splash.idx
[2012/12/25 01:33:05 | 000,453,952 | —- | M] () – C:\test.xml
[2011/07/08 08:10:38 | 000,004,112 | -H– | M] () – C:\version

< %systemroot%\Fonts\*.com >
[2009/07/14 13:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 13:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 13:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 13:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 04:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/03/08 18:37:20 | 000,302,448 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 12:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >
[2012/12/24 16:56:06 | 133,334,048 | —- | M] (COMODO) – C:\Users\Kun Jin\Desktop\cfw_installer.exe
[2012/12/24 17:42:17 | 169,850,464 | —- | M] (Kaspersky Lab) – C:\Users\Kun Jin\Desktop\kis13.0.1.4190en_trial.exe
[2012/12/24 16:44:07 | 003,318,416 | —- | M] (PC Help Soft ) – C:\Users\Kun Jin\Desktop\pc-cleaner-335.exe
[2012/12/24 16:47:09 | 000,937,232 | —- | M] (Crawler.com ) – C:\Users\Kun Jin\Desktop\SpywareTerminatorSetup.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.ADML >
[2010/11/21 15:06:30 | 000,003,695 | —- | M] () MD5=7A4C7F3CB156543113596988479CAFCE – C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\Explorer.adml

< MD5 for: EXPLORER.ADMX >
[2009/06/11 04:53:55 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\winsxs\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_71af9b5b0a86e6b7\Explorer.admx

< MD5 for: EXPLORER.EXE >
[2011/05/27 03:53:26 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/05/27 03:53:26 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/05/27 03:53:26 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/05/27 03:53:26 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/21 11:24:25 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/05/27 03:53:26 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/05/27 03:53:26 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/21 11:24:11 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: EXPLORER.EXE.MUI >
[2011/02/15 08:45:00 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=05BED2A524B8C373BC6770985BB94BC6 – C:\Windows\SysWOW64\vi-VN\explorer.exe.mui
[2011/02/15 08:45:00 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=05BED2A524B8C373BC6770985BB94BC6 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_vi-vn_3f3cfc9cde9afba8\explorer.exe.mui
[2010/11/21 15:06:17 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\en-US\explorer.exe.mui
[2010/11/21 15:06:17 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=4B87EEFDC8E253F846A7DFB49A8E6C70 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui
[2011/02/15 08:45:00 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=91C443347D5081F34509A5257462CD14 – C:\Windows\vi-VN\explorer.exe.mui
[2011/02/15 08:45:00 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=91C443347D5081F34509A5257462CD14 – C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_vi-vn_34e8524aaa3a39ad\explorer.exe.mui
[2010/11/21 15:06:19 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2010/11/21 15:06:19 | 000,022,016 | —- | M] (Microsoft Corporation) MD5=B9F4B1CA23D60775736059D72BA48526 – C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui

< MD5 for: IEXPLORE.EXE >
[2012/06/02 19:47:54 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=004640AB259C1572EBD5FB0A32F63686 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_0dbfc836999db0ca\iexplore.exe
[2012/05/18 07:21:54 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=0129BB16161C2FD9A6B19111AB047198 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_1798a687b4d6030f\iexplore.exe
[2012/11/14 10:56:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=0D286C0FE561D1A7EB30E83A0FF305B2 – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2012/11/14 10:56:04 | 000,757,296 | —- | M] (Microsoft Corporation) MD5=0D286C0FE561D1A7EB30E83A0FF305B2 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16457_none_178ed6e5b4dd3857\iexplore.exe
[2012/06/29 13:02:52 | 000,754,784 | —- | M] (Microsoft Corporation) MD5=1223ACBFC1093852DFF039E189599BBD – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_0d45fcc9807373c2\iexplore.exe
[2012/08/24 15:34:41 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=22CC6CDBA678790046693654C3B212E4 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_1787d4dfb4e386f6\iexplore.exe
[2012/05/18 06:59:46 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=268982F1FD671A077C6A2AF41E351436 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_181271f4ce004017\iexplore.exe
[2012/10/08 16:37:24 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=270A1342BD5AF95CA25A586B4C2F1522 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16455_none_178cd651b4df05a9\iexplore.exe
[2012/08/24 19:23:44 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=2D53C5F71653EF94E7829846405D4ED2 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16450_none_0d332a8d8082c4fb\iexplore.exe
[2012/06/02 17:08:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=34B01BBD8F00B6B9C9248DC4F1E3CD01 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_1799a6d1b4d51c66\iexplore.exe
[2012/10/08 20:29:46 | 000,754,848 | —- | M] (Microsoft Corporation) MD5=49442BA6DCE4B4E3C1CB0AB193FE29AD – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16455_none_0d382bff807e43ae\iexplore.exe
[2012/05/18 10:51:05 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=4E99F42504A99D5024C2EFA015001937 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16446_none_0d43fc3580754114\iexplore.exe
[2012/08/24 18:49:07 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=5A150AFABB25BEA50CEDC8650A7B8A9E – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_0dc3c95e999a1626\iexplore.exe
[2012/06/29 10:45:31 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=5D03518409F37D1483C98869D86E23FF – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_0dc0c880999cca21\iexplore.exe
[2012/06/02 20:52:21 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=610F6596921C4BAA8834ADBB9BE272EE – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16447_none_0d44fc7f80745a6b\iexplore.exe
[2012/08/24 15:49:25 | 000,748,680 | —- | M] (Microsoft Corporation) MD5=62188720CE27B982B4285C03163C9FB3 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20557_none_181873b0cdfad821\iexplore.exe
[2010/11/21 11:24:43 | 000,695,056 | —- | M] (Microsoft Corporation) MD5=86257731DDB311FBC283534CC0091634 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe
[2011/05/27 03:55:11 | 000,748,336 | —- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_17a944edb4ca4c7a\iexplore.exe
[2012/06/29 09:00:47 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=93569D46D79F9756ED077156496AFE23 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16448_none_179aa71bb4d435bd\iexplore.exe
[2012/11/16 11:08:58 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=AC4957E154F750DF54F36ADC8E3E040D – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20565_none_0db6f8de99a3ff69\iexplore.exe
[2012/06/02 16:51:58 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=BE967C74B89577B78FB57C061E12B04C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20553_none_18147288cdfe72c5\iexplore.exe
[2010/11/21 11:25:08 | 000,673,040 | —- | M] (Microsoft Corporation) MD5=C613E69C3B191BB02C7A191741A1D024 – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe
[2012/10/08 16:22:05 | 000,748,704 | —- | M] (Microsoft Corporation) MD5=CECB15F834FC2B4B150449717ADE18DD – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20562_none_1808a252ce07755f\iexplore.exe
[2012/06/29 07:35:27 | 000,748,664 | —- | M] (Microsoft Corporation) MD5=EB4105348272018D096FEB655CD1608C – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20554_none_181572d2cdfd8c1c\iexplore.exe
[2011/05/27 03:55:06 | 000,754,480 | —- | M] (Microsoft Corporation) MD5=F1424C1B9B1813BF825E45DF3790BC8A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16421_none_0d549a9b80698a7f\iexplore.exe
[2012/10/08 19:09:10 | 000,754,824 | —- | M] (Microsoft Corporation) MD5=F61714ABCF9BF0CEF0A6249AD4FD490B – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20562_none_0db3f80099a6b364\iexplore.exe
[2012/11/14 10:19:28 | 000,757,280 | —- | M] (Microsoft Corporation) MD5=F691418EE9A6344AEB5C1B0518FBF8AE – C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20565_none_180ba330ce04c164\iexplore.exe
[2012/05/18 09:37:57 | 000,754,808 | —- | M] (Microsoft Corporation) MD5=F8B2D47ED17C1D087D14EC747E5AC57A – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.20551_none_0dbdc7a2999f7e1c\iexplore.exe
[2012/11/14 15:11:18 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=FD0D2E1FAEBAE5031BE2EB8000D973F1 – C:\Program Files\Internet Explorer\iexplore.exe
[2012/11/14 15:11:18 | 000,763,424 | —- | M] (Microsoft Corporation) MD5=FD0D2E1FAEBAE5031BE2EB8000D973F1 – C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_9.4.8112.16457_none_0d3a2c93807c765c\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2011/05/27 03:57:56 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=01E762F8A9ADD0EB536BBD0B1A9EE761 – C:\Program Files (x86)\Internet Explorer\zh-CN\iexplore.exe.mui
[2011/05/27 03:57:56 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=01E762F8A9ADD0EB536BBD0B1A9EE761 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_zh-cn_70dc44d2d3996773\iexplore.exe.mui
[2011/08/10 09:45:01 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=156F6CF3DB3D3B3469D6EADDDBCDEB89 – C:\Program Files (x86)\Internet Explorer\zh-HK\iexplore.exe.mui
[2011/08/10 09:45:01 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=156F6CF3DB3D3B3469D6EADDDBCDEB89 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_zh-hk_6f873d60d474da03\iexplore.exe.mui
[2011/05/27 03:55:06 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2011/05/27 03:55:06 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=17FAE936C452188D05852DE8D1082013 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_07013012b816cb66\iexplore.exe.mui
[2011/05/27 03:55:12 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2011/05/27 03:55:12 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=4C71CCB3C8817185E67210856778831F – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_en-us_1155da64ec778d61\iexplore.exe.mui
[2011/05/27 03:56:42 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=659DF231038551F1238525F0C59F8717 – C:\Program Files\Internet Explorer\ar-SA\iexplore.exe.mui
[2011/05/27 03:56:42 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=659DF231038551F1238525F0C59F8717 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_ar-sa_72618c92f3144186\iexplore.exe.mui
[2011/05/27 03:57:07 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=81646C75BE985C873FACCC9D0BCA07CA – C:\Program Files\Internet Explorer\th-TH\iexplore.exe.mui
[2011/05/27 03:57:07 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=81646C75BE985C873FACCC9D0BCA07CA – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_th-th_912753eef1898ea9\iexplore.exe.mui
[2011/08/10 09:45:01 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=9C3EDECF99A5F0BD9E7BF2638114F67F – C:\Program Files\Internet Explorer\zh-HK\iexplore.exe.mui
[2011/08/10 09:45:01 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=9C3EDECF99A5F0BD9E7BF2638114F67F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_zh-hk_6532930ea0141808\iexplore.exe.mui
[2011/05/27 03:57:30 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=A4EA15F0472F67E3CB8EF485FC432B21 – C:\Program Files\Internet Explorer\vi-VN\iexplore.exe.mui
[2011/05/27 03:57:30 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=A4EA15F0472F67E3CB8EF485FC432B21 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_vi-vn_da020998d4fe3378\iexplore.exe.mui
[2009/07/14 10:29:20 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=C29BCFB504E33FEADDFA2D0183CEF62F – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_0b433e7773148b79\iexplore.exe.mui
[2011/05/27 03:57:30 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=CBB41B9F89E274550EEBAEC25E0FA3B5 – C:\Program Files (x86)\Internet Explorer\vi-VN\iexplore.exe.mui
[2011/05/27 03:57:30 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=CBB41B9F89E274550EEBAEC25E0FA3B5 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_vi-vn_e456b3eb095ef573\iexplore.exe.mui
[2011/05/27 03:57:56 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=D69A495BB30EAFC1B11218D5204BE291 – C:\Program Files\Internet Explorer\zh-CN\iexplore.exe.mui
[2011/05/27 03:57:56 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=D69A495BB30EAFC1B11218D5204BE291 – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_zh-cn_66879a809f38a578\iexplore.exe.mui
[2011/05/27 03:56:42 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=E102F39A1680B5586D2F9F29388CB502 – C:\Program Files (x86)\Internet Explorer\ar-SA\iexplore.exe.mui
[2011/05/27 03:56:42 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=E102F39A1680B5586D2F9F29388CB502 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_ar-sa_7cb636e527750381\iexplore.exe.mui
[2011/05/27 03:57:07 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=EC47FDDF5A4CEDCDD81219E49D23CDB1 – C:\Program Files (x86)\Internet Explorer\th-TH\iexplore.exe.mui
[2011/05/27 03:57:07 | 000,005,632 | —- | M] (Microsoft Corporation) MD5=EC47FDDF5A4CEDCDD81219E49D23CDB1 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_9.4.8112.16421_th-th_9b7bfe4125ea50a4\iexplore.exe.mui
[2011/02/15 08:45:02 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=EDEDD3C86DCBF555F67F240224903157 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_vi-vn_e667ae87c76e31ec\iexplore.exe.mui
[2011/02/15 08:45:02 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=F4C19E727B42DB8A6A1DF21C4AF06A5D – C:\Windows\winsxs\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7600.16385_vi-vn_dc130435930d6ff1\iexplore.exe.mui
[2009/07/14 10:05:06 | 000,005,120 | —- | M] (Microsoft Corporation) MD5=FBA4CD95930248053A2C3F43CA70B986 – C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_en-us_1597e8c9a7754d74\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE___9.0.8112.16421___IEXPLORE.EXE___9.0.8112.16421___ACCESS_VIOLATION
___74636556___73729___0___.DMP >
[2012/04/24 15:29:38 | 004,953,055 | —- | M] () MD5=820FE0C783DAF24F4AE80CDFE45DF77B – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1335252569\iexplore.exe___9.0.8112.16421___iexplore.exe___9.0.8112.16421___ACCESS_VIOL
ATION___74636556___73729___0___.dmp
[2012/04/24 15:29:38 | 004,953,055 | —- | M] () MD5=820FE0C783DAF24F4AE80CDFE45DF77B – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1335252569\iexplore.exe___9.0.8112.16421___iexplore.exe___9.0.8112.16421___ACCESS_VIOL
ATION___74636556___73729___0___.dmp

< MD5 for: IEXPLORE.EXE___9.0.8112.16421___TSVULFW.DAT___7.0.2825.205___ACCESS_VIOLATION___
35788___73729___0___.DMP >
[2012/06/12 12:34:29 | 000,926,954 | —- | M] () MD5=5AA0ABAA9D4B4BA9D382EAB0DB37C20B – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1339475666\iexplore.exe___9.0.8112.16421___TSVulFW.DAT___7.0.2825.205___ACCESS_VIOLATI
ON___35788___73729___0___.dmp
[2012/06/12 12:34:29 | 000,926,954 | —- | M] () MD5=5AA0ABAA9D4B4BA9D382EAB0DB37C20B – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1339475666\iexplore.exe___9.0.8112.16421___TSVulFW.DAT___7.0.2825.205___ACCESS_VIOLATI
ON___35788___73729___0___.dmp
[2012/06/08 17:00:38 | 000,926,100 | —- | M] () MD5=D41FC27A46BAD362FEE731D042E63A74 – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1339146037\iexplore.exe___9.0.8112.16421___TSVulFW.DAT___7.0.2825.205___ACCESS_VIOLATI
ON___35788___73729___0___.dmp
[2012/06/08 17:00:38 | 000,926,100 | —- | M] () MD5=D41FC27A46BAD362FEE731D042E63A74 – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1339146037\iexplore.exe___9.0.8112.16421___TSVulFW.DAT___7.0.2825.205___ACCESS_VIOLATI
ON___35788___73729___0___.dmp

< MD5 for: IEXPLORE.EXE___9.0.8112.16421___TSVULFW.DAT___7.0.2825.205___ACCESS_VIOLATION___
35788___73729___0___.TXT >
[2012/06/12 12:34:29 | 000,000,203 | —- | M] () MD5=20A9888B09065EE0A7CD0430BB4F8C9C – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1339475666\iexplore.exe___9.0.8112.16421___TSVulFW.DAT___7.0.2825.205___ACCESS_VIOLATI
ON___35788___73729___0___.txt
[2012/06/12 12:34:29 | 000,000,203 | —- | M] () MD5=20A9888B09065EE0A7CD0430BB4F8C9C – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1339475666\iexplore.exe___9.0.8112.16421___TSVulFW.DAT___7.0.2825.205___ACCESS_VIOLATI
ON___35788___73729___0___.txt
[2012/06/08 17:00:38 | 000,000,203 | —- | M] () MD5=81C8C026C51F22641A17E52F74C9C43A – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1339146037\iexplore.exe___9.0.8112.16421___TSVulFW.DAT___7.0.2825.205___ACCESS_VIOLATI
ON___35788___73729___0___.txt
[2012/06/08 17:00:38 | 000,000,203 | —- | M] () MD5=81C8C026C51F22641A17E52F74C9C43A – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1339146037\iexplore.exe___9.0.8112.16421___TSVulFW.DAT___7.0.2825.205___ACCESS_VIOLATI
ON___35788___73729___0___.txt

< MD5 for: IEXPLORE.EXE___9.0.8112.16447___FLASH32_11_3_300_265.OCX___11.3.300.265______144
4A9___73729___0___.DMP >
[2012/07/18 00:54:30 | 000,000,000 | —- | M] () MD5=D41D8CD98F00B204E9800998ECF8427E – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1342544070\iexplore.exe___9.0.8112.16447___Flash32_11_3_300_265.ocx___11.3.300.265____
__1444a9___73729___0___.dmp
[2012/07/18 00:54:30 | 000,000,000 | —- | M] () MD5=D41D8CD98F00B204E9800998ECF8427E – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1342544070\iexplore.exe___9.0.8112.16447___Flash32_11_3_300_265.ocx___11.3.300.265____
__1444a9___73729___0___.dmp

< MD5 for: IEXPLORE.EXE___9.0.8112.16447___FLASH32_11_3_300_265.OCX___11.3.300.265______144
4A9___73729___0___.TXT >
[2012/07/18 00:54:30 | 000,000,204 | —- | M] () MD5=A3B02CBB7DB2859C9E8F6313678E6CB7 – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1342544070\iexplore.exe___9.0.8112.16447___Flash32_11_3_300_265.ocx___11.3.300.265____
__1444a9___73729___0___.txt
[2012/07/18 00:54:30 | 000,000,204 | —- | M] () MD5=A3B02CBB7DB2859C9E8F6313678E6CB7 – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1342544070\iexplore.exe___9.0.8112.16447___Flash32_11_3_300_265.ocx___11.3.300.265____
__1444a9___73729___0___.txt

< MD5 for: IEXPLORE.EXE___9.0.8112.16447___TSVULFW.DAT___7.1.2901.201___ACCESS_VIOLATION___
35861___73729___0___.DMP >
[2012/07/15 14:35:31 | 000,978,176 | —- | M] () MD5=20A72E7E425AFF4FA50EF1532535E042 – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1342334130\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/07/15 14:35:31 | 000,978,176 | —- | M] () MD5=20A72E7E425AFF4FA50EF1532535E042 – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1342334130\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/07/31 23:03:23 | 001,009,071 | —- | M] () MD5=5D799FDAC36B20B31E8AAB0C527F94BD – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1343747003\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/07/31 23:03:23 | 001,009,071 | —- | M] () MD5=5D799FDAC36B20B31E8AAB0C527F94BD – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1343747003\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/07/31 22:51:47 | 001,008,649 | —- | M] () MD5=7D5B32D473205D3888E66CB1C2680139 – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1343746306\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/07/31 22:51:47 | 001,008,649 | —- | M] () MD5=7D5B32D473205D3888E66CB1C2680139 – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1343746306\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp

< MD5 for: IEXPLORE.EXE___9.0.8112.16447___TSVULFW.DAT___7.1.2901.201___ACCESS_VIOLATION___
35861___73729___0___.TXT >
[2012/07/31 22:51:47 | 000,000,203 | —- | M] () MD5=625FEB5F3314DE0B386DF424C58DF912 – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1343746306\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/07/31 22:51:47 | 000,000,203 | —- | M] () MD5=625FEB5F3314DE0B386DF424C58DF912 – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1343746306\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/07/15 14:35:31 | 000,000,204 | —- | M] () MD5=A1D2158883B19920CB7C512D61011FCE – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1342334130\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/07/15 14:35:31 | 000,000,204 | —- | M] () MD5=A1D2158883B19920CB7C512D61011FCE – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1342334130\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/07/31 23:03:23 | 000,000,203 | —- | M] () MD5=E5E512A111834761C396A53F1188842D – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1343747003\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/07/31 23:03:23 | 000,000,203 | —- | M] () MD5=E5E512A111834761C396A53F1188842D – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1343747003\iexplore.exe___9.0.8112.16447___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt

< MD5 for: IEXPLORE.EXE___9.0.8112.16448___IEXPLORE.EXE___9.0.8112.16448______65A14419___73
729___0___.DMP >
[2012/08/20 11:19:09 | 000,000,000 | —- | M] () MD5=D41D8CD98F00B204E9800998ECF8427E – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1345432749\iexplore.exe___9.0.8112.16448___iexplore.exe___9.0.8112.16448______65a14419
___73729___0___.dmp
[2012/08/20 11:19:09 | 000,000,000 | —- | M] () MD5=D41D8CD98F00B204E9800998ECF8427E – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1345432749\iexplore.exe___9.0.8112.16448___iexplore.exe___9.0.8112.16448______65a14419
___73729___0___.dmp

< MD5 for: IEXPLORE.EXE___9.0.8112.16448___IEXPLORE.EXE___9.0.8112.16448______65A14419___73
729___0___.TXT >
[2012/08/20 11:19:09 | 000,000,203 | —- | M] () MD5=B5FF7C5FB060E082BF9272CC5793B060 – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1345432749\iexplore.exe___9.0.8112.16448___iexplore.exe___9.0.8112.16448______65a14419
___73729___0___.txt
[2012/08/20 11:19:09 | 000,000,203 | —- | M] () MD5=B5FF7C5FB060E082BF9272CC5793B060 – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1345432749\iexplore.exe___9.0.8112.16448___iexplore.exe___9.0.8112.16448______65a14419
___73729___0___.txt

< MD5 for: IEXPLORE.EXE___9.0.8112.16448___TSVULFW.DAT___7.1.2901.201___ACCESS_VIOLATION___
35861___73729___0___.DMP >
[2012/09/02 11:17:10 | 001,012,208 | —- | M] () MD5=5BA4190E9367086D4C8067D511B3710B – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1346555829\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/09/02 11:17:10 | 001,012,208 | —- | M] () MD5=5BA4190E9367086D4C8067D511B3710B – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1346555829\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/09/12 10:48:35 | 001,008,519 | —- | M] () MD5=8C77608D4DE9A70A0C34C09E18D98B93 – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1347418114\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/09/12 10:48:35 | 001,008,519 | —- | M] () MD5=8C77608D4DE9A70A0C34C09E18D98B93 – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1347418114\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/08/20 12:24:49 | 001,008,196 | —- | M] () MD5=C0BBCF0FB9784526F9E55F49FF444B91 – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1345436689\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp
[2012/08/20 12:24:49 | 001,008,196 | —- | M] () MD5=C0BBCF0FB9784526F9E55F49FF444B91 – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1345436689\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.dmp

< MD5 for: IEXPLORE.EXE___9.0.8112.16448___TSVULFW.DAT___7.1.2901.201___ACCESS_VIOLATION___
35861___73729___0___.TXT >
[2012/09/02 11:17:10 | 000,000,203 | —- | M] () MD5=2FC65507AA18380DB073C432C9037A43 – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1346555829\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/09/02 11:17:10 | 000,000,203 | —- | M] () MD5=2FC65507AA18380DB073C432C9037A43 – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1346555829\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/09/12 10:48:35 | 000,000,203 | —- | M] () MD5=41737F5AD82A081DB09BDACCE0CEC17D – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1347418114\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/09/12 10:48:35 | 000,000,203 | —- | M] () MD5=41737F5AD82A081DB09BDACCE0CEC17D – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1347418114\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/08/20 12:24:49 | 000,000,204 | —- | M] () MD5=8D1C7CA22FA5EC6A247494E4F6F255EA – C:\Documents and Settings\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1345436689\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt
[2012/08/20 12:24:49 | 000,000,204 | —- | M] () MD5=8D1C7CA22FA5EC6A247494E4F6F255EA – C:\Users\Kun Jin\AppData\Local\Temp\Low\KingsoftDump\1345436689\iexplore.exe___9.0.8112.16448___TSVulFW.DAT___7.1.2901.201___ACCESS_VIOLATI
ON___35861___73729___0___.txt

< MD5 for: IEXPLORE.EXE-A033F7A0.PF >
[2012/12/25 15:29:07 | 000,301,704 | —- | M] () MD5=EFFA82C48782B4160CCFD7EAF4A65DD5 – C:\Windows\Prefetch\IEXPLORE.EXE-A033F7A0.pf

< MD5 for: IEXPLORE.TLG >
[2012/11/24 20:33:36 | 000,013,408 | —- | M] () MD5=1A035C8DAE7630E20C4A0FF697B6A2B3 – C:\Documents and Settings\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Kun Jin\AppData\Roaming\Tencent\Logs\iexplore.tlg
[2012/11/24 20:33:36 | 000,013,408 | —- | M] () MD5=1A035C8DAE7630E20C4A0FF697B6A2B3 – C:\Users\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Kun Jin\AppData\Roaming\Tencent\Logs\iexplore.tlg

< MD5 for: SERVICES >
[2009/06/11 05:00:26 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.1.7600.16385_none_6079f415110c0210\services

< MD5 for: SERVICES.ASFX >
[2011/09/06 01:05:00 | 000,001,836 | —- | M] () MD5=13C89B78521C07A31549C9D09FEF756D – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\pt_BR\Services\Services.asfx
[2011/09/06 01:04:58 | 000,001,888 | RH– | M] () MD5=14A44E8C50067E903D81B951B0F20EC6 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\de_DE\Services\Services.asfx
[2011/09/06 01:05:06 | 000,002,333 | —- | M] () MD5=1F40CE84CCFD99E6EC5633890E6F5DFD – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\uk_UA\Services\Services.asfx
[2011/09/06 01:05:00 | 000,001,765 | —- | M] () MD5=250D79EB795013B6D926B2951024A3BB – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\sv_SE\Services\Services.asfx
[2011/09/06 01:05:06 | 000,001,770 | —- | M] () MD5=326D5A150C48E137EF1A0A086C746888 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\sl_SI\Services\Services.asfx
[2011/09/06 01:05:00 | 000,001,746 | —- | M] () MD5=3412870422FC0A2575E263BAAF0738CC – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\nb_NO\Services\Services.asfx
[2011/09/06 01:05:00 | 000,001,746 | RH– | M] () MD5=3CC88D11998B6835AEB51BBE6D8DF0C3 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\da_DK\Services\Services.asfx
[2011/09/06 01:05:06 | 000,001,792 | —- | M] () MD5=3E6DC2400B088DB84769C8ECD079273B – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\tr_TR\Services\Services.asfx
[2011/09/06 01:04:58 | 000,001,805 | —- | M] () MD5=48174B2E4B2CD1CD1907E5245A3A0B21 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\it_IT\Services\Services.asfx
[2011/09/06 01:05:04 | 000,001,936 | —- | M] () MD5=5F4B370E4002A64521BDD68624EB8108 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\hu_HU\Services\Services.asfx
[2011/09/06 01:05:06 | 000,001,800 | RH– | M] () MD5=7400B0AE9DDCA0F5913679E30C4C0658 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ca_ES\Services\Services.asfx
[2011/09/06 01:05:00 | 000,001,811 | —- | M] () MD5=91625FDA8230436DEFE5900C91A6621E – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\nl_NL\Services\Services.asfx
[2011/09/06 01:05:04 | 000,001,750 | —- | M] () MD5=A340A1AC77219E2CA847F8D6F7FC3A86 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\zh_TW\Services\Services.asfx
[2011/09/06 01:05:02 | 000,001,848 | —- | M] () MD5=ADC1F664D83173C7D8BB2F15FF78B35F – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ko_KR\Services\Services.asfx
[2011/09/06 01:05:04 | 000,001,842 | RH– | M] () MD5=B37B456519095064DF61CD448EE5252D – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\cs_CZ\Services\Services.asfx
[2011/09/06 01:04:58 | 000,001,959 | —- | M] () MD5=C021B27CC046FD08C010C61AAE81E9C7 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ja_JP\Services\Services.asfx
[2011/09/06 01:05:06 | 000,001,847 | —- | M] () MD5=C0EB4141140E016394875D39FAB0B709 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\sk_SK\Services\Services.asfx
[2011/09/06 01:05:02 | 000,001,728 | —- | M] () MD5=C6C7116072CEB7533050E6D8A66373B9 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\zh_CN\Services\Services.asfx
[2011/09/06 01:05:04 | 000,001,785 | —- | M] () MD5=CE2066D362ED22CA6B1D6F85F3CA68CE – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\pl_PL\Services\Services.asfx
[2011/09/06 01:05:06 | 000,001,854 | —- | M] () MD5=D01B5387ADDFDC752452043424FEB665 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ro_RO\Services\Services.asfx
[2010/11/16 12:02:32 | 000,000,228 | R— | M] () MD5=E09422BE0C7636A7B63A1527C4C1372D – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx
[2011/09/06 01:05:00 | 000,002,223 | —- | M] () MD5=E97C70B4BF9C3CB3DFE2DFF39BFA6C9E – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\fi_FI\Services\Services.asfx
[2011/09/06 01:05:00 | 000,001,816 | —- | M] () MD5=ED4417FB4F270254B27E0D2A5FCAA65F – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Services\Services.asfx
[2011/09/06 01:05:06 | 000,002,376 | —- | M] () MD5=F6F160D19299A641F5F4F4CB2558301C – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\ru_RU\Services\Services.asfx
[2011/09/06 01:05:08 | 000,001,763 | —- | M] () MD5=F74ACA6507409484E1DB2F344D61602B – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\eu_ES\Services\Services.asfx
[2011/09/06 01:05:06 | 000,001,793 | —- | M] () MD5=FA15C7EC21355391225D76C910089F50 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\hr_HR\Services\Services.asfx
[2011/09/06 01:04:58 | 000,001,831 | —- | M] () MD5=FE3CE5C3CCD3DF6B436B0DA535E36744 – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\fr_FR\Services\Services.asfx

< MD5 for: SERVICES.ASFX1 >
[2010/11/16 12:02:32 | 000,000,228 | R— | M] () MD5=A7B7A4CC1A717292474115CD3A4AC121 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx1

< MD5 for: SERVICES.ASFX10 >
[2010/11/16 12:02:34 | 000,000,233 | R— | M] () MD5=3382FAB54FC906B0E40269D903A8D690 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx10

< MD5 for: SERVICES.ASFX11 >
[2010/11/16 12:02:26 | 000,000,227 | R— | M] () MD5=F36865AB3B9813962B7EDBE66FA1C28A – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx11

< MD5 for: SERVICES.ASFX12 >
[2010/11/16 12:02:30 | 000,000,225 | R— | M] () MD5=9287C7268CC0F37F1DDE18CEBB128685 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx12

< MD5 for: SERVICES.ASFX13 >
[2010/11/16 12:02:30 | 000,000,228 | R— | M] () MD5=95326C46AC2654AFF5C8543DFE22CCB3 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx13

< MD5 for: SERVICES.ASFX14 >
[2010/11/16 12:02:26 | 000,000,228 | R— | M] () MD5=14DA84ECAF57B5ADA36B9093FF04CF32 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx14

< MD5 for: SERVICES.ASFX15 >
[2010/11/16 12:02:26 | 000,000,231 | R— | M] () MD5=CF94F061685A38BABE0BBD463191EDE7 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx15

< MD5 for: SERVICES.ASFX16 >
[2010/11/16 12:02:34 | 000,000,232 | R— | M] () MD5=B6E63D87C73CED2D6B433C542C5C3965 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx16

< MD5 for: SERVICES.ASFX17 >
[2010/11/16 12:02:34 | 000,000,230 | R— | M] () MD5=545E97C4F4CEA743A8D86B685EE2EDBB – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx17

< MD5 for: SERVICES.ASFX18 >
[2010/11/16 12:02:24 | 000,000,230 | R— | M] () MD5=2577B66F38E0DEA25F328DA4A0FED322 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx18

< MD5 for: SERVICES.ASFX19 >
[2010/11/16 12:02:26 | 000,000,225 | R— | M] () MD5=0A27F1D6595A69800A43CDE155B1E4A0 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx19

< MD5 for: SERVICES.ASFX2 >
[2010/11/16 12:02:36 | 000,000,264 | R— | M] () MD5=0652D24D4E2799851A6DF1705E2BFFDA – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx2

< MD5 for: SERVICES.ASFX20 >
[2010/11/16 12:02:38 | 000,000,231 | R— | M] () MD5=C85F2519DC6AECF93F67AA613A320136 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx20

< MD5 for: SERVICES.ASFX21 >
[2010/11/16 12:02:26 | 000,000,231 | R— | M] () MD5=8C95C0528EA7049A1DFC7A7342461D75 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx21

< MD5 for: SERVICES.ASFX22 >
[2010/11/16 12:02:24 | 000,000,231 | R— | M] () MD5=9F2731666F5771CC5C1E4EEDC8FB8607 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx22

< MD5 for: SERVICES.ASFX23 >
[2010/11/16 12:02:26 | 000,000,225 | R— | M] () MD5=0E89BE53F56B22390CF61584B649CE01 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx23

< MD5 for: SERVICES.ASFX24 >
[2010/11/16 12:02:32 | 000,000,229 | R— | M] () MD5=E57594DB9B9D78AB4B53D34CAFEB8497 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx24

< MD5 for: SERVICES.ASFX25 >
[2010/11/16 12:02:36 | 000,000,232 | R— | M] () MD5=611CB9CC21D2DDAD711690671F70EF39 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx25

< MD5 for: SERVICES.ASFX3 >
[2010/11/16 12:02:34 | 000,000,229 | R— | M] () MD5=F9824728970AC8199BABDC9CBA5E038C – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx3

< MD5 for: SERVICES.ASFX4 >
[2010/11/16 12:02:26 | 000,000,226 | R— | M] () MD5=55EA57D90AE22BDF0132597EF0D7C9C7 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx4

< MD5 for: SERVICES.ASFX5 >
[2010/11/16 12:02:34 | 000,000,233 | R— | M] () MD5=846C265B751189E88B74F0155DB6B828 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx5

< MD5 for: SERVICES.ASFX6 >
[2010/11/16 12:02:36 | 000,000,231 | R— | M] () MD5=89BD37C4118540FD5AA8CDD0C24D6C0A – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx6

< MD5 for: SERVICES.ASFX7 >
[2010/11/16 12:02:34 | 000,000,245 | R— | M] () MD5=0B82FAB8FF5F988C5311DF1144A7D740 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx7

< MD5 for: SERVICES.ASFX8 >
[2010/11/16 12:02:34 | 000,000,231 | R— | M] () MD5=5226417D3C8206000A8983BDC1243075 – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx8

< MD5 for: SERVICES.ASFX9 >
[2010/11/16 12:02:30 | 000,000,234 | R— | M] () MD5=EBD8D036504F2935675F5F432F076DBA – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.asfx9

< MD5 for: SERVICES.CFG >
[2011/09/06 01:04:56 | 000,584,808 | —- | M] () MD5=B3B25937514C772FD2490108B91CE17F – C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\Services.cfg
[2010/11/16 12:02:22 | 000,032,633 | R— | M] () MD5=EA1C35DD541D60819D55482130BD585D – C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\services.cfg

< MD5 for: SERVICES.EXE >
[2009/07/14 09:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009/07/14 09:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2010/11/21 15:06:16 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\SysNative\en-US\services.exe.mui
[2010/11/21 15:06:16 | 000,017,408 | —- | M] (Microsoft Corporation) MD5=6507BF0DC2D1F5F32493C288EAA59277 – C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5f238be3fa63468\services.exe.mui

< MD5 for: SERVICES.LNK >
[2009/07/14 12:54:05 | 000,001,288 | —- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 – C:\Documents and Settings\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/14 12:54:05 | 000,001,288 | —- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2009/07/14 12:54:05 | 000,001,288 | —- | M] () MD5=CA0D9F4743DFF86EBAF09D763139E958 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2009/06/11 04:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2009/06/11 04:44:06 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.mof

< MD5 for: SERVICES.MSC >
[2010/11/21 15:06:14 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\en-US\services.msc
[2009/06/11 04:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysNative\services.msc
[2010/11/21 15:06:17 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\en-US\services.msc
[2009/06/11 05:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\SysWOW64\services.msc
[2010/11/21 15:06:14 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_003408aa160fce5b\services.msc
[2009/06/11 04:38:36 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_2b58d44b5f6beb8a\services.msc
[2010/11/21 15:06:17 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a4156d265db25d25\services.msc
[2009/06/11 05:21:09 | 000,092,745 | —- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 – C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.1.7600.16385_none_cf3a38c7a70e7a54\services.msc

< MD5 for: SERVICES.PTXML >
[2009/07/14 04:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2009/07/14 04:16:17 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\Services.ptxml

< MD5 for: WINLOGON.ADML >
[2010/11/21 15:06:30 | 000,008,013 | —- | M] () MD5=CED0EAD8D152B3D0F114698DE2316C5E – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f0f9032ef6930070\WinLogon.adml

< MD5 for: WINLOGON.ADMX >
[2009/06/11 05:04:41 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.1.7600.16385_none_d7024e6992f3424d\WinLogon.admx

< MD5 for: WINLOGON.EXE >
[2010/11/21 11:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/21 11:24:29 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

< MD5 for: WINLOGON.EXE.MUI >
[2010/11/21 15:06:14 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2010/11/21 15:06:14 | 000,023,040 | —- | M] (Microsoft Corporation) MD5=34C7D2E30868EDAFB191341D963ABA5F – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7601.17514_en-us_291e96fa1ab5fc7b\winlogon.exe.mui
[2011/02/15 08:44:58 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=B80C5C4D3909B7F1DFF9E39A26490B26 – C:\Windows\SysNative\vi-VN\winlogon.exe.mui
[2011/02/15 08:44:58 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=B80C5C4D3909B7F1DFF9E39A26490B26 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.1.7600.16385_vi-vn_f9ee5cb83aaee0f3\winlogon.exe.mui

< MD5 for: WINLOGON.MFL >
[2010/11/21 15:06:15 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2010/11/21 15:06:15 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84afd4fd38ffd276\winlogon.mfl

< MD5 for: WINLOGON.MOF >
[2009/07/14 04:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2009/07/14 04:30:01 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.1.7600.16385_none_dc2dbb778f98e40f\winlogon.mof

========== Files - Unicode (All) ==========
[2012/12/21 23:45:51 | 000,000,940 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\?? Internet Explorer ???.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
[2012/12/21 23:45:51 | 000,000,940 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\?? Internet Explorer ???.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
[2012/12/19 16:03:33 | 000,000,000 | —D | C](C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\2345??) – C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\2345好压
[2012/11/26 01:29:06 | 000,000,000 | —D | C](C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\?????) – C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\猎豹浏览器
[2012/04/15 22:34:42 | 000,001,167 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk
[2012/04/15 22:34:42 | 000,001,167 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk
[2012/04/15 22:09:22 | 000,002,045 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\????.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯视频.lnk
[2012/04/15 22:09:22 | 000,002,045 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\????.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯视频.lnk
[2012/04/15 22:07:12 | 000,002,239 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\??QQ.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯QQ.lnk
[2012/04/15 22:07:12 | 000,002,239 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\??QQ.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯QQ.lnk
(C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\????) – C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\金山毒霸
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯软件

========== Alternate Data Streams ==========

@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:98181191

< End of report >

OTL Extras logfile created on: 25/12/2012 3:37:38 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kun Jin\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

7.91 Gb Total Physical Memory | 5.89 Gb Available Physical Memory | 74.38% Memory free
15.82 Gb Paging File | 13.57 Gb Available in Paging File | 85.78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453.16 Gb Total Space | 286.34 Gb Free Space | 63.19% Space Free | Partition Type: NTFS

Computer Name: KUNJIN-VAIO | User Name: Kun Jin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = Liebao.HTML] – C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\liebao.exe (Kingsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Liebao.HTML] – C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\liebao.exe (Kingsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] – "C:\Users\Kun Jin\AppData\Local\xws.exe" -a "%1" %*
.html [@ = Liebao.HTML] – C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\liebao.exe (Kingsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – "C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\liebao.exe" "%1" (Kingsoft Corporation)
https [open] – "C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\liebao.exe" "%1" (Kingsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – "C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCFileOpen.exe" "%1" (Tencent)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – "C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\liebao.exe" "%1" (Kingsoft Corporation)
https [open] – "C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\liebao.exe" "%1" (Kingsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – "C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCFileOpen.exe" "%1" (Tencent)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08A5E0FE-3F33-407E-90B5-13598914730B}" = lport=137 | protocol=17 | dir=in | app=system |
"{0D65AA73-9B42-46AC-82FD-E49D3EFAF46C}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{0EB84A00-373D-4DF5-835A-348FC5679CE6}" = lport=445 | protocol=6 | dir=in | app=system |
"{11DD1084-D366-4C80-86E9-6EEDD0DB87A2}" = lport=138 | protocol=17 | dir=in | app=system |
"{17EF0A29-391F-4E2B-A9E7-815D64434375}" = rport=445 | protocol=6 | dir=out | app=system |
"{2B35B910-BC15-4977-A25F-96264AED83D0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{39DCB36A-B915-419A-8BCA-EC6207765E2E}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{3DF394BC-143D-413B-A299-6B96E3935184}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{43F3BA51-15CF-4087-AADD-AA55E05E3C0F}" = lport=6886 | protocol=17 | dir=in | name=league of legends launcher |
"{4AAABEC3-AF9D-4126-A9FA-1CFB3325429E}" = lport=8370 | protocol=17 | dir=in | name=league of legends launcher |
"{4EEEC600-40F5-4E6E-A48A-9A9B1C54075D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{82240DD6-7499-4D5F-B340-51423B05BBF4}" = lport=139 | protocol=6 | dir=in | app=system |
"{8ACFCBB4-A029-4CFD-88FF-ED4DB86AAE1A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{989550D6-0FC8-4391-8BC6-0E4686762C35}" = rport=138 | protocol=17 | dir=out | app=system |
"{9F1FD900-5194-4B69-81CC-DDB4F9723077}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{ADF4B492-B1F4-4AD8-9034-8C69E15E81B3}" = lport=6884 | protocol=17 | dir=in | name=league of legends launcher |
"{B60C1847-5DCE-4696-A77D-EEC36291542D}" = lport=8370 | protocol=6 | dir=in | name=league of legends launcher |
"{BCFEBE2D-559A-45BE-8D7A-05E3BF253663}" = rport=139 | protocol=6 | dir=out | app=system |
"{D6F83B5A-D3B7-4C3D-9030-1C4AF2B7D92D}" = lport=6886 | protocol=6 | dir=in | name=league of legends launcher |
"{E109AFCF-D02E-4787-97AC-9F4B31523963}" = rport=137 | protocol=17 | dir=out | app=system |
"{F12FCB75-5E86-4BBD-9809-569C380BBC8E}" = lport=6884 | protocol=6 | dir=in | name=league of legends launcher |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03DB2B44-77A6-43FF-ADC9-94DE1E217E32}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcmgr.exe |
"{07D7A7A4-55C1-4FB9-8FEF-859564430268}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{09E5A7A3-7B42-4361-A73E-3637144E9B67}" = protocol=17 | dir=in | app=c:\programdata\qvodplayer\qvoddown.exe |
"{0C5621F1-5357-4E21-85C7-2603C27D6488}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qqmusicinstall\qqmusicmminstaller.exe |
"{10733ED4-675E-45C4-9118-CD3425348E9F}" = protocol=6 | dir=in | app=c:\programdata\qvodplayer\qvoddown.exe |
"{115D6B31-DCC8-4614-98CE-2A405E76E086}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qzonemusic\qzonemusic.exe |
"{1275FF80-8AD2-4727-9563-FF6F583FEFF7}" = protocol=6 | dir=in | app=c:\program files (x86)\garenalol\gamedata\apps\lol\game\league of legends.exe |
"{1403C3AB-7B01-498D-8B36-C0D62F2814C5}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\bugreport.exe |
"{16080356-411A-4C14-BF9D-2F2D395E8A82}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{164E8615-59D3-4366-8A05-5F6A6C571C24}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{1B1F1495-0903-424C-B470-CCC80A3B3047}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1C3FF3FD-F921-4CED-8DC6-FB47996D29EE}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcupdateavlib.exe |
"{1F4A559F-0EA5-4442-9EF0-2E1F494AFF8D}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqpcmgr\6.6.2162.401\qmloader\qqpcdetector.exe |
"{20E3A44F-ECBB-498D-AFBA-F7AE0AF011D7}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qqmusic.exe |
"{27305994-88FF-4404-8A30-3BD555F25FE6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{285A2645-29D7-4CAE-8032-7217BE10445A}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcsoftmgr.exe |
"{2D4215F5-8CEF-456A-B2B0-859CD165D0CA}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qzonemusic.exe |
"{3008C9E7-A7DB-4A09-9E39-C82739AC6438}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{32160286-823E-47FF-B157-F03EA306562A}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcmgrinstallguide.exe |
"{34B8E963-88ED-4FE4-9FAF-C7A615D99C69}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"{3DD94CDB-E22F-4EC6-8416-5C771B42ECB8}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcfileopen.exe |
"{3FBCAED5-3220-4388-B3C1-EA08DA5BF056}" = protocol=6 | dir=in | app=c:\program files (x86)\garenalol\gamedata\apps\lol\air\lolclient.exe |
"{3FCAD349-A81D-47A5-87B7-D0EE88BC75B2}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe |
"{4139F85D-CB04-463E-B572-62710FB7F3FE}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qq\bin\txupd.exe |
"{41FF600D-ACF4-4639-9CED-8B3EC8E75009}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{4371CC2F-D6B0-4A45-B51D-65600924E303}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcurlloader.exe |
"{43B094B8-6984-4E47-89D7-1ED8C9E9C9DE}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{46440BD0-AA04-4378-A036-D4C7F8C24295}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{465D590E-405A-4214-81A9-28015313A9E8}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{47B7382D-18DA-4397-9098-FACA2B1B22FF}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqlive\qqliveup.exe |
"{49BFCDAE-2BF2-4F2D-965A-2F62D32A7E53}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qq\bin\setupex\qqsetupex.exe |
"{4C104AB6-CACC-4A9B-8CE7-4A0D86BB7B48}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{4E6EF157-A7DF-4AA5-AEE6-03D988E86253}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qmupdate\qqpcmgrupdate.exe |
"{4F0406EA-378C-4337-9044-DFA981FFFAF8}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{51F4636D-ABDA-40F0-84EB-7E73BDD0AE79}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{521AE9A6-81D8-413A-B442-5538D47EC506}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qq\bin\qq.exe |
"{52786F45-F259-4738-AFEB-43C562D21957}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\plugins\qmnetmon\qqpcnetflow.exe |
"{5C39C693-2405-4E64-A6A8-A3C9AEE3E4A6}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\121\tencentdl.exe |
"{5D7E6DDA-1C60-4B36-BFCC-06FD6DDE98B5}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{5F7C71AD-F981-4606-85EA-36CA4E55D8FC}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qqmusicupdate.exe |
"{6054BBF4-812C-4EE3-B52B-4127A0F668B2}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qqmusicinstall\qqmusicmminstaller.exe |
"{60DAB1CC-71C7-4E76-8D96-14E0A833281F}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{65594339-9456-4CF7-99A5-761115832D03}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qmloader\qqpcdetector.exe |
"{67561EBE-F99F-4F1F-B58D-18B8210FDED8}" = protocol=17 | dir=in | app=c:\users\kun jin\appdata\local\temp\qqgamedownloader\lol1354616548\miniqqdl.exe |
"{67FED3FD-B762-4B66-B76A-675A98659F49}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcsoftgame.exe |
"{6866D57B-D1B2-4128-8861-97B0336E3E5D}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqrepair.exe |
"{6A864E06-00D5-48C0-A8AA-627C820E4B87}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qq\bin\auclt.exe |
"{7110A081-8C33-47DB-9C1E-74BF27428524}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqlive\qqlive.exe |
"{754A8B94-1A52-4510-B505-EFFD936287A2}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcclinic.exe |
"{75D68D3C-C51D-46A2-8A58-56EF736DF6D6}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{77BB8933-F1F9-4CCE-B9E8-BE1C6A6ED9F4}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcbtu.exe |
"{7DF3C942-878A-4CAC-8674-7F248A330726}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe |
"{7EA62416-63B5-4234-B9C6-E3D64322E256}" = protocol=17 | dir=in | app=c:\garenadownload\games\lol\lolinstaller.exe |
"{84BC8DCE-A556-4801-AFEF-64D54F56F9D8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{84D5FDC4-89FC-46A5-A2D6-41561B1C72C9}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\uninst.exe |
"{865DBC45-97B3-4ADC-B30A-2A5F5EBFB7F2}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qq\bin\txupd.exe |
"{906A32E5-6473-4EBE-832A-7A8994D6F404}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe |
"{91159C89-D41E-4CB6-9712-FD36B6D3A8C8}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcsplash.exe |
"{925A959C-C1DB-48D6-B341-8B12C86D66BD}" = protocol=17 | dir=in | app=c:\program files (x86)\garenalol\gamedata\apps\lol\game\league of legends.exe |
"{987B18C8-7A6B-4787-9B5E-F8743A7BC193}" = protocol=6 | dir=in | app=c:\users\kun jin\appdata\roaming\tencent\qqpcmgr\download\qqpcdownload.exe |
"{9B62D7B0-37D8-4DB9-A45C-1C4FDCE9D0C1}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qmloader\qqpcdetector.exe |
"{9EFED1BC-41D4-4DB5-8E25-7E5A7A885C79}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpclaunch.exe |
"{A4BB684F-5071-4CD0-A69E-34777AED71C8}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qq\bin\auclt.exe |
"{A78299DC-3847-475B-BC21-E7167264C87F}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qqmusic.exe |
"{A7FE7336-24F6-4081-B4BD-E254CC27C09D}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qq\bin\qq.exe |
"{AE686D80-4EC6-4413-A0EA-89CDDDAF5757}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qmloader\qqpcdetector.exe |
"{B02B6089-7776-4865-98DC-136ABB43397C}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcleakscan.exe |
"{B462C7AB-53FA-409E-8DA7-CABF907EE526}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpctray.exe |
"{B68282A1-B0B2-440A-A056-28FACFC7A8F5}" = protocol=17 | dir=in | app=c:\program files (x86)\garenalol\gamedata\apps\lol\air\lolclient.exe |
"{BF7CB8B0-207F-4CE1-82CF-24A9844F65B5}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"{BFC566FF-1E1A-4570-9C5F-8AA41FDA0F2C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C2C99F12-A1FF-4C71-92D3-6FAC2E98DAC3}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcloader.exe |
"{C38B8D33-7086-4EEF-BA89-A82589CA207F}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{C73A896A-6B79-431E-B016-393E1DD9CF26}" = protocol=6 | dir=in | app=c:\garenadownload\games\lol\lolinstaller.exe |
"{C7D17870-3A8A-4BA4-94BB-1555D6D8514E}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcpatch.exe |
"{C9B036F1-8D0F-40F4-AFEE-233374053860}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcsysoptimize.exe |
"{CA586161-0D5B-4CA9-AA14-21F3905E7C60}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqpcmgr\6.6.2162.401\qmloader\qqpcdetector.exe |
"{CACB9AFA-B893-4165-97CC-70D2C051D047}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpconfig.exe |
"{CCF087E4-2FC3-4457-A2BF-B4EDEF70999C}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqlive\qqliveup.exe |
"{CECE0A11-FA5E-4B6A-B0C4-56242DAD9206}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qq\bin\setupex\qqsetupex.exe |
"{D0698B18-8FA1-468F-B3EC-A06D56D6DA04}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\121\tencentdl.exe |
"{D08A188D-7BAD-46BB-A63D-4474AFC771D9}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qdesksetup.exe |
"{D23CC7E8-E760-4219-BD6E-C755799625AB}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qqmusicie.exe |
"{D3A2B3AC-0C5C-4F5D-BDA0-7B758A09929B}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcprotect.exe |
"{D4298C44-4650-443E-B93F-9B59F42939A4}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qzonemusic.exe |
"{D6EF66BA-2205-4253-8707-5C5737417FA7}" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qqlive\qqlive.exe |
"{DD4B9E54-A7C4-4023-B74E-517F761FEF04}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E5F852B1-6999-4FE8-B758-CA991C95BF42}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{E9919139-7F42-45EF-B530-ECA7F0BDB672}" = protocol=17 | dir=in | app=c:\users\kun jin\appdata\roaming\tencent\qqpcmgr\download\qqpcdownload.exe |
"{E9DCB420-2D7D-4E2E-B31E-1FAC147F72C6}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qqmusicie.exe |
"{F4A6E49A-0E18-4CF4-AEC9-B888182FC8E2}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{F52C47E1-8896-47EC-8376-C038B82643A6}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{F5F7A169-8874-4F6E-B63E-B9B4A86D3030}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qzonemusic\qzonemusic.exe |
"{F7FF2174-5C6D-4B6B-B578-497C9EC2C264}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F98B81C8-47EA-479E-B343-7BD5AED08EA5}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcrtp.exe |
"{FD7F3503-5A4B-4221-8090-ADEC970EF554}" = dir=in | app=c:\program files (x86)\tencent\qqpcmgr\7.2.6889.210\qqpcwebshield.exe |
"{FD7FA031-4E67-4AFA-A349-561F78726BBE}" = protocol=6 | dir=in | app=c:\users\kun jin\appdata\local\temp\qqgamedownloader\lol1354616548\miniqqdl.exe |
"{FFDDC096-336C-4D26-8789-0ACC30B2E348}" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qqmusic\qqmusicupdate.exe |
"TCP Query User{123C5FE3-8D0A-45C2-AE4F-2C6EAFD4FEF4}C:\program files (x86)\garena plus\garenamessenger.exe" = protocol=6 | dir=in | app=c:\program files (x86)\garena plus\garenamessenger.exe |
"TCP Query User{277B41D5-A498-4A58-B8BC-4B0159474891}C:\users\kun jin\appdata\local\microsoft\windows\temporary internet files\content.ie5\9kirvtlm\qvodsetupplus.exe" = protocol=6 | dir=in | app=c:\users\kun jin\appdata\local\microsoft\windows\temporary internet files\content.ie5\9kirvtlm\qvodsetupplus.exe |
"TCP Query User{2EB9A2C3-62C1-4ED6-8BA8-01B23FE7FBBA}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"TCP Query User{335AF746-44F0-4BDC-9DF4-03FD5F9B372E}C:\users\kun jin\downloads\qvodsetup5.exe" = protocol=6 | dir=in | app=c:\users\kun jin\downloads\qvodsetup5.exe |
"TCP Query User{34D2522A-E144-4848-AABF-8C2507E1F533}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"TCP Query User{3A274E1E-AEB3-488B-92BA-797E1146F940}C:\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\warcraft iii\war3.exe |
"TCP Query User{3CC9CFB9-98CD-472B-9862-459987649BEF}C:\program files (x86)\qvodplayer\qvodterminal.exe" = protocol=6 | dir=in | app=c:\program files (x86)\qvodplayer\qvodterminal.exe |
"TCP Query User{4809E664-29AA-470D-AA8D-0AD78ABADD9A}C:\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\warcraft iii\war3.exe |
"TCP Query User{5B99EBF8-512D-46CF-8A86-8BFA987D6330}C:\program files (x86)\qvodplayer\qvodplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\qvodplayer\qvodplayer.exe |
"TCP Query User{63722B91-7D9E-4011-8CC8-8CC3613B49F4}C:\program files (x86)\common files\tencent\qqdownload\121\tencentdl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\121\tencentdl.exe |
"TCP Query User{67A827FD-75F7-4CF6-B374-CA4D52F6CB4C}C:\program files (x86)\common files\tencent\qqdownload\114\tencentdl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\114\tencentdl.exe |
"TCP Query User{71840A0D-9C68-43F8-8D73-CFCEB57EA7A0}C:\program files (x86)\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe |
"TCP Query User{92467B30-C38E-401A-A94C-DA6F64B5AB92}C:\program files (x86)\qvodplayer\qvodterminal.exe" = protocol=6 | dir=in | app=c:\program files (x86)\qvodplayer\qvodterminal.exe |
"TCP Query User{93B5604E-5E4E-4E7D-B9C9-AFD67BD1A9EA}C:\users\kun jin\desktop\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\users\kun jin\desktop\warcraft iii\war3.exe |
"TCP Query User{93BE1226-DA2C-41FE-95AF-47902FA2914D}C:\warcraft iii\campaigns\garena\garena.exe" = protocol=6 | dir=in | app=c:\warcraft iii\campaigns\garena\garena.exe |
"TCP Query User{9DF8431D-49CF-48C6-9E6D-FA687B1517A6}C:\users\kun jin\desktop\garena plus\garenamessenger.exe" = protocol=6 | dir=in | app=c:\users\kun jin\desktop\garena plus\garenamessenger.exe |
"TCP Query User{A2FCFCE0-ABEA-40FB-88A9-A48BBA80C729}C:\program files (x86)\football manager 2012\garena plus\room\garena_room.exe" = protocol=6 | dir=in | app=c:\program files (x86)\football manager 2012\garena plus\room\garena_room.exe |
"TCP Query User{AC9B607E-5910-4AD4-AA20-958A3D2EFF75}C:\users\kun jin\desktop\garena\garena.exe" = protocol=6 | dir=in | app=c:\users\kun jin\desktop\garena\garena.exe |
"TCP Query User{B33CA2E2-FE86-47C1-AA64-FAE702870A87}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe |
"TCP Query User{B448DDA9-142E-47A3-A0F9-0DD0828AF0FE}C:\program files (x86)\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files (x86)\real\realplayer\realplay.exe |
"TCP Query User{C2F6FE67-A736-4423-B90C-5B86507909FD}C:\program files (x86)\garena plus\bbtalk\bbtalk.exe" = protocol=6 | dir=in | app=c:\program files (x86)\garena plus\bbtalk\bbtalk.exe |
"TCP Query User{C54F18AC-9FC0-45F5-B1D5-09C92B4EEEBD}C:\users\kun jin\desktop\garena plus\room\garena_room.exe" = protocol=6 | dir=in | app=c:\users\kun jin\desktop\garena plus\room\garena_room.exe |
"TCP Query User{D0D8F3DD-0C6D-41EA-9558-169C321114BC}C:\program files (x86)\tencent\qq\bin\qq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tencent\qq\bin\qq.exe |
"TCP Query User{DF056CE0-C0E7-4082-A760-796CC14B43A6}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe |
"TCP Query User{E4DA80F3-4BB1-4E65-86BC-2C84F70C686C}C:\program files (x86)\kuaiwan\kuaiwan.exe" = protocol=6 | dir=in | app=c:\program files (x86)\kuaiwan\kuaiwan.exe |
"TCP Query User{ED4686D7-8479-4B86-B768-EF725F6A8AF2}C:\program files (x86)\garena plus\room\garena_room.exe" = protocol=6 | dir=in | app=c:\program files (x86)\garena plus\room\garena_room.exe |
"TCP Query User{F6C58A30-8577-4845-9447-5C37409B10FF}C:\program files (x86)\qvodplayer\qvodplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\qvodplayer\qvodplayer.exe |
"UDP Query User{01B07AFC-C55E-4867-A0CD-E7206A5322CC}C:\program files (x86)\common files\tencent\qqdownload\114\tencentdl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\114\tencentdl.exe |
"UDP Query User{0FB9C335-7C4E-44C8-AC2C-47807C953FE2}C:\program files (x86)\common files\tencent\qqdownload\121\tencentdl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\121\tencentdl.exe |
"UDP Query User{1B37F5D6-EBA9-445F-A39B-F7264BF5FA4F}C:\program files (x86)\garena plus\garenamessenger.exe" = protocol=17 | dir=in | app=c:\program files (x86)\garena plus\garenamessenger.exe |
"UDP Query User{2042AC96-EA8D-42EE-8FB1-E09CBF16EA8C}C:\warcraft iii\campaigns\garena\garena.exe" = protocol=17 | dir=in | app=c:\warcraft iii\campaigns\garena\garena.exe |
"UDP Query User{24A1B093-3896-4B73-ACFB-E2F3AAA200E1}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"UDP Query User{2D2CD48A-60BD-4A3C-81D4-39D556F0F4E7}C:\program files (x86)\garena plus\bbtalk\bbtalk.exe" = protocol=17 | dir=in | app=c:\program files (x86)\garena plus\bbtalk\bbtalk.exe |
"UDP Query User{44EC0885-07D4-4CBF-A501-9FF610010363}C:\users\kun jin\downloads\qvodsetup5.exe" = protocol=17 | dir=in | app=c:\users\kun jin\downloads\qvodsetup5.exe |
"UDP Query User{49A194DF-7EC0-4B17-B6E7-513E89A47364}C:\program files (x86)\kuaiwan\kuaiwan.exe" = protocol=17 | dir=in | app=c:\program files (x86)\kuaiwan\kuaiwan.exe |
"UDP Query User{4EC15786-24D9-4C6F-A6A9-650AD4452E8F}C:\program files (x86)\garena plus\room\garena_room.exe" = protocol=17 | dir=in | app=c:\program files (x86)\garena plus\room\garena_room.exe |
"UDP Query User{4FC2E59F-D688-45F4-853B-000A2C184F11}C:\program files (x86)\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe |
"UDP Query User{5F3569BA-B680-40B8-ABF8-4AB95E2357CE}C:\program files (x86)\football manager 2012\garena plus\room\garena_room.exe" = protocol=17 | dir=in | app=c:\program files (x86)\football manager 2012\garena plus\room\garena_room.exe |
"UDP Query User{71630A61-B832-4A8C-BFBE-52B59D3E48DB}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe |
"UDP Query User{78570458-1E7A-4532-BC87-3CA368E00D81}C:\program files (x86)\tencent\qq\bin\qq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tencent\qq\bin\qq.exe |
"UDP Query User{7CD6D1A7-F0EF-49C0-BE36-080960EA8381}C:\program files (x86)\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files (x86)\real\realplayer\realplay.exe |
"UDP Query User{7F0D83FD-63C4-4E9F-A010-5DB75DA7B40C}C:\users\kun jin\desktop\garena\garena.exe" = protocol=17 | dir=in | app=c:\users\kun jin\desktop\garena\garena.exe |
"UDP Query User{8F24AC51-B283-4A85-930B-E838FAE8572F}C:\program files (x86)\qvodplayer\qvodplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\qvodplayer\qvodplayer.exe |
"UDP Query User{94EA3B76-E408-4C42-9EB5-7788F6E730B1}C:\program files (x86)\symantec\norton online backup\nobuclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\symantec\norton online backup\nobuclient.exe |
"UDP Query User{97F0D0C2-9243-4FF1-ABA4-7D1A4E2A3A28}C:\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\warcraft iii\war3.exe |
"UDP Query User{A33AFD06-B262-497A-A8B1-892A1438F691}C:\users\kun jin\desktop\garena plus\room\garena_room.exe" = protocol=17 | dir=in | app=c:\users\kun jin\desktop\garena plus\room\garena_room.exe |
"UDP Query User{AD43E96E-4A6F-47A2-8373-BB83D552A095}C:\users\kun jin\desktop\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\users\kun jin\desktop\warcraft iii\war3.exe |
"UDP Query User{AFFF378D-692B-4E07-8726-58BD6550125F}C:\program files (x86)\qvodplayer\qvodterminal.exe" = protocol=17 | dir=in | app=c:\program files (x86)\qvodplayer\qvodterminal.exe |
"UDP Query User{C32DBEC0-17C1-442A-B9D1-BDFAB6EB7078}C:\users\kun jin\appdata\local\microsoft\windows\temporary internet files\content.ie5\9kirvtlm\qvodsetupplus.exe" = protocol=17 | dir=in | app=c:\users\kun jin\appdata\local\microsoft\windows\temporary internet files\content.ie5\9kirvtlm\qvodsetupplus.exe |
"UDP Query User{CDAF309E-152C-4C40-87E3-662CD4E2C5B3}C:\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\warcraft iii\war3.exe |
"UDP Query User{E3AD55A3-F525-4836-8A52-C690C0400284}C:\users\kun jin\desktop\garena plus\garenamessenger.exe" = protocol=17 | dir=in | app=c:\users\kun jin\desktop\garena plus\garenamessenger.exe |
"UDP Query User{ED6F30A9-EDCD-46A4-ACF4-3964C7B878A2}C:\program files (x86)\qvodplayer\qvodplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\qvodplayer\qvodplayer.exe |
"UDP Query User{F5941E41-A223-4360-9126-C522868777C7}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"UDP Query User{F7575D6A-02B8-4656-93C1-0F5B70C6C97B}C:\program files (x86)\qvodplayer\qvodterminal.exe" = protocol=17 | dir=in | app=c:\program files (x86)\qvodplayer\qvodterminal.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00386162-C708-3331-9300-72C68A35A56E}" = Microsoft .NET Framework 4 Extended CHT Language Pack
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{115B60D5-BBDB-490E-AF2E-064D37A3CE01}" = Media Gallery
"{133D3F07-D558-46CE-80E8-F4D75DBBAD63}" = PMB VAIO Edition Plug-in
"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{206BD2C5-DE08-4577-A0D7-D441A79D5A3A}" = Windows Live Remote Client Resources
"{2106A845-79C0-426B-9B91-9CBEAF3DE0F2}" = VAIO Update Merge Module x64
"{26A24AE4-039D-4CA4-87B4-2F86416026FF}" = Java™ 6 Update 26 (64-bit)
"{312395BC-7CC2-434C-A660-30250276A926}" = SSLx64
"{349F0F3D-5B4A-8E7B-87FF-72D3C626B6F9}" = ccc-utility64
"{350FD0E7-175A-4F86-84EF-05B77FCD7161}" = Windows Live Remote Service Resources
"{3C41721F-AF0F-4086-AA1C-4C7F29076228}" = Intel® PROSet/Wireless WiFi Software
"{4F31AC31-0A28-4F5A-8416-513972DA1F79}" = Sony Corporation
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{549AD5FB-F52D-4307-864A-C0008FB35D96}" = VCCx64
"{57DD35E9-D9BB-4089-BB05-EF933C586CB3}" = Broadcom InConcert Maestro
"{5FCD6EFE-C2E7-4D77-8212-4BA223D8DF8E}" = Windows Live Remote Client Resources
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6C8F7FE6-6D5E-49FE-A4EB-6597B41C2BCA}" = VAIO Care
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support
"{7506BB74-99D1-4283-B648-CEDBECDDC819}" = Windows Live Remote Service Resources
"{75C8188C-883C-310E-BB83-E7EA3023FCB1}" = Microsoft .NET Framework 4 Client Profile CHT Language Pack
"{79838C67-3222-3912-951B-E66023E9415B}" = Microsoft .NET Framework 4 Client Profile CHS Language Pack
"{7FD0F1DB-F00E-3A64-A1A9-825E9EB3F3C2}" = Microsoft .NET Framework 4 Extended ARA Language Pack
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{AE91E0F3-C49A-4EF4-8B98-A07BD409EB90}" = Windows Live Remote Service Resources
"{C6A27482-6911-388E-9A57-CFB80D3029E9}" = Microsoft .NET Framework 4 Extended CHS Language Pack
"{C6C9D5F7-630C-4125-8C4E-94AF77C1896E}" = WIDCOMM Bluetooth Software
"{D55EAC07-7207-44BD-B524-0F063F327743}" = VIx64
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DBEAA361-F8A4-4298-B41C-9E9DCB9AAB84}" = VPMx64
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{DF8241A3-B956-36B2-9898-42D53C3B3A46}" = Microsoft .NET Framework 4 Client Profile ARA Language Pack
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E34DB4F2-8F02-EBB7-7E42-28B8986A7850}" = ATI Catalyst Install Manager
"{E8A15EEF-9E69-48AF-AB8E-0BAEF878B050}" = Windows Live Remote Client Resources
"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources
"{F2611404-06BF-4E67-A5B7-8DB2FFC1CBF6}" = VSNx64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F83779DF-E1F5-43A2-A7BE-732F856FADB7}" = Microsoft SQL Server Compact 3.5 SP1 x64 English
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources
"HaoZip" = 2345好压
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile ARA Language Pack" = حزمة اللغة العربية لـ Microsoft .NET Framework 4
"Microsoft .NET Framework 4 Client Profile CHS Language Pack" = Microsoft .NET Framework 4 Client Profile 简体中文语言包
"Microsoft .NET Framework 4 Client Profile CHT Language Pack" = Microsoft .NET Framework 4 Client Profile 繁體中文語言套件
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended ARA Language Pack" = حزمة اللغة العربية الموسعة لـ Microsoft .NET Framework 4
"Microsoft .NET Framework 4 Extended CHS Language Pack" = Microsoft .NET Framework 4 Extended 简体中文语言包
"Microsoft .NET Framework 4 Extended CHT Language Pack" = Microsoft .NET Framework 4 Extended 繁體中文語言套件
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000F2A10-9CDF-47BF-9CF2-9AC87567B433}" = Windows Live Photo Common
"{03241D8D-2217-42F7-9FCB-6A68D141C14D}" = Windows Live 软件包
"{046885A1-B4AE-4459-A0D1-8C93706698D6}" =
"{048495CC-6A0F-2BBF-7DF6-D67DBEBDB051}" = CCC Help Italian
"{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}" = 腾讯QQ2011
"{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}" = VAIO Smart Network
"{08A68007-A1AD-A299-4D60-01E76BC81EE0}" = PX Profile Update
"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation®Store
"{0F895695-33CC-4203-9C47-25EF2AC9441C}" = Media Go
"{10FC29D4-280E-4F2B-9AA1-9245FA0F0BD3}" = CCC Help Chinese Traditional
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack
"{13EC74A6-4707-4D26-B9B9-E173403F3B08}" = Quick Web Access
"{1569A576-D643-C124-AAD3-106BB06FD525}" = Catalyst Control Center Graphics Previews Common
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer
"{1C5DA253-B20B-6740-0C49-367C6BDD34C0}" = CCC Help Swedish
"{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}" = Bing Bar
"{1ED5CC90-A836-B517-57F5-7B38D6479C19}" = CCC Help Chinese Standard
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2107A91F-E5D3-5E09-55BE-39B986A164EC}" = CCC Help English
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{249EE21B-8EDD-4F36-8A23-E580E9DBE80A}" = Windows Live Mail
"{263C52B3-966A-47A7-91EA-6E53B5E64A6D}" = Windows Live Photo Gallery
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java™ 7 Update 5
"{270380EB-8812-42E1-8289-53700DB840D2}" = PMB VAIO Edition Plug-in
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2AE032B3-9C08-48A3-AD30-43FC4DE7C2BC}" = Windows Live Writer Resources
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{2D457E06-4535-43DA-9B34-E9BF0786B705}" = Windows Live Mail
"{2D49C296-BCCA-4800-BAF6-A0269EBDCF74}" = Windows Live Messenger
"{317D56AC-0DB3-48F5-929A-42032DAC9AD7}" = Windows Live Writer
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{368BEC2C-B7A2-4762-9213-2D8465D533CA}" = Windows Live UX Platform Language Pack
"{3A26D9BD-0F73-432D-B522-2BA18138F7EF}" = VAIO Improvement
"{3B72C1E0-26A1-40F6-8516-D50C651DFB3C}" = Windows Live Essentials
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A48F20C-BEE3-4661-B55D-9280D06E5DA3}" = Điều khiển ActiveX Windows Live Mesh dành cho kết nối từ xa
"{4D733D18-94AC-F2EF-875B-F69695486D13}" = CCC Help Korean
"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common
"{542DA303-FB91-4731-9F37-6E518368D3B9}" = Windows Live Messenger
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}" = VAIO Sample Contents
"{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{588CE0C0-860B-49A8-AFCF-3C69465B345F}" = Windows Live Mesh
"{591C957D-EC79-EB3B-B61B-5FD8EE28940B}" = CCC Help Portuguese
"{592A32CB-BE54-4FEC-883B-C197A077DC96}" = Windows Live Essentials
"{5A20185A-6B82-9A90-7E3B-918D846AA5F4}" = CCC Help French
"{5BC3D0A9-F317-E4AD-BC4D-A88B88D0B9EB}" = CCC Help Turkish
"{5BEE8F1F-BD32-4553-8107-500439E43BD7}" = VAIO Update
"{5DA7D148-D2D2-4C67-8444-2F0F9BD88A06}" = Windows Live Writer
"{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}" = VAIO Transfer Support
"{5F460157-3666-4CFD-9C24-6469E16BAFEB}" = Windows Live Movie Maker
"{622DE1BE-9EDE-49D3-B349-29D64760342A}" = 適用遠端連線的 Windows Live Mesh ActiveX 控制項
"{63C43435-F428-42BA-8E7B-5848749D9262}" = SSLx86
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{66081CDD-C1FE-415F-BB3A-F2622BA27461}" = PMB VAIO Edition Guide
"{66EA890C-EB35-48C1-BB9F-AEAF43E9A6D9}" = Catalyst Control Center
"{66FF4C48-0083-4E60-8556-B883AB200092}" = Heroes of Might and Magic V - Tribes of the East
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6874282F-37D6-4829-8B6F-D2D4FD818AA5}" = Catalyst Control Center - Branding
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{6FBD5341-533D-44D2-901F-07764025247F}" = Windows Live UX Platform Language Pack
"{70991E0A-1108-437E-BA7D-085702C670C0}" =
"{70DE9E60-DE22-4362-B868-1B8922F78C1A}" = Remote Keyboard
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7115EEBC-DA7B-434C-B81C-EA5B26EA9A94}" = Windows Live Writer Resources
"{71FC647F-E91F-4DD2-BEA4-7B4172015DCE}" = VHD
"{7327080F-6673-421F-BBD9-B618F357EEB3}" = Windows Live UX Platform Language Pack
"{7396FB15-9AB4-4B78-BDD8-24A9C15D2C65}" = VAIO - Remote Keyboard
"{753F0A72-59C3-41CE-A36A-F2DF2079275C}" = Windows Live Mail
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78DBE8CE-61F6-4D6C-806C-A0FFF65F5E1D}" = Windows Live Messenger
"{7B982EBD-D017-4527-BF1A-FC489EC6B100}" = Windows Live 照片库
"{7C2A3479-A5A0-412B-B0E6-6D64CBB9B251}" = Windows Live Photo Common
"{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}" = VAIO Easy Connect
"{803E4FA5-A940-4420-B89D-A8BC2E160247}" =
"{8156F9E1-F231-4DF9-A81F-B1E4A26687EB}" = Windows Live Photo Common
"{82F09B1C-F602-4552-9C40-5BD5F8EAF750}" =
"{8356CB97-A48F-44CB-837A-A12838DC4669}" = PMB VAIO Edition Plug-in
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials
"{855DDD3C-131E-42A8-BCBD-F9581F80CACB}" =
"{861B1145-7762-4794-B40C-3FF0A389DFE6}" = Windows Live Photo Gallery
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{895B02A3-C5EE-D477-558B-9B6FB1A42175}" = CCC Help Danish
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E797841-A110-41FD-B17A-3ABC0641187A}" = VAIO Control Center
"{903EDF14-4E28-4463-AA5E-4AEE71C0263B}" = Windows Live Movie Maker
"{90968A90-5622-4C20-A7C1-20AD28F06A9C}" = Windows Live Writer
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{94865835-24E8-4A44-8602-6663577E776B}" = Windows Live Mesh
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A2EDAEEB-C981-46D5-8163-CF8F5F640EEE}" = ตัวควบคุม ActiveX ใน Windows Live Mesh สำหรับการเชื่อมต่อระยะไกล (ไทย)
"{A49A517F-5332-4665-922C-6D9AD31ADD4F}" = VSNx86
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7C30414-2382-4086-B0D6-01A88ABA21C3}" = VAIO Gate
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB0B2113-5B96-4B95-8AD1-44613384911F}" = Windows Live Mesh
"{AB259D46-F851-41B0-9AFA-AED8998AD68A}" = MusicStation
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.1) MUI
"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh
"{B1893E3F-9BDF-443F-BED0-1AAA2D9E0D68}" = ArcSoft Magic-i Visual Effects 2
"{B1CB87AD-540D-F2E9-7C4A-9210CF2EF9F5}" = CCC Help Czech
"{B26438B4-BF51-49C3-9567-7F14A5E40CB9}" = Dolby Home Theater v4
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation®Network Downloader
"{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}" = PMB
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7546697-2A80-4256-A24B-1C33163F535B}" = VAIO Gate Default
"{B77DE05C-7C84-4011-B93F-A29D0D2840F4}" = ArcSoft WebCam Companion 4
"{B8991D99-88FD-41F2-8C32-DB70278D5C30}" = VWSTx86
"{B91914C7-13E3-15FB-776E-DB5D93F5692F}" = CCC Help Norwegian
"{BAEE89D5-6E87-4F89-9603-A1C100479181}" = Windows Live Messenger
"{BBED4FD2-55C9-9055-AA86-CD270214804E}" = Catalyst Control Center Profiles Mobile
"{BC9418A7-6E7D-4F3E-8138-1E865FF35F55}" = CCC Help Finnish
"{BE9E4DD1-6228-46C6-8EF9-42F7A4F6CC9D}" = VAIO Data Restore Tool
"{BFEF2C48-D947-4C95-B29F-97237B1E71E1}" = Windows Live Messenger
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}" = VAIO Manual
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D17C2A58-E0EA-4DD7-A2D6-C448FD25B6F6}" = VIx86
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4DD8497-FDA1-6A85-7C57-945A4F6A5342}" = CCC Help Russian
"{D6CBB3B2-F510-483D-AE0D-1CF3F43CF1EE}" = Windows Live Writer Resources
"{DCD2E2B5-9B63-ABA6-9C6E-5EC1CC06D506}" = CCC Help Dutch
"{DD07A8CC-7B65-09C9-26B3-3A4DB1B16058}" = CCC Help Polish
"{DD628CCC-CA26-94D4-C748-6B7219D927CD}" = Catalyst Control Center Localization All
"{DDC1E1BD-7615-4186-89E1-F5F43F9B6491}" = Windows Live Movie Maker
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE2DFF65-FC1D-4508-9633-877FB97B099C}" = CCC Help Greek
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DF184496-1CA2-4D07-92E7-0BD251D7DEF0}" = VCCx86
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E18B30AA-6E2D-480C-B918-AF61009F4010}" = عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة
"{E18F8580-D8DA-0E63-90BB-BBCDE3C3342D}" = CCC Help Spanish
"{E344B90C-012B-2050-3939-07BE69D15076}" = CCC Help German
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F027F28C-3229-94CF-9E3A-9B323660817B}" = CCC Help Thai
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Display Audio Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote v. 4.4
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center
"{F96C1385-A4D1-BF4D-2177-FD1D8C1DF688}" = CCC Help Hungarian
"{F98DB0D2-FBEC-512B-E429-6A2150D1FBA4}" = CCC Help Japanese
"{F992409C-9D10-4AE2-BAEB-B5409AD3785E}" = 用于远程连接的 Windows Live Mesh ActiveX 控件(简体中文)
"{F9D72CAD-F499-69BE-568E-891109DCAB50}" = Catalyst Control Center InstallProxy
"{FA870BF1-44A1-4B7D-93E1-C101369AF0C1}" = VAIO - Media Gallery
"{FB77DB0C-6951-47B6-9D80-A0FDBEE0334C}" =
"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Diablo III" = Diablo III
"football manager 2012_is1" = football manager 2012
"Google Chrome" = Google Chrome
"im" = Garena Plus
"InstallShield_{270380EB-8812-42E1-8289-53700DB840D2}" = VAIO - PMB VAIO Edition Plug-in
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{66081CDD-C1FE-415F-BB3A-F2622BA27461}" = VAIO - PMB VAIO Edition Guide
"InstallShield_{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}" = VAIO Easy Connect
"InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"Kingsoft Internet Security" = 新毒霸(悟空)
"liebao" = 猎豹浏览器
"LoL" = Garena - League of Legends
"MapleStorySEA" = MapleStorySEA
"PC Cleaner_is1" = PC Cleaner v3.1
"ProInst" = Intel PROSet Wireless
"qqlive" = 腾讯视频
"QQMusic" = QQ音乐 2011
"QQPCMgr" = 电脑管家7.2
"QvodPlayer" = QvodPlayer 5.3.103
"RadioRage_4jbar Uninstall" = RadioRage Toolbar
"RealPlayer 15.0" = RealPlayer
"SOSOUpdate" = ËÑË÷¸üÐÂ·þÎñ
"splashtop" = Quick Web Access
"TBUpdate" = TBUpdate
"TXIEHlp" = IEËÑË÷ÖúÊÖ
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 24/12/2012 6:52:42 AM | Computer Name = KunJin-VAIO | Source = WinMgmt | ID = 10
Description =

Error - 24/12/2012 6:57:46 AM | Computer Name = KunJin-VAIO | Source = WinMgmt | ID = 10
Description =

Error - 24/12/2012 7:21:29 AM | Computer Name = KunJin-VAIO | Source = WinMgmt | ID = 10
Description =

Error - 24/12/2012 9:11:13 AM | Computer Name = KunJin-VAIO | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 24/12/2012 3:01:42 PM | Computer Name = KunJin-VAIO | Source = WinMgmt | ID = 10
Description =

Error - 24/12/2012 3:11:15 PM | Computer Name = KunJin-VAIO | Source = WinMgmt | ID = 10
Description =

Error - 24/12/2012 9:02:11 PM | Computer Name = KunJin-VAIO | Source = WinMgmt | ID = 10
Description =

Error - 24/12/2012 11:30:32 PM | Computer Name = KunJin-VAIO | Source = WinMgmt | ID = 10
Description =

Error - 25/12/2012 3:06:28 AM | Computer Name = KunJin-VAIO | Source = WinMgmt | ID = 10
Description =

Error - 25/12/2012 3:34:07 AM | Computer Name = KunJin-VAIO | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Users\Kun Jin\Downloads\SoftonicDownloader_for_qq-messenger.exe".Error
in manifest or policy file "" on line . A component version required by the application
conflicts with another component version already active. Conflicting components
are:. Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Component
2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

[ System Events ]
Error - 24/12/2012 11:26:42 PM | Computer Name = KunJin-VAIO | Source = DCOM | ID = 10010
Description =

Error - 24/12/2012 11:30:21 PM | Computer Name = KunJin-VAIO | Source = Service Control Manager | ID = 7000
Description = The Kingsoft Core Service service failed to start due to the following
error: %%5

Error - 24/12/2012 11:30:26 PM | Computer Name = KunJin-VAIO | Source = Service Control Manager | ID = 7000
Description = The Kaspersky Anti-Virus Service service failed to start due to the
following error: %%5

Error - 24/12/2012 11:30:30 PM | Computer Name = KunJin-VAIO | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
TsFltMgr

Error - 24/12/2012 11:32:48 PM | Computer Name = KunJin-VAIO | Source = Service Control Manager | ID = 7023
Description = The Windows Defender service terminated with the following error:
%%-2146762496

Error - 24/12/2012 11:36:01 PM | Computer Name = KunJin-VAIO | Source = DCOM | ID = 10010
Description =

Error - 25/12/2012 3:06:17 AM | Computer Name = KunJin-VAIO | Source = Service Control Manager | ID = 7000
Description = The Kingsoft Core Service service failed to start due to the following
error: %%5

Error - 25/12/2012 3:06:22 AM | Computer Name = KunJin-VAIO | Source = Service Control Manager | ID = 7000
Description = The Kaspersky Anti-Virus Service service failed to start due to the
following error: %%5

Error - 25/12/2012 3:06:26 AM | Computer Name = KunJin-VAIO | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
TsFltMgr

Error - 25/12/2012 3:09:03 AM | Computer Name = KunJin-VAIO | Source = Service Control Manager | ID = 7023
Description = The Windows Defender service terminated with the following error:
%%-2146762496

< End of report >

oldman960

Post #11December 25, 2012, 8:58 AM UTC last edited December 25, 2012, 9:00 AM UTC

Hi Edwinnnn,

Which browser were you having problems with?

It looks like you have 2 antivirus programs installed, Kaspersky Internet Security 2013
and Kingsoft Internet Security. This will not give you more protection but rather most likely less as the 2 will conflict with each other casing slowdowns and lockups. Please uninstall one of them after the fix.

Next, Right click on OTL.exe (mirror.scr in your case) and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
O35 - HKCU\..exefile [open] – "C:\Users\Kun Jin\AppData\Local\xws.exe" -a "%1" %*
O37 - HKCU\…exe [@ = exefile] – "C:\Users\Kun Jin\AppData\Local\xws.exe" -a "%1" %*
[2012/12/24 13:13:56 | 000,219,328 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\xeb.exe
[2012/12/24 13:12:48 | 000,219,328 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\yaw.exe
[2012/12/24 13:10:58 | 000,011,862 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl
[2012/12/24 13:10:58 | 000,001,364 | -HS- | C] () – C:\ProgramData\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl
[2012/12/24 13:10:38 | 000,219,328 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\pmu.exe
[2012/12/24 13:10:38 | 000,219,328 | -HS- | C] () – C:\Users\Kun Jin\AppData\Local\boy.exe

:Files
C:\Users\Kun Jin\AppData\Local\xws.exe

:Commands
[purity]
[createrestorepoint]
[reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

How is the computer?

Edwinnnn

Post #12December 25, 2012, 9:19 AM UTC last edited December 27, 2012, 6:34 PM UTC

I'm having problems with IE . and it seems like i can't access to my email and facebook .. i can't view videos too .. Alot programmes re-enabled.. P.S the com auto rebooted and i'm not sure where is the otl fix log and resulting log . ;X

Edwinnnn

Post #13December 25, 2012, 9:33 AM UTC

I feel kinda stupid but i can't unistall kaspersky because of the trustedinstaller appeared in the ownership . and i think i kinda messed up passing the ownership .

oldman960

Post #14December 25, 2012, 4:40 PM UTC

Hi Edwinnnn,

We'll worry about Kaspersky in a bit.

The OTL fix log can be found at C:\_OTL\MovedFiles It will have a file name consisting of numders that reflect the date and time stamp the fix was ran. It will be something similar to 09092010_111009.log . Please copy and paste the contents into your next reply.

What problems are you currently experiencing?

Edwinnnn

Post #15December 25, 2012, 5:07 PM UTC last edited December 25, 2012, 5:11 PM UTC

uhm , i can't view my facebook and videos and some other websites with my IE … tried with my other browser but still experiencing the same problem …. here's the log .. ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry value HKEY_CURRENT_USER\SOFTWARE\Classes\exefile\shell\open\command\\'' updated successfully. File "C:\Users\Kun Jin\AppData\Local\xws.exe" -a "%1" %* not found. Registry key HKEY_CURRENT_USER\Software\Classes\.exe\ deleted successfully. Registry key HKEY_CURRENT_USER\Software\Classes\exefile\ deleted successfully. HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully! C:\Users\Kun Jin\AppData\Local\xeb.exe moved successfully. C:\Users\Kun Jin\AppData\Local\yaw.exe moved successfully. C:\Users\Kun Jin\AppData\Local\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl moved successfully. C:\ProgramData\1pb78m8n6he1l1565b3k36w7o7of8ksb88y53s63tpqg0vl moved successfully. C:\Users\Kun Jin\AppData\Local\pmu.exe moved successfully. C:\Users\Kun Jin\AppData\Local\boy.exe moved successfully. ========== FILES ========== File\Folder C:\Users\Kun Jin\AppData\Local\xws.exe not found. ========== COMMANDS ========== System Restore Service not available. OTL by OldTimer - Version 3.2.69.0 log created on 12252012_170948

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Window getting hijacked by spyware/malware, [Solved]

✨ Ask AI

Ask AI