Spyware / Malware / Virus Removal

Window getting hijacked by spyware/malware, [Solved]

27 min read

Looking for the outcome? Ask AI

Edwinnnn

Post #16December 25, 2012, 5:22 PM UTC

Uhm … May I know what kind of virus is this ? And how did my com get infected ? Thankss..

oldman960

Post #17December 25, 2012, 5:51 PM UTC

Hi Edwinnnn,

You are/were infected with a fake alert. Basically when ever an .exe is accessed the infection pops up an "infected" message. We should have dealt with that part with the OTL fix.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Right click on ComboFix.exe, click Run as Administrator & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. If after running combofix you recieve an message "Illegal operation attempted on a registery key that has been marked for deletion" or similar reboot the computer.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log.

Thanks

Edwinnnn

Post #18December 25, 2012, 7:43 PM UTC

here's the log..

ComboFix 12-12-25.02 - Kun Jin 26/12/2012 3:22.1.4 - x64
Running from: c:\users\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\desktop.ini
c:\program files (x86)\RadioRage_4j
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jdatact.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jdlghk.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jdyn.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jfeedmg.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhkstub.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhttpct.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jieovr.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jimpipe.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jmlbtn.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jPlugin.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jradio.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jregfft.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jreghk.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jregiet.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jscript.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jsknlcr.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jskplay.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4juabtn.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\CHROME.MANIFEST
c:\program files (x86)\RadioRage_4j\bar\1.bin\chrome\4jffxtbr.jar
c:\program files (x86)\RadioRage_4j\bar\1.bin\INSTALL.RDF
c:\program files (x86)\RadioRage_4j\bar\1.bin\installKeys.js
c:\program files (x86)\RadioRage_4j\bar\1.bin\LOGO.BMP
c:\program files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8RES.DLL
c:\program files (x86)\RadioRage_4j\bar\gen1\COMMON.T8S
c:\program files (x86)\RadioRage_4j\bar\IE9Mesg\COMMON.T8S
c:\program files (x86)\RadioRage_4j\bar\Message\COMMON.T8S
c:\program files (x86)\RadioRage_4j\bar\Settings\s_pid.dat
c:\programdata\ntuser.dat
c:\programdata\Roaming
c:\windows\PFRO.log
.
.
((((((((((((((((((((((((( Files Created from 2012-11-25 to 2012-12-25 )))))))))))))))))))))))))))))))
.
.
2012-12-25 19:36 . 2012-12-25 19:36 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-12-25 09:09 . 2012-12-25 09:09 ——– d—–w- C:\_OTL
2012-12-24 17:32 . 2012-12-24 17:32 ——– d—–w- c:\users\Kun Jin\AppData\Roaming\iolo
2012-12-24 11:28 . 2012-11-18 17:01 9125352 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C78C1A9E-3D79-4F45-BD18-83BDCCEC37C1}\mpengine.dll
2012-12-24 10:29 . 2012-12-24 11:19 ——– d—–w- c:\windows\ELAMBKUP
2012-12-24 10:28 . 2012-12-24 10:29 ——– d—–w- c:\programdata\Kaspersky Lab
2012-12-24 09:49 . 2012-12-24 09:49 ——– d—–w- c:\program files (x86)\Kaspersky Lab
2012-12-24 09:49 . 2012-08-13 10:24 89432 —-a-w- c:\windows\system32\drivers\klflt.sys
2012-12-24 09:49 . 2012-08-13 10:24 611160 —-a-w- c:\windows\system32\drivers\klif.sys
2012-12-24 09:17 . 2012-12-24 11:19 ——– d—–w- c:\programdata\MFAData
2012-12-24 09:17 . 2012-12-24 09:17 ——– d–h–w- c:\programdata\Common Files
2012-12-24 09:17 . 2012-12-24 09:17 ——– d—–w- c:\users\Kun Jin\AppData\Local\MFAData
2012-12-24 09:17 . 2012-12-24 09:17 ——– d—–w- c:\users\Kun Jin\AppData\Local\Avg2013
2012-12-24 09:07 . 2012-12-24 09:07 ——– d—–w- c:\users\Kun Jin\AppData\Roaming\PC Cleaner
2012-12-24 09:07 . 2012-12-24 11:19 ——– d—–w- c:\program files (x86)\PC Cleaner
2012-12-24 08:38 . 2012-12-24 08:38 ——– d—–w- c:\users\Kun Jin\AppData\Local\ElevatedDiagnostics
2012-12-24 06:39 . 2011-05-23 20:07 525792 —-a-w- c:\windows\DIFxAPI.dll
2012-12-24 06:39 . 2011-05-23 20:07 232272 —-a-w- c:\windows\TmNSCIns.dll
2012-12-24 05:20 . 2012-12-24 11:19 ——– d—–w- c:\users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}
2012-12-21 15:41 . 2012-12-21 15:41 ——– d—–w- c:\programdata\KRSHistory
2012-12-21 15:40 . 2012-12-21 15:40 ——– d—–w- c:\programdata\ksrbm
2012-12-20 23:42 . 2012-12-16 14:13 34304 —-a-w- c:\windows\SysWow64\atmlib.dll
2012-12-20 23:42 . 2012-12-16 17:11 46080 —-a-w- c:\windows\system32\atmlib.dll
2012-12-20 23:42 . 2012-12-16 14:45 367616 —-a-w- c:\windows\system32\atmfd.dll
2012-12-20 23:42 . 2012-12-16 14:13 295424 —-a-w- c:\windows\SysWow64\atmfd.dll
2012-12-19 08:48 . 2012-12-24 11:19 ——– d—–w- c:\users\Kun Jin\AppData\Roaming\ELEX
2012-12-19 08:03 . 2012-12-25 19:18 ——– d—–w- c:\users\Kun Jin\AppData\Roaming\HaoZip
2012-12-19 08:03 . 2012-12-24 11:19 ——– d—–w- c:\program files\HaoZip
2012-12-19 06:52 . 2012-12-19 06:52 ——– d—–w- c:\users\Kun Jin\AppData\Roaming\DNAML
2012-12-19 06:52 . 2012-11-27 03:01 274432 —-a-w- c:\windows\SysWow64\SkinX.dll
2012-12-15 05:43 . 2012-12-15 05:44 ——– d—–w- c:\users\Kun Jin\AppData\Roaming\AutoGG
2012-12-12 13:12 . 2012-11-09 05:45 2048 —-a-w- c:\windows\system32\tzres.dll
2012-12-12 13:12 . 2012-11-09 04:42 2048 —-a-w- c:\windows\SysWow64\tzres.dll
2012-12-12 13:12 . 2012-11-22 03:26 3149824 —-a-w- c:\windows\system32\win32k.sys
2012-12-10 11:22 . 2012-12-10 11:22 ——– d—–w- C:\Download
2012-12-01 03:32 . 2012-12-01 03:32 ——– d—–w- c:\users\Kun Jin\AppData\Roaming\xim
2012-11-27 08:15 . 2012-12-25 19:09 ——– d—–w- c:\users\Kun Jin\AppData\Roaming\Skype
2012-11-27 08:15 . 2012-12-24 11:19 ——– d—–w- c:\program files (x86)\Common Files\Skype
2012-11-27 08:15 . 2012-11-27 08:15 ——– d—–r- c:\program files (x86)\Skype
2012-11-27 08:15 . 2012-12-24 11:19 ——– d—–w- c:\programdata\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-12 17:11 . 2011-12-26 04:18 67413224 —-a-w- c:\windows\system32\MRT.exe
2012-12-12 09:51 . 2012-07-17 12:52 697272 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-12 09:51 . 2011-08-10 02:04 73656 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-11-30 04:05 . 2012-10-21 12:07 18296 —-a-w- c:\windows\system32\drivers\kusbquery64.sys
2012-11-30 04:05 . 2012-10-21 12:07 14200 —-a-w- c:\windows\system32\drivers\kusbquery.sys
2012-11-25 17:29 . 2012-11-25 17:29 49312 —-a-w- c:\windows\system32\drivers\KNBDrv64.sys
2012-11-25 17:29 . 2012-11-25 17:29 81568 —-a-w- c:\windows\system32\drivers\knbdrv.sys
2012-11-25 15:28 . 2012-04-15 14:11 31848 —-a-w- c:\windows\system32\drivers\kavbootc64.sys
2012-11-25 15:28 . 2012-04-15 14:11 27240 —-a-w- c:\windows\system32\drivers\kavbootc.sys
2012-11-15 12:33 . 2012-04-15 14:11 221048 —-a-w- c:\windows\system32\drivers\kisknl.sys
2012-10-25 14:14 . 2012-10-30 12:31 49320 —-a-w- c:\windows\SysWow64\drivers\TFsFltX64.sys
2012-10-25 14:14 . 2012-10-24 00:29 49320 —-a-w- c:\windows\system32\drivers\TFsFltX64.sys
2012-10-21 10:25 . 2012-10-21 10:25 163056 —-a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin
2012-10-16 08:38 . 2012-11-28 07:48 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-28 07:48 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-28 07:48 561664 —-a-w- c:\windows\apppatch\AcLayers.dll
2012-10-12 06:56 . 2012-10-12 06:56 22456 —-a-w- c:\windows\system32\drivers\TSysCare64.sys
2012-10-12 06:40 . 2012-10-12 06:40 69888 —-a-w- c:\windows\SysWow64\drivers\TsFltMgr.sys
2012-10-12 06:40 . 2012-10-24 00:29 112032 —-a-w- c:\windows\system32\QQPCUrlLoader.exe
2012-10-09 18:17 . 2012-11-15 04:23 55296 —-a-w- c:\windows\system32\dhcpcsvc6.dll
2012-10-09 18:17 . 2012-11-15 04:23 226816 —-a-w- c:\windows\system32\dhcpcore6.dll
2012-10-09 17:40 . 2012-11-15 04:23 44032 —-a-w- c:\windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40 . 2012-11-15 04:23 193536 —-a-w- c:\windows\SysWow64\dhcpcore6.dll
2012-10-04 16:40 . 2012-12-12 13:11 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2012-10-03 17:56 . 2012-11-15 04:22 1914248 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-03 17:44 . 2012-11-15 04:22 303104 —-a-w- c:\windows\system32\nlasvc.dll
2012-10-03 17:44 . 2012-11-15 04:22 70656 —-a-w- c:\windows\system32\nlaapi.dll
2012-10-03 17:44 . 2012-11-15 04:22 246272 —-a-w- c:\windows\system32\netcorehc.dll
2012-10-03 17:44 . 2012-11-15 04:22 18944 —-a-w- c:\windows\system32\netevent.dll
2012-10-03 17:44 . 2012-11-15 04:22 216576 —-a-w- c:\windows\system32\ncsi.dll
2012-10-03 17:42 . 2012-11-15 04:22 569344 —-a-w- c:\windows\system32\iphlpsvc.dll
2012-10-03 16:42 . 2012-11-15 04:22 175104 —-a-w- c:\windows\SysWow64\netcorehc.dll
2012-10-03 16:42 . 2012-11-15 04:22 18944 —-a-w- c:\windows\SysWow64\netevent.dll
2012-10-03 16:42 . 2012-11-15 04:22 156672 —-a-w- c:\windows\SysWow64\ncsi.dll
2012-10-03 16:07 . 2012-11-15 04:22 45568 —-a-w- c:\windows\system32\drivers\tcpipreg.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{5816DEEA-1962-7AF5-8444-8FB1EB633FE2}]
2012-03-16 06:10 446128 —-a-w- c:\program files (x86)\Tencent\SOSOAddr\ieaddr.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}]
2012-10-24 15:30 574880 —-a-w- c:\program files (x86)\Tencent\QQPCMgr\7.2.6889.210\TSWebMon.dat
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{A8502600-B272-4F68-A67B-A0305D46D297}]
2012-04-21 03:11 173968 —-a-w- c:\program files (x86)\QvodPlayer\QvodExtend.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-03 08:31 1514152 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2012-04-02 18:47 233288 —-a-w- c:\program files (x86)\Hotspot Shield\HssIE\HssIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QQ2009"="c:\program files (x86)\Tencent\QQ\Bin\QQ.exe" [2012-04-15 136568]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-07-17 39408]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-11-09 17877168]
"PC Cleaner"="c:\program files (x86)\PC Cleaner\PCCLauncher.exe" [2012-01-30 63120]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-04-30 284440]
"Dolby Home Theater v4"="c:\program files (x86)\Dolby Home Theater v4\pcee4.exe" [2011-05-02 500736]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-06-30 336384]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-06-01 2801288]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2012-10-31 3056576]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2011-03-15 650080]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2011-12-23 296056]
"QvodTerminal"="c:\program files (x86)\QvodPlayer\QvodTerminal.exe" [2012-06-08 1079216]
"QQPCTray"="c:\program files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCTray.exe" [2012-10-12 1066528]
"kxesc"="c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" [2012-12-21 1089280]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2012-08-17 218880]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R0 TsFltMgr;tencent TsFltMgr;c:\windows\System32\drivers\TsFltMgr.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 knbcenter;?????????;c:\users\Kun Jin\AppData\Local\liebao\LBBrowser\KNBCenter.exe [2012-11-25 312224]
R2 kxescore;Kingsoft Core Service;c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe [2012-12-19 152832]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-12-13 3290896]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys [2011-06-22 437288]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2011-06-22 39976]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [2009-06-10 281088]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 GGSAFERDriver;GGSAFER Driver;c:\warcraft iii\Campaigns\Garena\safedrv.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-06-01 340240]
R3 SOHCImp;VAIO Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2011-02-21 113824]
R3 SOHDs;VAIO Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2011-02-21 67232]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-01-20 286936]
R3 TBUpdate;Tencent Toolbar Update Service;c:\program files\Tencent\barupdate\TBUpdate.exe [2012-07-23 224672]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-01-20 887000]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-05-20 549616]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2011-02-19 385336]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-02-19 99104]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-12-21 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 kavbootc;kavbootc;c:\windows\system32\drivers\kavbootc64.sys [2012-11-25 31848]
S1 KDHacker;KDHacker;c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker64.sys [2012-09-26 166776]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys [2012-06-08 54104]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys [2012-08-13 178008]
S1 QqNetflpwControl;QqNetflpwControl;c:\program files (x86)\Tencent\QQPCMgr\7.2.6889.210\QMNetflow764.sys [2012-11-27 39592]
S1 TCSafeBox;TCSafeBox;c:\program files (x86)\Tencent\QQPCMgr\7.2.6889.210\TCSafebox64.sys [2012-10-12 40616]
S1 TSCPM;TSCPM;c:\program files (x86)\Tencent\QQPCMgr\7.2.6889.210\tscpm64.sys [2012-10-12 32936]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-07-27 203776]
S2 ARUpdate;Tencent AddressBar Update Service;c:\program files\TENCENT\AddrUpdate\AddrUpdate.exe [2012-05-29 116656]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2012-04-02 329544]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-30 13592]
S2 kisknl;kisknl;c:\windows\system32\drivers\kisknl.sys [2012-11-15 221048]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2011-03-15 428384]
S2 QQPCRTP;QQPCMgr RTP Service;c:\program files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCRtp.exe [2012-10-12 822768]
S2 QQSysMonX64;QQSysMonX64;c:\program files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQSysMonX64.sys [2012-10-12 98984]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [2011-06-24 102400]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsnxc64.sys [2011-06-24 98816]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2011-07-22 259512]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2011-02-23 105024]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-06-24 2656536]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2011-05-31 552584]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2011-07-15 969352]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968]
S3 HaozipVirtualCDBus;HaoZip Virtual Bus Driver;c:\windows\system32\DRIVERS\HaoZipVirtualCDBus.sys [2012-07-24 204888]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-07-27 317440]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [2011-07-27 12230912]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys [2012-05-25 29016]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2012-07-25 29016]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-06-24 76912]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2010-12-10 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2010-12-10 181248]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2010-04-26 12032]
S3 TcHardWare;TcHardWare;c:\program files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCHW-x64.sys [2012-10-12 16552]
S3 TFsFlt;TFsFlt;c:\windows\system32\Drivers\TFsFltX64.sys [2012-10-25 49320]
S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-07-24 53176]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2011-06-30 1380480]
S4 KUsbGuard;KUsbGuard;c:\program files (x86)\kingsoft\kingsoft antivirus\kusbquery64.sys [2012-11-30 18296]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - KAVBOOTC
*Deregistered* - TSysCare
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-17 09:51]
.
2012-12-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17 12:58]
.
2012-12-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17 12:58]
.
2012-12-25 c:\windows\Tasks\ReclaimerUpdateFiles_Kun Jin.job
- c:\users\Kun Jin\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-17 12:34]
.
2012-12-25 c:\windows\Tasks\ReclaimerUpdateXML_Kun Jin.job
- c:\users\Kun Jin\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-17 12:34]
.
2012-12-25 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Kun Jin.job
- c:\users\Kun Jin\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-17 12:34]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}]
2012-10-12 06:41 385440 —-a-w- c:\program files (x86)\Tencent\QQPCMgr\7.2.6889.210\TSWebMon64.dat
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-06-24 11855976]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-24 2226280]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-07-27 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-07-27 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-07-27 416024]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-06-01 1935120]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.facebook.com/
mStart Page = hxxp://123.duba.net/?f=dbsj
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
Trusted Zone: qq.com\cache.tv
Trusted Zone: qq.com\qqlivecaption
Trusted Zone: qq.com\qqlivehabit
Trusted Zone: qq.com\qqlivesearch
Trusted Zone: qq.com\video_1
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{3c35ad63-af1d-4e21-b484-b6651a8efcf9} - c:\program files (x86)\RadioRage_4j\bar\1.bin\4jSrcAs.dll
Wow6432Node-HKLM-Run- - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-im - c:\program files (x86)\Garena Plus\uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
" QQPCTray"="\"c:\\Program Files (x86)\\Tencent\\QQPCMgr\\7.2.6889.210\\QQPCTray.exe\" /regrun"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"&_\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\%C3 &_ Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
–
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TSysCare]
"ImagePath"=multi:"system32\Drivers\TSysCare64.sys\00"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TSysCare]
"ImagePath"=multi:"system32\Drivers\TSysCare64.sys\00"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2495382944-2607938036-4029320614-1000_Classes\BitTorrent\Shell\O(uQ*Q*ËeÎ˜Sb*_å‹B*T*‡eöN(*&*Q*)*\Command]
@="\"c:\\Program Files (x86)\\Tencent\\QQDownload\\QQDownload.exe\" /BT=\"%1\""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-12-26 03:40:49
ComboFix-quarantined-files.txt 2012-12-25 19:40
.
Pre-Run: 308,260,081,664 bytes free
Post-Run: 310,809,305,088 bytes free
.
- - End Of File - - DD867CF0C5549D0DB8881F71159C3C08

Edwinnnn

Post #19December 26, 2012, 12:23 AM UTC last edited December 26, 2012, 12:39 AM UTC

i think likely my problems are 1. IE delete anything i tried to DL .(Likely is the false alert infected my IE ) It will state "virus has been detected and deleted automatically ." 2.Unable to use browser to view facebook,youtube,videos.3 3.Trustedinstaller appeared in multi folders ownership.(I kinda messed up this) Solved problems : 1.Antivirus able to start working again. 2. Not facing "open with" problem when opening files 3.Files that are missing re-appeared.(Likely the virus hid the files) btw i really really appreciate the help you been giving to me …A big big thanks to you

and there's no nasty virus right ? D: .

oldman960

Post #20December 26, 2012, 1:51 AM UTC last edited December 26, 2012, 1:52 AM UTC

Hi Edwinnnn,

Let's see how we have progressed in resolving the problems. Try this with IE.

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it. If asked to download Avast's database please do so.

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.

Edwinnnn

Post #21December 26, 2012, 3:04 AM UTC last edited December 26, 2012, 3:07 AM UTC

here is the zip file and the logs ,btw i can't download with my IE as usual.. and i noticed my IE dun have the attachment section.. end up have to use chrome to post… just found out my chrome is able to view FB And videos . it seems like my chinese browser and IE can't view only.. aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2012-12-26 10:21:48 —————————– 10:21:48.689 OS Version: Windows x64 6.1.7601 Service Pack 1 10:21:48.689 Number of processors: 4 586 0x2A07 10:21:48.691 ComputerName: KUNJIN-VAIO UserName: Kun Jin 10:21:50.014 Initialize success 10:29:37.934 AVAST engine defs: 12122501 10:33:21.158 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 10:33:21.161 Disk 0 Vendor: TOSHIBA_ MJ00 Size: 476940MB BusType: 3 10:33:21.176 Disk 0 MBR read successfully 10:33:21.178 Disk 0 MBR scan 10:33:21.181 Disk 0 Windows 7 default MBR code 10:33:21.185 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12800 MB offset 2048 10:33:21.201 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 26216448 10:33:21.217 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 464038 MB offset 26421248 10:33:21.236 Disk 0 scanning C:\Windows\system32\drivers 10:33:30.340 Service scanning 10:33:57.972 Modules scanning 10:33:57.973 Disk 0 trace - called modules: 10:33:57.992 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll 10:33:57.993 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8009d3b790] 10:33:57.994 3 CLASSPNP.SYS[fffff88001e0143f] -> nt!IofCallDriver -> [0xfffffa8007546420] 10:33:57.995 5 ACPI.sys[fffff88000e1b7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800754a050] 10:33:59.034 AVAST engine scan C:\Windows 10:34:02.001 AVAST engine scan C:\Windows\system32 10:36:17.196 AVAST engine scan C:\Windows\system32\drivers 10:36:28.262 AVAST engine scan C:\Users\Kun Jin 10:42:16.516 File: C:\Users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}\syshost.exe **INFECTED** Win32:Malware-gen 10:44:33.072 AVAST engine scan C:\ProgramData 10:46:57.611 Scan finished successfully 10:49:44.367 Disk 0 MBR has been saved successfully to "C:\Users\Kun Jin\Desktop\MBR.dat" 10:49:44.373 The log file has been saved successfully to "C:\Users\Kun Jin\Desktop\aswMBR.txt"

Attachments:

📎MBR.zip

oldman960

Post #22December 26, 2012, 6:25 PM UTC

Hi Edwinnnn,

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:Files
C:\Users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}\syshost.exe 
dir "C:\Users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}\*.*" /s /c
 ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[createrestorepoint]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log

Next

We'll open IE a different way and see if it is any better.

Make sure IE is closed. Right click the taskbar near the clock. Click Taskmanger

click file
click New Task (run)
type iexplore
click ok

Does IE work any better?

Edwinnnn

Post #23December 26, 2012, 7:15 PM UTC

Followed your method opening IE but same results.. unable to view FB and view videos ..

here's the fix log..
Again…thanks for everything..

All processes killed
========== SERVICES/DRIVERS ==========
========== FILES ==========
File\Folder C:\Users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}\syshost.exe not found.
< dir "C:\Users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}\*.*" /s /c >
Volume in drive C has no label.
Volume Serial Number is FCEF-1C30
Directory of C:\Users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}
26/12/2012 03:06 PM .
26/12/2012 03:06 PM ..
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
2 Dir(s) 308,599,357,440 bytes free
C:\Users\Kun Jin\Desktop\cmd.bat deleted successfully.
C:\Users\Kun Jin\Desktop\cmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Kun Jin\Desktop\cmd.bat deleted successfully.
C:\Users\Kun Jin\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Kun Jin
->Temp folder emptied: 225792563 bytes
->Temporary Internet Files folder emptied: 1998502446 bytes
->Java cache emptied: 368975 bytes
->Google Chrome cache emptied: 133449062 bytes
->Flash cache emptied: 923 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6150 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 1262719 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 2,250.00 mb

System Restore Service not available.

OTL by OldTimer - Version 3.2.69.0 log created on 12272012_030630

Files\Folders moved on Reboot…
C:\Users\Kun Jin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QZM9UX3G\index[1].htm moved successfully.
C:\Users\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Edwinnnn

Post #24December 26, 2012, 7:23 PM UTC last edited December 26, 2012, 7:24 PM UTC

just found out my Kingsoft antivirus doesn't seem to work/probably the virus malfunctioned it .. and i don't have any antivirus to protect my com now… can you recommend some good AV ? . Thanks ! .

oldman960

Post #25December 26, 2012, 8:54 PM UTC last edited December 26, 2012, 8:55 PM UTC

Hi Edwinnnn,

Let's see if we can sort your av problem out. It may resolve some of the issues.

you can get the kaspersky removal tool and instructions for it's use from HERE

Uninstall Kingsoft via Uninstall a program.

Don't do any surfing other than posting in this topic without an antivirus program. Post back when you are finished and I'll give you some links to some good free antivirus programs.

Edwinnnn

Post #26December 27, 2012, 8:16 AM UTC

Okay.. removed all my antivirus..

oldman960

Post #27December 27, 2012, 8:18 AM UTC

Hi Edwinnnn, Computer any better?

Edwinnnn

Post #28December 27, 2012, 8:24 AM UTC last edited December 27, 2012, 9:19 AM UTC

yupp . that fixed IE , i can now view FB and videos , download stuffs too..Thanks! btw how did kaspersky interfere with my IE ? .

oldman960

Post #29December 27, 2012, 9:36 AM UTC

Hi Edwinnnn,

It was most likely a conflict between Kasperky and Kingsoft plus the fact both were corrupted.

Download and install one of these antivirus programs. Once you have it installed open OTL and click the Quick scan button and post the log.

Avast
Help and support can be found here Avast Forum

Microsoft Security Essentials
Support

Antivir PersonalEditionClassic
Help and support can be found here Avira Personal Support Forum

Edwinnnn

Post #30December 27, 2012, 11:37 AM UTC last edited December 27, 2012, 11:42 AM UTC

here's the log

P.S i forgot to unistall kingsoft , just unistalled after posting this log :X

OTL logfile created on: 27/12/2012 7:28:19 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kun Jin\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

7.91 Gb Total Physical Memory | 5.11 Gb Available Physical Memory | 64.56% Memory free
15.82 Gb Paging File | 12.46 Gb Available in Paging File | 78.77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453.16 Gb Total Space | 288.42 Gb Free Space | 63.65% Space Free | Partition Type: NTFS

Computer Name: KUNJIN-VAIO | User Name: Kun Jin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Kun Jin\Desktop\mirror.scr (OldTimer Tools)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_135_ActiveX.exe (Adobe Systems Incorporated)
PRC - C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\knbcenter.exe (Kingsoft Corporation)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\afwServ.exe (AVAST Software)
PRC - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCTray.exe (Tencent)
PRC - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCRTP.exe (Tencent)
PRC - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Program Files (x86)\QvodPlayer\QvodTerminal.exe (Shenzhen QVOD Technology Co.,Ltd)
PRC - C:\Program Files\TENCENT\AddrUpdate\AddrUpdate.exe (Tencent)
PRC - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe ()
PRC - C:\Program Files (x86)\Tencent\SOSOAddr\txiehelp.exe (腾讯)
PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Care\listener.exe (Sony of America Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ggspawn.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\0fc35f0deb45a9ed030009ac1e673840\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\9d19c4e8d91bf2f766f7b2b70278d448\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\c11e8c8ee98243f81088d49822c15852\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\c423a5b0a857fb4fe4f856a6b88787e2\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\d86faac9b3fb996a7210e9783b76ca1a\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\0a9b81930af930d919969bb234026375\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3b9f9cee47282e10cdafb32b8c5d240a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\4db13ed5b635a3d708647855400b6750\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1eccdb959aa1aedaa2e7b4e14e332f3e\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\703b27023a4fddb44d47f4b3010c324c\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\TSWebMon.dat ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\libjpegturbo.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\tinyxml.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\zlib.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\sqlite.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\libexpatw.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\libpng.dll ()
MOD - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\arkGraphic.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (avast! Firewall) – C:\Program Files\AVAST Software\Avast\afwServ.exe (AVAST Software)
SRV:64bit: - (TBUpdate) – C:\Program Files\Tencent\barupdate\TBUpdate.exe (Tencent)
SRV:64bit: - (ARUpdate) – C:\Program Files\TENCENT\AddrUpdate\AddrUpdate.exe (Tencent)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (VCService) – C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation)
SRV:64bit: - (SampleCollector) – C:\Program Files\Sony\VAIO Care\VCPerfService.exe (Sony Corporation)
SRV:64bit: - (VSNService) – C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation)
SRV:64bit: - (VUAgent) – C:\Program Files\Sony\VAIO Update Common\VUAgent.exe (Sony Corporation)
SRV:64bit: - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV:64bit: - (VAIO Power Management) – C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
SRV:64bit: - (VcmIAlzMgr) – C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV:64bit: - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV:64bit: - (VcmXmlIfHelper) – C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe (Sony Corporation)
SRV:64bit: - (VcmINSMgr) – C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe (Sony Corporation)
SRV:64bit: - (SpfService) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe (Sony Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (kxescore) – c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe (Kingsoft Corporation)
SRV - (Skype C2C Service) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (knbcenter) – C:\Users\Kun Jin\AppData\Local\liebao\LBBrowser\knbcenter.exe (Kingsoft Corporation)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (NOBU) – C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
SRV - (QQPCRTP) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCRTP.exe (Tencent)
SRV - (HssWd) – C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe ()
SRV - (HssSrv) – C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (VAIO Event Service) – C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (Sony Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (IAStorDataMgrSvc) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (PMBDeviceInfoProvider) – C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (BBSvc) – C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (uCamMonitor) – C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
SRV - (SOHCImp) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe (Sony Corporation)
SRV - (SOHDs) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe (Sony Corporation)
SRV - (VCFw) – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (kavbootc) – C:\Windows\SysNative\drivers\kavbootc64.sys (Kingsoft Corporation)
DRV:64bit: - (kisknl) – C:\Windows\SysNative\drivers\kisknl.sys (Kingsoft Corporation)
DRV:64bit: - (aswTdi) – C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswSnx) – C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) – C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswNdis2) – C:\Windows\SysNative\drivers\aswNdis2.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) – C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswKbd) – C:\Windows\SysNative\drivers\aswKbd.sys (AVAST Software)
DRV:64bit: - (aswFW) – C:\Windows\SysNative\drivers\aswFW.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) – C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (TFsFlt) – C:\Windows\SysNative\drivers\TFsFltX64.sys (Tencent)
DRV:64bit: - (aswRdr) – C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswNdis) – C:\Windows\SysNative\drivers\aswNdis.sys (ALWIL Software)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (HaozipVirtualCDBus) – C:\Windows\SysNative\drivers\HaoZipVirtualCDBus.sys (Shanghai RuiChuang)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (taphss) – C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (intelkmd) – C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (risdsnpe) – C:\Windows\SysNative\drivers\risdsnxc64.sys (REDC)
DRV:64bit: - (rimspci) – C:\Windows\SysNative\drivers\rimssne64.sys (REDC)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (BTWAMPFL) – C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (NETwNs64) – C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (nusb3xhc) – C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) – C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (SFEP) – C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (e1yexpress) – C:\Windows\SysNative\drivers\e1y60x64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ArcSoftKsUFilter) – C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)
DRV - (QqNetflpwControl) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QMNetflow764.sys (tencent)
DRV - (TFsFlt) – C:\Windows\SysWOW64\drivers\TFsFltX64.sys (Tencent)
DRV - (TcHardWare) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCHW-x64.sys (Tencent)
DRV - (TsFltMgr) – C:\Windows\SysWOW64\drivers\TsFltMgr.sys (Tencent)
DRV - (QQSysMonX64) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQSysMonX64.sys (Tencent)
DRV - (TSCPM) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\tscpm64.sys (Tencent)
DRV - (TCSafeBox) – C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\TCSafeBox64.sys (Tencent)
DRV - (KDHacker) – c:\Program Files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker64.sys (Kingsoft Corporation)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://123.duba.net/?f=dbsj
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.sony.com.sg/microsite/vaio/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\SearchScopes,DefaultScope = {1FF7973D-AB0A-496d-82C1-4EADBBA11E7B}
IE - HKCU\..\SearchScopes\{0067C841-E764-4961-8A21-B159D051DBA9}: "URL" = http://www.bing.com/search?FORM=UP22DF&…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{1FF7973D-AB0A-496d-82C1-4EADBBA11E7B}: "URL" = http://www.soso.com/q?sc=web&cid=th.ub…;unc=y400372_95
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@kingsfot.com/npkws: C:\Program Files (x86)\kingsoft\kingsoft antivirus\npkws.dll (Kingsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@kingsoft.com/npkvip: c:\program files (x86)\kingsoft\kingsoft antivirus\npkvip.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall: C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/QQlive: C:\Program Files (x86)\Tencent\QQLive\LiveOcx\npQQLive.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/QQPCMgr: C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\npQMExtensionsMozilla.dll (Tencent Technology (Shenzhen) Company Limited)
FF - HKLM\Software\MozillaPlugins\@qq.com/QQPhotoDrawEx: C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll ()
FF - HKLM\Software\MozillaPlugins\@qq.com/QzoneMusic: C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/TXSSO: C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll ()
FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodInsert: C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll (Shenzhen QVOD Technology Co.,Ltd)
FF - HKLM\Software\MozillaPlugins\@RadioRage_4j.com/Plugin: C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/12/24 19:19:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\4jffxtbr@RadioRage_4j.com: C:\Program Files (x86)\RadioRage_4j\bar\1.bin

========== Chrome ==========

CHR - homepage: http://www.google.com
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QQ2011 (Enabled) = C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll
CHR - plugin: NPTXSSO Dynamic Link Library (Enabled) = C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U5 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: QvodInsert (Enabled) = C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll
CHR - plugin: MindSpark Toolbar Platform Plugin Stub (Enabled) = C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Media Go Detector (Enabled) = C:\Program Files (x86)\Sony\Media Go\npmediago.dll
CHR - plugin: \u817E\u8BAF\u89C6\u9891 (Enabled) = C:\Program Files (x86)\Tencent\QQLive\LiveOcx\npQQLive.dll
CHR - plugin: QQMusic (Enabled) = C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll
CHR - plugin: npQQPhotoDrawEx (Enabled) = C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dllCHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Kingsoft@Firefox ActiveX Comm (Enabled) = c:\program files (x86)\kingsoft\kingsoft antivirus\npkvip.dll
CHR - plugin: Kingsoft Internet Security (Enabled) = c:\program files (x86)\kingsoft\kingsoft antivirus\npkws.dll
CHR - Extension: avast! WebRep = C:\Users\Kun Jin\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0\

O1 HOSTS File: ([2012/12/26 03:36:25 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (no name) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - No CLSID value found.
O2:64bit: - BHO: (QQ电脑管家网页防火墙) - {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\TSWebMon64.dat (Tencent)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - No CLSID value found.
O2 - BHO: (IE Search Helper) - {5816DEEA-1962-7AF5-8444-8FB1EB633FE2} - C:\Program Files (x86)\Tencent\SOSOAddr\ieaddr.dll (腾讯)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (电脑管家网页防火墙) - {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\TSWebMon.dat ()
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D297} - C:\Program Files (x86)\QvodPlayer\QvodExtend.dll (Shenzhen QVOD Technology Co.,Ltd)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ QQPCTray] C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\QQPCTray.exe (Tencent)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Dolby Home Theater v4] C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe (Dolby Laboratories Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [kxesc] c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe (Kingsoft Corporation)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [QvodTerminal] C:\Program Files (x86)\QvodPlayer\QvodTerminal.exe (Shenzhen QVOD Technology Co.,Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [QQ2009] C:\Program Files (x86)\Tencent\QQ\Bin\QQ.exe (Tencent)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Domains: qq.com ([cache.tv] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([qqlivecaption] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([qqlivehabit] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([qqlivesearch] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([video_1] http in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB0026D1-9ACC-4583-938F-F56066697B99}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/12/27 19:07:18 | 000,132,864 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswFW.sys
[2012/12/27 19:07:10 | 000,262,656 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswNdis2.sys
[2012/12/27 19:07:10 | 000,021,136 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswKbd.sys
[2012/12/27 19:07:08 | 000,012,368 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswNdis.sys
[2012/12/27 19:03:51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Internet Security
[2012/12/27 19:00:36 | 000,370,288 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswSP.sys
[2012/12/27 19:00:36 | 000,025,232 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012/12/27 19:00:33 | 000,054,072 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswRdr2.sys
[2012/12/27 19:00:32 | 000,059,728 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswTdi.sys
[2012/12/27 19:00:29 | 000,984,144 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswSnx.sys
[2012/12/27 19:00:28 | 000,071,600 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012/12/27 19:00:27 | 000,285,328 | —- | C] (AVAST Software) – C:\Windows\SysNative\aswBoot.exe
[2012/12/27 19:00:12 | 000,227,648 | —- | C] (AVAST Software) – C:\Windows\SysWow64\aswBoot.exe
[2012/12/27 19:00:12 | 000,041,224 | —- | C] (AVAST Software) – C:\Windows\avastSS.scr
[2012/12/27 19:00:02 | 000,000,000 | —D | C] – C:\ProgramData\AVAST Software
[2012/12/27 19:00:02 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2012/12/27 16:13:43 | 004,870,584 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Kun Jin\Desktop\kavremover.exe
[2012/12/26 10:20:58 | 004,732,416 | —- | C] (AVAST Software) – C:\Users\Kun Jin\Desktop\aswMBR.exe
[2012/12/26 03:47:20 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/12/26 03:40:55 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/12/26 03:20:03 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/12/26 03:20:03 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/12/26 03:20:03 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/12/26 03:19:40 | 000,000,000 | —D | C] – C:\ComboFix
[2012/12/26 03:19:25 | 000,000,000 | —D | C] – C:\Qoobox
[2012/12/26 03:18:54 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/12/26 03:15:56 | 005,013,093 | R— | C] (Swearware) – C:\Users\Kun Jin\Desktop\ComboFix.exe
[2012/12/25 17:12:04 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{652A10D2-BEA1-428E-A730-15CA06C1D7F7}
[2012/12/25 17:09:48 | 000,000,000 | —D | C] – C:\_OTL
[2012/12/25 15:34:42 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Kun Jin\Desktop\mirror.scr
[2012/12/25 01:32:06 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\iolo
[2012/12/24 18:29:25 | 000,000,000 | —D | C] – C:\Windows\ELAMBKUP
[2012/12/24 18:28:19 | 000,000,000 | —D | C] – C:\Config.Msi
[2012/12/24 17:17:24 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2012/12/24 17:17:24 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\MFAData
[2012/12/24 17:17:24 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2012/12/24 17:17:24 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\Avg2013
[2012/12/24 17:07:21 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2012/12/24 16:38:52 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\ElevatedDiagnostics
[2012/12/24 14:39:10 | 000,232,272 | —- | C] (Trend Micro Inc.) – C:\Windows\TmNSCIns.dll
[2012/12/24 13:20:39 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}
[2012/12/24 13:02:44 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{204A7560-72B6-43F5-976A-E28701AC22E1}
[2012/12/23 12:33:46 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{BCEC7246-5B8A-442C-8C95-196082AA57E2}
[2012/12/22 13:52:10 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{B0A2F42F-D880-44AF-964C-36F36695BF76}
[2012/12/22 00:55:48 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{2A0EDD02-FCA5-4250-9927-3E1E168F61FD}
[2012/12/21 23:41:35 | 000,000,000 | —D | C] – C:\ProgramData\KRSHistory
[2012/12/21 23:40:48 | 000,000,000 | —D | C] – C:\ProgramData\ksrbm
[2012/12/21 12:55:24 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{F82AAA1F-F1BC-407C-8F84-2081F0269FB5}
[2012/12/21 00:55:01 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{6C501E4F-A6C5-469B-9C31-87F473931601}
[2012/12/20 09:10:39 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{059ED6B3-2546-4297-BFCF-DA00C401881A}
[2012/12/19 16:48:50 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\ELEX
[2012/12/19 16:03:26 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\HaoZip
[2012/12/19 16:03:22 | 000,000,000 | —D | C] – C:\Program Files\HaoZip
[2012/12/19 14:52:27 | 000,000,000 | —D | C] – C:\Users\Kun Jin\Documents\eCatalogues
[2012/12/19 14:52:27 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\DNAML
[2012/12/19 14:52:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF2PageTurn
[2012/12/19 14:28:44 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{A28A1782-4D2D-4CD3-9A6A-8109AA73F118}
[2012/12/19 02:07:52 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{443B49A9-F27E-4256-BDCA-D77FFF2CFA61}
[2012/12/18 13:03:12 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{96E630BD-EFE3-4CAE-928D-E242D58904C3}
[2012/12/18 01:02:48 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{4BDEA9C9-6431-4943-B7D1-61637B33E0E1}
[2012/12/17 12:26:43 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{8E59F50E-43DE-4498-8A1D-BAD76BFC2EBF}
[2012/12/16 17:16:33 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{E48AEDD8-9A0E-4516-9176-E3B72537BF77}
[2012/12/15 13:43:15 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\AutoGG
[2012/12/15 12:47:42 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{76BDB65F-AE9A-4CD6-B939-72C37BE4A9EB}
[2012/12/14 13:17:45 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{4C6E2C20-6A07-4742-A896-DC7CCB6CE70D}
[2012/12/14 01:00:11 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{C0F23098-03AA-4027-8FF7-CAE74F913237}
[2012/12/13 11:53:26 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{5732AF26-0062-4F16-B31C-720F79D97A0C}
[2012/12/12 15:19:37 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{CC3E7648-A149-40FC-96BD-E66992F8B5A1}
[2012/12/11 11:57:43 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{7B453AD7-48F6-4B62-BFC5-E806655E2D09}
[2012/12/10 19:22:24 | 000,000,000 | —D | C] – C:\Download
[2012/12/10 08:58:40 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{73859F94-1EFA-409B-BDD5-69C9429EF85C}
[2012/12/09 09:45:29 | 000,000,000 | —D | C] – C:\Users\Kun Jin\Desktop\Law Paper
[2012/12/09 09:24:07 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{01E3A7CE-6413-4827-BA9D-CB215A074EE8}
[2012/12/08 09:45:39 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{9D492B60-13A2-45A3-9513-74DB8D45E89C}
[2012/12/07 13:45:59 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{E5135BEF-F4BD-45B9-BE96-C87872A92CA5}
[2012/12/07 01:45:32 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{901026C1-A32A-44A6-9D13-18250DEECB92}
[2012/12/06 13:20:41 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{F378A05F-FC02-484C-9091-FD7AEAB1D4A6}
[2012/12/05 12:51:19 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{4DF2232D-E804-4BD7-B2CF-8718B8FD8A83}
[2012/12/04 09:46:01 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{B5E70262-F0B1-4B7D-955C-59CBBE6D840B}
[2012/12/03 11:01:17 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{68A3CA2D-7C2B-4910-9269-F59C564A1E42}
[2012/12/02 20:53:28 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{D0C1886A-A9C1-446B-90F2-9D897963D7CE}
[2012/12/02 08:53:03 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{24B5285A-52B6-439E-A639-AE5BB29501E1}
[2012/12/01 15:43:44 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{C64F4C01-5B4F-4CBB-ADF2-14C91BF3E194}
[2012/12/01 11:32:32 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\xim
[2012/12/01 00:51:52 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{8C3FCE3A-F2F1-47A3-93B0-AAE7203930CA}
[2012/11/30 11:58:02 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{461F1A2B-98D0-43C4-BD41-8AD5E2646C73}
[2012/11/29 11:59:34 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{6000DE7A-BB23-423E-91E8-F3D7A26782F0}
[2012/11/28 15:42:15 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{FE09B298-74DD-460E-9291-F55002BB081F}
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/12/27 19:21:00 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/27 19:15:46 | 000,020,928 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/27 19:15:46 | 000,020,928 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/27 19:08:36 | 000,000,384 | —- | M] () – C:\Windows\tasks\RNUpgradeHelperLogonPrompt_Kun Jin.job
[2012/12/27 19:08:33 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/27 19:08:11 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/12/27 19:08:07 | 2077,597,695 | -HS- | M] () – C:\hiberfil.sys
[2012/12/27 19:07:10 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\config.nt
[2012/12/27 19:03:51 | 000,001,958 | —- | M] () – C:\Users\Public\Desktop\avast! Internet Security.lnk
[2012/12/27 18:50:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/12/27 18:44:00 | 000,000,378 | —- | M] () – C:\Windows\tasks\ReclaimerUpdateFiles_Kun Jin.job
[2012/12/27 01:43:05 | 000,466,918 | —- | M] () – C:\test.xml
[2012/12/26 10:51:44 | 000,000,564 | —- | M] () – C:\Users\Kun Jin\Desktop\MBR.zip
[2012/12/26 10:49:44 | 000,000,512 | —- | M] () – C:\Users\Kun Jin\Desktop\MBR.dat
[2012/12/26 10:21:05 | 004,732,416 | —- | M] (AVAST Software) – C:\Users\Kun Jin\Desktop\aswMBR.exe
[2012/12/26 03:36:25 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012/12/26 03:16:40 | 005,013,093 | R— | M] (Swearware) – C:\Users\Kun Jin\Desktop\ComboFix.exe
[2012/12/26 00:33:00 | 000,000,374 | —- | M] () – C:\Windows\tasks\ReclaimerUpdateXML_Kun Jin.job
[2012/12/25 15:12:56 | 000,794,862 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/12/25 15:12:56 | 000,676,512 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/12/25 15:12:56 | 000,129,556 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/12/24 13:41:29 | 000,001,447 | —- | M] () – C:\Users\Kun Jin\Desktop\Internet Explorer.lnk
[2012/12/24 09:44:26 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Kun Jin\Desktop\mirror.scr
[2012/12/21 23:41:49 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.ics
[2012/12/21 12:21:52 | 000,301,392 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/19 14:52:22 | 000,001,011 | —- | M] () – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\PDF2PageTurn.lnk
[2012/12/15 01:17:30 | 000,045,270 | —- | M] () – C:\Users\Kun Jin\AppData\Roaming\room_v3.dat
[2012/12/10 18:23:27 | 000,000,522 | —- | M] () – C:\Users\Kun Jin\Desktop\GsNJNwuI-UM.gif
[2012/11/30 12:05:48 | 000,018,296 | —- | M] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\kusbquery64.sys
[2012/11/30 12:05:48 | 000,014,200 | —- | M] (Kingsoft Corporation) – C:\Windows\SysNative\drivers\kusbquery.sys
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/12/27 19:03:51 | 000,001,958 | —- | C] () – C:\Users\Public\Desktop\avast! Internet Security.lnk
[2012/12/27 19:00:28 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\config.nt
[2012/12/26 10:51:44 | 000,000,564 | —- | C] () – C:\Users\Kun Jin\Desktop\MBR.zip
[2012/12/26 10:49:44 | 000,000,512 | —- | C] () – C:\Users\Kun Jin\Desktop\MBR.dat
[2012/12/26 03:20:03 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/12/26 03:20:03 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/12/26 03:20:03 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/12/26 03:20:03 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/12/26 03:20:03 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/12/24 14:39:10 | 000,001,740 | —- | C] () – C:\Windows\TmTdi.inf
[2012/12/24 13:41:29 | 000,001,447 | —- | C] () – C:\Users\Kun Jin\Desktop\Internet Explorer.lnk
[2012/12/19 14:52:22 | 000,274,432 | —- | C] () – C:\Windows\SysWow64\SkinX.dll
[2012/12/19 14:52:22 | 000,001,011 | —- | C] () – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\PDF2PageTurn.lnk
[2012/12/17 23:35:03 | 000,000,384 | —- | C] () – C:\Windows\tasks\RNUpgradeHelperLogonPrompt_Kun Jin.job
[2012/12/17 23:35:02 | 000,000,378 | —- | C] () – C:\Windows\tasks\ReclaimerUpdateFiles_Kun Jin.job
[2012/12/17 23:35:02 | 000,000,374 | —- | C] () – C:\Windows\tasks\ReclaimerUpdateXML_Kun Jin.job
[2012/12/10 23:12:42 | 000,000,522 | —- | C] () – C:\Users\Kun Jin\Desktop\GsNJNwuI-UM.gif
[2012/10/07 22:17:17 | 000,000,001 | —- | C] () – C:\Windows\SysWow64\SI.bin
[2012/06/18 09:01:19 | 000,000,419 | —- | C] () – C:\Windows\BRWMARK.INI
[2012/06/18 09:01:19 | 000,000,027 | —- | C] () – C:\Windows\BRPP2KA.INI
[2012/04/15 22:06:47 | 000,018,760 | —- | C] () – C:\Windows\SysWow64\QQVistaHelper.dll
[2012/01/06 23:36:54 | 000,000,243 | —- | C] () – C:\ProgramData\MusicStation.xml
[2011/12/22 19:19:02 | 000,045,270 | —- | C] () – C:\Users\Kun Jin\AppData\Roaming\room_v3.dat
[2011/08/10 09:57:07 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/08/10 09:53:22 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblup.dat
[2011/07/28 09:26:00 | 000,963,116 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2011/07/28 09:25:59 | 013,906,944 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll
[2011/07/28 09:25:59 | 000,218,304 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2011/07/28 09:25:59 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/07/28 09:25:59 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2011/07/28 09:25:59 | 000,028,732 | —- | C] () – C:\Windows\SysWow64\ativvsny.dat
[2011/07/28 09:25:59 | 000,026,936 | —- | C] () – C:\Windows\SysWow64\ativvsnl.dat
[2011/07/28 09:25:58 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/06/30 23:01:52 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2011/06/29 09:44:43 | 000,066,856 | —- | C] () – C:\Windows\SysWow64\SynTPEnhPS.dll
[2011/02/15 08:47:22 | 000,780,986 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI

========== ZeroAccess Check ==========

[2009/07/14 12:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 13:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 12:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 09:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/21 11:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 09:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/12/15 13:44:09 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\AutoGG
[2012/12/19 14:52:27 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\DNAML
[2012/12/24 19:19:08 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\ELEX
[2012/12/24 19:19:08 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Garena
[2012/12/27 17:21:09 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\GarenaPlus
[2012/12/27 19:28:07 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\HaoZip
[2012/12/25 01:32:07 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\iolo
[2012/11/05 12:52:04 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Kingsoft
[2012/10/27 00:11:49 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\LolClient
[2012/10/21 18:36:42 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Maxthon3
[2011/12/23 22:01:54 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Sony
[2012/01/18 21:28:10 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Sports Interactive
[2012/10/24 08:29:44 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Tencent
[2012/10/21 09:41:46 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Wandoujia2
[2011/12/23 15:42:37 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Windows Live Writer
[2012/12/01 11:32:32 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\xim

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2012/12/21 23:45:51 | 000,000,940 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\?? Internet Explorer ???.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
[2012/12/21 23:45:51 | 000,000,940 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\?? Internet Explorer ???.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
[2012/12/19 16:03:33 | 000,000,000 | —D | C](C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\2345??) – C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\2345好压
[2012/04/15 22:34:42 | 000,001,167 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk
[2012/04/15 22:34:42 | 000,001,167 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk
[2012/04/15 22:09:22 | 000,002,045 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\????.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯视频.lnk
[2012/04/15 22:09:22 | 000,002,045 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\????.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯视频.lnk
[2012/04/15 22:07:12 | 000,002,239 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\??QQ.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯QQ.lnk
[2012/04/15 22:07:12 | 000,002,239 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\??QQ.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯QQ.lnk
(C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\?????) – C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\猎豹浏览器
(C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\????) – C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\金山毒霸
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯软件

========== Alternate Data Streams ==========

@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:98181191

< End of report >

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Window getting hijacked by spyware/malware, [Solved]

✨ Ask AI

Ask AI