Spyware / Malware / Virus Removal

Window getting hijacked by spyware/malware, [Solved]

27 min read

Looking for the outcome? Ask AI

Edwinnnn

Post #31December 27, 2012, 12:07 PM UTC

Avast detected 4 infections , but the location was at OTL_Moved Files , i think it's the files that is affected which u helped me with OTL to get rid of .. Deleted the files with avast…

oldman960

Post #32December 27, 2012, 4:34 PM UTC

Hi Edwinnnn, Please run OTL again. I need a log from a scan taken after Kingsoft was uninstalled to check for remnants of it.

Edwinnnn

Post #33December 27, 2012, 5:17 PM UTC

Thanksss,here's the log

OTL logfile created on: 28/12/2012 1:11:10 AM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Kun Jin\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00004809 | Country: Singapore | Language: ENE | Date Format: d/M/yyyy

7.91 Gb Total Physical Memory | 5.27 Gb Available Physical Memory | 66.64% Memory free
15.82 Gb Paging File | 12.52 Gb Available in Paging File | 79.09% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453.16 Gb Total Space | 288.82 Gb Free Space | 63.73% Space Free | Partition Type: NTFS

Computer Name: KUNJIN-VAIO | User Name: Kun Jin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Kun Jin\Desktop\mirror.scr (OldTimer Tools)
PRC - C:\Users\Kun Jin\Desktop\Garena Plus\GarenaMessenger.exe ()
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_135_ActiveX.exe (Adobe Systems Incorporated)
PRC - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\GarenaTalkOverlay.exe ()
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\afwServ.exe (AVAST Software)
PRC - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Program Files (x86)\QvodPlayer\QvodTerminal.exe (Shenzhen QVOD Technology Co.,Ltd)
PRC - C:\Program Files\TENCENT\AddrUpdate\AddrUpdate.exe (Tencent)
PRC - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe ()
PRC - C:\Program Files (x86)\Tencent\SOSOAddr\txiehelp.exe (腾讯)
PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation)
PRC - C:\Program Files\Sony\VAIO Care\listener.exe (Sony of America Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Users\Kun Jin\Desktop\Garena Plus\VersionModule.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ggspawn.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\xim\plugin_xmpp.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\xim\plugin_yahoo.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\xim\plugin_msn.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\GaFileTransfer.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\XLL.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\TaskManagerLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\StatsPlugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\PluginNews.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\PlatformPlugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\ggplugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\DailyTaskPlugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\xIM.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\GarenaMessenger.exe ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\Overlay.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\GarenaTalkOverlay.exe ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\Plugins\GarenaTalkPlugin.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\CxImage.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\Http.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\FileSender.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\0fc35f0deb45a9ed030009ac1e673840\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\9d19c4e8d91bf2f766f7b2b70278d448\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\130a01a65302d258744f423012fc4983\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\c11e8c8ee98243f81088d49822c15852\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\c423a5b0a857fb4fe4f856a6b88787e2\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\d86faac9b3fb996a7210e9783b76ca1a\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\0a9b81930af930d919969bb234026375\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3b9f9cee47282e10cdafb32b8c5d240a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\4db13ed5b635a3d708647855400b6750\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1eccdb959aa1aedaa2e7b4e14e332f3e\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\703b27023a4fddb44d47f4b3010c324c\mscorlib.ni.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ImageModule.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\DibModule.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\FileLoader.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\PluginKernel.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\PluginModule.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\UILayout.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\XmlUIModule.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ggdownloader.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\libzmq.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\ClientTcp.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\UdtLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\fs\YYFileSystem.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\MediaEngine.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\AudioMixerLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ServerMemAlloc.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\delay_load\RSALib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\sqlite3.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\CommonLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\bbtalk\PluginKernel.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\ggcode.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lib\MP3Module.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\CommonLib.dll ()
MOD - C:\Users\Kun Jin\Desktop\Garena Plus\lame_enc.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (avast! Firewall) – C:\Program Files\AVAST Software\Avast\afwServ.exe (AVAST Software)
SRV:64bit: - (TBUpdate) – C:\Program Files\Tencent\barupdate\TBUpdate.exe (Tencent)
SRV:64bit: - (ARUpdate) – C:\Program Files\TENCENT\AddrUpdate\AddrUpdate.exe (Tencent)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (VCService) – C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation)
SRV:64bit: - (SampleCollector) – C:\Program Files\Sony\VAIO Care\VCPerfService.exe (Sony Corporation)
SRV:64bit: - (VSNService) – C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation)
SRV:64bit: - (VUAgent) – C:\Program Files\Sony\VAIO Update Common\VUAgent.exe (Sony Corporation)
SRV:64bit: - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) – C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV:64bit: - (VAIO Power Management) – C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
SRV:64bit: - (VcmIAlzMgr) – C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV:64bit: - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV:64bit: - (VcmXmlIfHelper) – C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe (Sony Corporation)
SRV:64bit: - (VcmINSMgr) – C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe (Sony Corporation)
SRV:64bit: - (SpfService) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe (Sony Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Skype C2C Service) – C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (NOBU) – C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
SRV - (HssWd) – C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe ()
SRV - (HssSrv) – C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (VAIO Event Service) – C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (Sony Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (IAStorDataMgrSvc) – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (PMBDeviceInfoProvider) – C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (BBSvc) – C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (uCamMonitor) – C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
SRV - (SOHCImp) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe (Sony Corporation)
SRV - (SOHDs) – C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe (Sony Corporation)
SRV - (VCFw) – C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (aswTdi) – C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswSnx) – C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) – C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswNdis2) – C:\Windows\SysNative\drivers\aswNdis2.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) – C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswKbd) – C:\Windows\SysNative\drivers\aswKbd.sys (AVAST Software)
DRV:64bit: - (aswFW) – C:\Windows\SysNative\drivers\aswFW.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) – C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (aswRdr) – C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswNdis) – C:\Windows\SysNative\drivers\aswNdis.sys (ALWIL Software)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (HaozipVirtualCDBus) – C:\Windows\SysNative\drivers\HaoZipVirtualCDBus.sys (Shanghai RuiChuang)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (taphss) – C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (intelkmd) – C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (risdsnpe) – C:\Windows\SysNative\drivers\risdsnxc64.sys (REDC)
DRV:64bit: - (rimspci) – C:\Windows\SysNative\drivers\rimssne64.sys (REDC)
DRV:64bit: - (L1C) – C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (btwrchid) – C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) – C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) – C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (BTWAMPFL) – C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)
DRV:64bit: - (btwl2cap) – C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (NETwNs64) – C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (nusb3xhc) – C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) – C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (SFEP) – C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (e1yexpress) – C:\Windows\SysNative\drivers\e1y60x64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ArcSoftKsUFilter) – C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://123.duba.net/?f=dbsj
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.sony.com.sg/microsite/vaio/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\SearchScopes,DefaultScope = {1FF7973D-AB0A-496d-82C1-4EADBBA11E7B}
IE - HKCU\..\SearchScopes\{0067C841-E764-4961-8A21-B159D051DBA9}: "URL" = http://www.bing.com/search?FORM=UP22DF&…rc=IE-SearchBox
IE - HKCU\..\SearchScopes\{1FF7973D-AB0A-496d-82C1-4EADBBA11E7B}: "URL" = http://www.soso.com/q?sc=web&cid=th.ub…;unc=y400372_95
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@kingsfot.com/npkws: C:\Program Files (x86)\kingsoft\kingsoft antivirus\npkws.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall: C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/QQlive: C:\Program Files (x86)\Tencent\QQLive\LiveOcx\npQQLive.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/QQPCMgr: C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\npQMExtensionsMozilla.dll File not found
FF - HKLM\Software\MozillaPlugins\@qq.com/QQPhotoDrawEx: C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll ()
FF - HKLM\Software\MozillaPlugins\@qq.com/QzoneMusic: C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll (Tencent)
FF - HKLM\Software\MozillaPlugins\@qq.com/TXSSO: C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll ()
FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodInsert: C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll (Shenzhen QVOD Technology Co.,Ltd)
FF - HKLM\Software\MozillaPlugins\@RadioRage_4j.com/Plugin: C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/12/24 19:19:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\4jffxtbr@RadioRage_4j.com: C:\Program Files (x86)\RadioRage_4j\bar\1.bin

========== Chrome ==========

CHR - homepage: http://www.google.com
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QQ2011 (Enabled) = C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll
CHR - plugin: NPTXSSO Dynamic Link Library (Enabled) = C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.38\Bin\npSSOAxCtrlForPTLogin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U5 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: QvodInsert (Enabled) = C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll
CHR - plugin: MindSpark Toolbar Platform Plugin Stub (Enabled) = C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Media Go Detector (Enabled) = C:\Program Files (x86)\Sony\Media Go\npmediago.dll
CHR - plugin: \u817E\u8BAF\u89C6\u9891 (Enabled) = C:\Program Files (x86)\Tencent\QQLive\LiveOcx\npQQLive.dll
CHR - plugin: QQMusic (Enabled) = C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll
CHR - plugin: npQQPhotoDrawEx (Enabled) = C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Kingsoft@Firefox ActiveX Comm (Enabled) = c:\program files (x86)\kingsoft\kingsoft antivirus\npkvip.dll
CHR - plugin: Kingsoft Internet Security (Enabled) = c:\program files (x86)\kingsoft\kingsoft antivirus\npkws.dll
CHR - Extension: avast! WebRep = C:\Users\Kun Jin\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0\

O1 HOSTS File: ([2012/12/26 03:36:25 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (no name) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - No CLSID value found.
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - No CLSID value found.
O2 - BHO: (IE Search Helper) - {5816DEEA-1962-7AF5-8444-8FB1EB633FE2} - C:\Program Files (x86)\Tencent\SOSOAddr\ieaddr.dll (腾讯)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (电脑管家网页防火墙) - {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} - C:\Program Files (x86)\Tencent\QQPCMgr\7.2.6889.210\TSWebMon.dat File not found
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D297} - C:\Program Files (x86)\QvodPlayer\QvodExtend.dll (Shenzhen QVOD Technology Co.,Ltd)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Dolby Home Theater v4] C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe (Dolby Laboratories Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [QvodTerminal] C:\Program Files (x86)\QvodPlayer\QvodTerminal.exe (Shenzhen QVOD Technology Co.,Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [QQ2009] C:\Program Files (x86)\Tencent\QQ\Bin\QQ.exe (Tencent)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Domains: qq.com ([cache.tv] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([qqlivecaption] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([qqlivehabit] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([qqlivesearch] http in Trusted sites)
O15 - HKLM\..Trusted Domains: qq.com ([video_1] http in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.5.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB0026D1-9ACC-4583-938F-F56066697B99}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/12/27 19:07:18 | 000,132,864 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswFW.sys
[2012/12/27 19:07:10 | 000,262,656 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswNdis2.sys
[2012/12/27 19:07:10 | 000,021,136 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswKbd.sys
[2012/12/27 19:07:08 | 000,012,368 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswNdis.sys
[2012/12/27 19:03:51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Internet Security
[2012/12/27 19:00:36 | 000,370,288 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswSP.sys
[2012/12/27 19:00:36 | 000,025,232 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012/12/27 19:00:33 | 000,054,072 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswRdr2.sys
[2012/12/27 19:00:32 | 000,059,728 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswTdi.sys
[2012/12/27 19:00:29 | 000,984,144 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswSnx.sys
[2012/12/27 19:00:28 | 000,071,600 | —- | C] (AVAST Software) – C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012/12/27 19:00:27 | 000,285,328 | —- | C] (AVAST Software) – C:\Windows\SysNative\aswBoot.exe
[2012/12/27 19:00:12 | 000,227,648 | —- | C] (AVAST Software) – C:\Windows\SysWow64\aswBoot.exe
[2012/12/27 19:00:12 | 000,041,224 | —- | C] (AVAST Software) – C:\Windows\avastSS.scr
[2012/12/27 19:00:02 | 000,000,000 | —D | C] – C:\ProgramData\AVAST Software
[2012/12/27 19:00:02 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2012/12/27 16:13:43 | 004,870,584 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Kun Jin\Desktop\kavremover.exe
[2012/12/26 10:20:58 | 004,732,416 | —- | C] (AVAST Software) – C:\Users\Kun Jin\Desktop\aswMBR.exe
[2012/12/26 03:47:20 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/12/26 03:40:55 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/12/26 03:20:03 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/12/26 03:20:03 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/12/26 03:20:03 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/12/26 03:19:40 | 000,000,000 | —D | C] – C:\ComboFix
[2012/12/26 03:19:25 | 000,000,000 | —D | C] – C:\Qoobox
[2012/12/26 03:18:54 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2012/12/26 03:15:56 | 005,013,093 | R— | C] (Swearware) – C:\Users\Kun Jin\Desktop\ComboFix.exe
[2012/12/25 17:12:04 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{652A10D2-BEA1-428E-A730-15CA06C1D7F7}
[2012/12/25 17:09:48 | 000,000,000 | —D | C] – C:\_OTL
[2012/12/25 15:34:42 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Kun Jin\Desktop\mirror.scr
[2012/12/25 01:32:06 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\iolo
[2012/12/24 18:29:25 | 000,000,000 | —D | C] – C:\Windows\ELAMBKUP
[2012/12/24 18:28:19 | 000,000,000 | —D | C] – C:\Config.Msi
[2012/12/24 17:17:24 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2012/12/24 17:17:24 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\MFAData
[2012/12/24 17:17:24 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2012/12/24 17:17:24 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\Avg2013
[2012/12/24 17:07:21 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2012/12/24 16:38:52 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\ElevatedDiagnostics
[2012/12/24 14:39:10 | 000,232,272 | —- | C] (Trend Micro Inc.) – C:\Windows\TmNSCIns.dll
[2012/12/24 13:20:39 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{365F45AC-17FE-39D7-4849-5A852797FBAD}
[2012/12/24 13:02:44 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{204A7560-72B6-43F5-976A-E28701AC22E1}
[2012/12/23 12:33:46 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{BCEC7246-5B8A-442C-8C95-196082AA57E2}
[2012/12/22 13:52:10 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{B0A2F42F-D880-44AF-964C-36F36695BF76}
[2012/12/22 00:55:48 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{2A0EDD02-FCA5-4250-9927-3E1E168F61FD}
[2012/12/21 23:41:35 | 000,000,000 | —D | C] – C:\ProgramData\KRSHistory
[2012/12/21 23:40:48 | 000,000,000 | —D | C] – C:\ProgramData\ksrbm
[2012/12/21 12:55:24 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{F82AAA1F-F1BC-407C-8F84-2081F0269FB5}
[2012/12/21 00:55:01 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{6C501E4F-A6C5-469B-9C31-87F473931601}
[2012/12/20 09:10:39 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{059ED6B3-2546-4297-BFCF-DA00C401881A}
[2012/12/19 16:48:50 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\ELEX
[2012/12/19 16:03:26 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\HaoZip
[2012/12/19 16:03:22 | 000,000,000 | —D | C] – C:\Program Files\HaoZip
[2012/12/19 14:52:27 | 000,000,000 | —D | C] – C:\Users\Kun Jin\Documents\eCatalogues
[2012/12/19 14:52:27 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\DNAML
[2012/12/19 14:52:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF2PageTurn
[2012/12/19 14:28:44 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{A28A1782-4D2D-4CD3-9A6A-8109AA73F118}
[2012/12/19 02:07:52 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{443B49A9-F27E-4256-BDCA-D77FFF2CFA61}
[2012/12/18 13:03:12 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{96E630BD-EFE3-4CAE-928D-E242D58904C3}
[2012/12/18 01:02:48 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{4BDEA9C9-6431-4943-B7D1-61637B33E0E1}
[2012/12/17 12:26:43 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{8E59F50E-43DE-4498-8A1D-BAD76BFC2EBF}
[2012/12/16 17:16:33 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{E48AEDD8-9A0E-4516-9176-E3B72537BF77}
[2012/12/15 13:43:15 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\AutoGG
[2012/12/15 12:47:42 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{76BDB65F-AE9A-4CD6-B939-72C37BE4A9EB}
[2012/12/14 13:17:45 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{4C6E2C20-6A07-4742-A896-DC7CCB6CE70D}
[2012/12/14 01:00:11 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{C0F23098-03AA-4027-8FF7-CAE74F913237}
[2012/12/13 11:53:26 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{5732AF26-0062-4F16-B31C-720F79D97A0C}
[2012/12/12 15:19:37 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{CC3E7648-A149-40FC-96BD-E66992F8B5A1}
[2012/12/11 11:57:43 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{7B453AD7-48F6-4B62-BFC5-E806655E2D09}
[2012/12/10 19:22:24 | 000,000,000 | —D | C] – C:\Download
[2012/12/10 08:58:40 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{73859F94-1EFA-409B-BDD5-69C9429EF85C}
[2012/12/09 09:45:29 | 000,000,000 | —D | C] – C:\Users\Kun Jin\Desktop\Law Paper
[2012/12/09 09:24:07 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{01E3A7CE-6413-4827-BA9D-CB215A074EE8}
[2012/12/08 09:45:39 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{9D492B60-13A2-45A3-9513-74DB8D45E89C}
[2012/12/07 13:45:59 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{E5135BEF-F4BD-45B9-BE96-C87872A92CA5}
[2012/12/07 01:45:32 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{901026C1-A32A-44A6-9D13-18250DEECB92}
[2012/12/06 13:20:41 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{F378A05F-FC02-484C-9091-FD7AEAB1D4A6}
[2012/12/05 12:51:19 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{4DF2232D-E804-4BD7-B2CF-8718B8FD8A83}
[2012/12/04 09:46:01 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{B5E70262-F0B1-4B7D-955C-59CBBE6D840B}
[2012/12/03 11:01:17 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{68A3CA2D-7C2B-4910-9269-F59C564A1E42}
[2012/12/02 20:53:28 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{D0C1886A-A9C1-446B-90F2-9D897963D7CE}
[2012/12/02 08:53:03 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{24B5285A-52B6-439E-A639-AE5BB29501E1}
[2012/12/01 15:43:44 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{C64F4C01-5B4F-4CBB-ADF2-14C91BF3E194}
[2012/12/01 11:32:32 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Roaming\xim
[2012/12/01 00:51:52 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{8C3FCE3A-F2F1-47A3-93B0-AAE7203930CA}
[2012/11/30 11:58:02 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{461F1A2B-98D0-43C4-BD41-8AD5E2646C73}
[2012/11/29 11:59:34 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{6000DE7A-BB23-423E-91E8-F3D7A26782F0}
[2012/11/28 15:42:15 | 000,000,000 | —D | C] – C:\Users\Kun Jin\AppData\Local\{FE09B298-74DD-460E-9291-F55002BB081F}
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/12/28 00:50:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/12/28 00:34:00 | 000,000,374 | —- | M] () – C:\Windows\tasks\ReclaimerUpdateXML_Kun Jin.job
[2012/12/28 00:21:00 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/27 20:49:18 | 000,020,928 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/12/27 20:49:18 | 000,020,928 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/12/27 20:41:54 | 000,000,896 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/27 20:41:27 | 000,000,384 | —- | M] () – C:\Windows\tasks\RNUpgradeHelperLogonPrompt_Kun Jin.job
[2012/12/27 20:40:47 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/12/27 20:28:24 | 2077,597,695 | -HS- | M] () – C:\hiberfil.sys
[2012/12/27 19:07:10 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\config.nt
[2012/12/27 19:03:51 | 000,001,958 | —- | M] () – C:\Users\Public\Desktop\avast! Internet Security.lnk
[2012/12/27 18:44:00 | 000,000,378 | —- | M] () – C:\Windows\tasks\ReclaimerUpdateFiles_Kun Jin.job
[2012/12/27 01:43:05 | 000,466,918 | —- | M] () – C:\test.xml
[2012/12/26 10:51:44 | 000,000,564 | —- | M] () – C:\Users\Kun Jin\Desktop\MBR.zip
[2012/12/26 10:49:44 | 000,000,512 | —- | M] () – C:\Users\Kun Jin\Desktop\MBR.dat
[2012/12/26 10:21:05 | 004,732,416 | —- | M] (AVAST Software) – C:\Users\Kun Jin\Desktop\aswMBR.exe
[2012/12/26 03:36:25 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2012/12/26 03:16:40 | 005,013,093 | R— | M] (Swearware) – C:\Users\Kun Jin\Desktop\ComboFix.exe
[2012/12/25 15:12:56 | 000,794,862 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2012/12/25 15:12:56 | 000,676,512 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2012/12/25 15:12:56 | 000,129,556 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2012/12/24 13:41:29 | 000,001,447 | —- | M] () – C:\Users\Kun Jin\Desktop\Internet Explorer.lnk
[2012/12/24 09:44:26 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Kun Jin\Desktop\mirror.scr
[2012/12/21 23:41:49 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts.ics
[2012/12/21 12:21:52 | 000,301,392 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2012/12/19 14:52:22 | 000,001,011 | —- | M] () – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\PDF2PageTurn.lnk
[2012/12/15 01:17:30 | 000,045,270 | —- | M] () – C:\Users\Kun Jin\AppData\Roaming\room_v3.dat
[2012/12/10 18:23:27 | 000,000,522 | —- | M] () – C:\Users\Kun Jin\Desktop\GsNJNwuI-UM.gif
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/12/27 19:03:51 | 000,001,958 | —- | C] () – C:\Users\Public\Desktop\avast! Internet Security.lnk
[2012/12/27 19:00:28 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\config.nt[2012/12/26 10:51:44 | 000,000,564 | —- | C] () – C:\Users\Kun Jin\Desktop\MBR.zip
[2012/12/26 10:49:44 | 000,000,512 | —- | C] () – C:\Users\Kun Jin\Desktop\MBR.dat
[2012/12/26 03:20:03 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/12/26 03:20:03 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/12/26 03:20:03 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/12/26 03:20:03 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/12/26 03:20:03 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/12/24 14:39:10 | 000,001,740 | —- | C] () – C:\Windows\TmTdi.inf
[2012/12/24 13:41:29 | 000,001,447 | —- | C] () – C:\Users\Kun Jin\Desktop\Internet Explorer.lnk
[2012/12/19 14:52:22 | 000,274,432 | —- | C] () – C:\Windows\SysWow64\SkinX.dll
[2012/12/19 14:52:22 | 000,001,011 | —- | C] () – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\PDF2PageTurn.lnk
[2012/12/17 23:35:03 | 000,000,384 | —- | C] () – C:\Windows\tasks\RNUpgradeHelperLogonPrompt_Kun Jin.job
[2012/12/17 23:35:02 | 000,000,378 | —- | C] () – C:\Windows\tasks\ReclaimerUpdateFiles_Kun Jin.job
[2012/12/17 23:35:02 | 000,000,374 | —- | C] () – C:\Windows\tasks\ReclaimerUpdateXML_Kun Jin.job
[2012/12/10 23:12:42 | 000,000,522 | —- | C] () – C:\Users\Kun Jin\Desktop\GsNJNwuI-UM.gif
[2012/10/07 22:17:17 | 000,000,001 | —- | C] () – C:\Windows\SysWow64\SI.bin
[2012/06/18 09:01:19 | 000,000,419 | —- | C] () – C:\Windows\BRWMARK.INI
[2012/06/18 09:01:19 | 000,000,027 | —- | C] () – C:\Windows\BRPP2KA.INI
[2012/04/15 22:06:47 | 000,018,760 | —- | C] () – C:\Windows\SysWow64\QQVistaHelper.dll
[2012/01/06 23:36:54 | 000,000,243 | —- | C] () – C:\ProgramData\MusicStation.xml
[2011/12/22 19:19:02 | 000,045,270 | —- | C] () – C:\Users\Kun Jin\AppData\Roaming\room_v3.dat
[2011/08/10 09:57:07 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/08/10 09:53:22 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblup.dat
[2011/07/28 09:26:00 | 000,963,116 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2011/07/28 09:25:59 | 013,906,944 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll
[2011/07/28 09:25:59 | 000,218,304 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2011/07/28 09:25:59 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/07/28 09:25:59 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2011/07/28 09:25:59 | 000,028,732 | —- | C] () – C:\Windows\SysWow64\ativvsny.dat
[2011/07/28 09:25:59 | 000,026,936 | —- | C] () – C:\Windows\SysWow64\ativvsnl.dat
[2011/07/28 09:25:58 | 000,003,929 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/06/30 23:01:52 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\OVDecode.dll
[2011/06/29 09:44:43 | 000,066,856 | —- | C] () – C:\Windows\SysWow64\SynTPEnhPS.dll
[2011/02/15 08:47:22 | 000,780,986 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI

========== ZeroAccess Check ==========

[2009/07/14 12:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 13:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/09 12:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 09:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/21 11:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 09:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/12/15 13:44:09 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\AutoGG
[2012/12/19 14:52:27 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\DNAML
[2012/12/24 19:19:08 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\ELEX
[2012/12/24 19:19:08 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Garena
[2012/12/28 00:06:08 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\GarenaPlus
[2012/12/28 01:11:04 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\HaoZip
[2012/12/25 01:32:07 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\iolo
[2012/11/05 12:52:04 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Kingsoft
[2012/10/27 00:11:49 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\LolClient
[2012/10/21 18:36:42 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Maxthon3
[2011/12/23 22:01:54 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Sony
[2012/01/18 21:28:10 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Sports Interactive
[2012/10/24 08:29:44 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Tencent
[2012/10/21 09:41:46 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Wandoujia2
[2011/12/23 15:42:37 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Windows Live Writer
[2012/12/01 11:32:32 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\xim

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2012/12/21 23:45:51 | 000,000,940 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\?? Internet Explorer ???.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
[2012/12/21 23:45:51 | 000,000,940 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\?? Internet Explorer ???.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
[2012/12/19 16:03:33 | 000,000,000 | —D | C](C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\2345??) – C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\2345好压
[2012/04/15 22:34:42 | 000,001,167 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk
[2012/04/15 22:34:42 | 000,001,167 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk
[2012/04/15 22:09:22 | 000,002,045 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\????.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯视频.lnk
[2012/04/15 22:09:22 | 000,002,045 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\????.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯视频.lnk
[2012/04/15 22:07:12 | 000,002,239 | —- | M] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\??QQ.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯QQ.lnk
[2012/04/15 22:07:12 | 000,002,239 | —- | C] ()(C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\??QQ.lnk) – C:\Users\Kun Jin\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯QQ.lnk
(C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\????) – C:\Users\Kun Jin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯软件

========== Alternate Data Streams ==========

@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:98181191

< End of report >

oldman960

Post #34December 27, 2012, 7:27 PM UTC

Hi Edwinnnn,

Just a little tidying up to do and a couple of more scans.

Your java is out of date. Click start > Control Panel. Under programs click Uninstall a program and uninstall

Java™ 6 Update 26 (64-bit)
Java™ 6 Update 31
Java™ 7 Update 5

Next, download and install the latest version of java. You can get both the 32bit and 64bit versions from HERE. They are near the end of the list. Download jre-7u10-windows-i586.exe and jre-7u10-windows-x64.exe, save to your desktop. Double click to install them. Decline any additional installs that may be offered.

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
O2:64bit: - BHO: (no name) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - No CLSID value found.

:Files
C:\Users\Kun Jin\AppData\Local\Avg2013
[2012/11/05 12:52:04 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Kingsoft

:Commands
[purity]
[emptytemp]
[createrestorepoint]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

Next

Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next

As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.

Do not use this instance of your browser for anything besides doing this scan
When the scan is complete and the results saved, close that instance of your browser
Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
When the scan completes, click List of found threats
click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
Include the contents of this report in your next reply

Note - when ESET doesn't find any threats, no report will be created.
Push the back button.
Push Finish
Re-enable your Antivirus software.

Please post back with

OTL fix log
MBAM log
ESET log if there was one

Any problems?

Edwinnnn

Post #35December 28, 2012, 7:30 AM UTC

It's seem everything is back to normal now… thanks! . Here's the log All processes killed ========== OTL ========== 64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F}\ deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F}\ not found. ========== FILES ========== C:\Users\Kun Jin\AppData\Local\Avg2013\log folder moved successfully. C:\Users\Kun Jin\AppData\Local\Avg2013 folder moved successfully. Invalid Switch: 05 12:52:04 | 000,000,000 | —D | M] – C:\Users\Kun Jin\AppData\Roaming\Kingsoft ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Kun Jin ->Temp folder emptied: 150758058 bytes ->Temporary Internet Files folder emptied: 64664372 bytes ->Java cache emptied: 0 bytes ->Google Chrome cache emptied: 11614437 bytes ->Flash cache emptied: 1414 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 972 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 246750 bytes %systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 666 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 217.00 mb Restore point Set: OTL Restore Point OTL by OldTimer - Version 3.2.69.0 log created on 12282012_130940 Files\Folders moved on Reboot… C:\Users\Kun Jin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Users\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\P60NS0I7\index[3].htm moved successfully. C:\Users\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\P60NS0I7\jre7-downloads-1880261[1].htm moved successfully. C:\Users\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O9ER7VXJ\iframe[1].htm moved successfully. C:\Users\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully. C:\Users\Kun Jin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully. File\Folder C:\Windows\temp\_avast_\Webshlock.txt not found! PendingFileRenameOperations files… Registry entries deleted on Reboot… Malwarebytes Anti-Malware (Trial) 1.70.0.1100 www.malwarebytes.org Database version: v2012.12.28.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Kun Jin :: KUNJIN-VAIO [administrator] Protection: Enabled 28/12/2012 1:23:33 PM mbam-log-2012-12-28 (13-23-33).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 212555 Time elapsed: 3 minute(s), 3 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 2 HKCR\CLSID\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Quarantined and deleted successfully. HKCR\CLSID\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Detected: 4 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved|{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved|{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

Edwinnnn

Post #36December 28, 2012, 11:38 AM UTC

is this a problem?

MBAM keep blocking QVODTERMINAL.EXE or it's normal? 2012/12/28 13:22:47 +0800 KUNJIN-VAIO Kun Jin MESSAGE Starting protection 2012/12/28 13:22:47 +0800 KUNJIN-VAIO Kun Jin MESSAGE Protection started successfully 2012/12/28 13:22:47 +0800 KUNJIN-VAIO Kun Jin MESSAGE Starting IP protection 2012/12/28 13:22:48 +0800 KUNJIN-VAIO Kun Jin MESSAGE IP Protection started successfully 2012/12/28 13:22:55 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:22:55 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:22:55 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:03 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:03 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:09 +0800 KUNJIN-VAIO Kun Jin MESSAGE Starting database refresh 2012/12/28 13:23:09 +0800 KUNJIN-VAIO Kun Jin MESSAGE Stopping IP protection 2012/12/28 13:23:09 +0800 KUNJIN-VAIO Kun Jin MESSAGE IP Protection stopped successfully 2012/12/28 13:23:11 +0800 KUNJIN-VAIO Kun Jin MESSAGE Database refreshed successfully 2012/12/28 13:23:11 +0800 KUNJIN-VAIO Kun Jin MESSAGE Starting IP protection 2012/12/28 13:23:12 +0800 KUNJIN-VAIO Kun Jin MESSAGE IP Protection started successfully 2012/12/28 13:23:19 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:19 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:19 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:19 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:27 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:27 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:35 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:35 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:43 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:51 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:23:59 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:24:08 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:24:16 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:24:32 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:24:40 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:24:48 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 222.71.113.116 (Type: outgoing, Port: 20006, Process: qvodterminal.exe) 2012/12/28 13:34:55 +0800 KUNJIN-VAIO Kun Jin MESSAGE Executing scheduled update: Daily 2012/12/28 13:35:00 +0800 KUNJIN-VAIO Kun Jin MESSAGE Scheduled update executed successfully: database updated from version v2012.12.28.03 to version v2012.12.28.04 2012/12/28 13:35:00 +0800 KUNJIN-VAIO Kun Jin MESSAGE Starting database refresh 2012/12/28 13:35:00 +0800 KUNJIN-VAIO Kun Jin MESSAGE Stopping IP protection 2012/12/28 13:35:00 +0800 KUNJIN-VAIO Kun Jin MESSAGE IP Protection stopped successfully 2012/12/28 13:35:02 +0800 KUNJIN-VAIO Kun Jin MESSAGE Database refreshed successfully 2012/12/28 13:35:02 +0800 KUNJIN-VAIO Kun Jin MESSAGE Starting IP protection 2012/12/28 13:35:03 +0800 KUNJIN-VAIO Kun Jin MESSAGE IP Protection started successfully 2012/12/28 19:25:22 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61662, Process: qvodterminal.exe) 2012/12/28 19:25:22 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61663, Process: qvodterminal.exe) 2012/12/28 19:27:23 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61690, Process: qvodterminal.exe) 2012/12/28 19:27:23 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61691, Process: qvodterminal.exe) 2012/12/28 19:27:23 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61692, Process: qvodterminal.exe) 2012/12/28 19:29:25 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61741, Process: qvodterminal.exe) 2012/12/28 19:29:33 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61742, Process: qvodterminal.exe) 2012/12/28 19:29:33 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61743, Process: qvodterminal.exe) 2012/12/28 19:34:08 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61809, Process: qvodterminal.exe) 2012/12/28 19:34:16 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61814, Process: qvodterminal.exe) 2012/12/28 19:34:16 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61816, Process: qvodterminal.exe) 2012/12/28 19:34:16 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61817, Process: qvodterminal.exe) 2012/12/28 19:34:24 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61818, Process: qvodterminal.exe) 2012/12/28 19:34:24 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61820, Process: qvodterminal.exe) 2012/12/28 19:34:24 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61821, Process: qvodterminal.exe) 2012/12/28 19:34:24 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61824, Process: qvodterminal.exe) 2012/12/28 19:34:24 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61825, Process: qvodterminal.exe) 2012/12/28 19:34:24 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61826, Process: qvodterminal.exe) 2012/12/28 19:34:32 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61827, Process: qvodterminal.exe) 2012/12/28 19:34:32 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61828, Process: qvodterminal.exe) 2012/12/28 19:34:32 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61829, Process: qvodterminal.exe) 2012/12/28 19:34:32 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61830, Process: qvodterminal.exe) 2012/12/28 19:34:40 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61832, Process: qvodterminal.exe) 2012/12/28 19:34:40 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61833, Process: qvodterminal.exe) 2012/12/28 19:34:40 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61834, Process: qvodterminal.exe) 2012/12/28 19:34:40 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61835, Process: qvodterminal.exe) 2012/12/28 19:34:40 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61836, Process: qvodterminal.exe) 2012/12/28 19:34:49 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61837, Process: qvodterminal.exe) 2012/12/28 19:34:49 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61838, Process: qvodterminal.exe) 2012/12/28 19:34:49 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61839, Process: qvodterminal.exe) 2012/12/28 19:34:49 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61840, Process: qvodterminal.exe) 2012/12/28 19:34:57 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61841, Process: qvodterminal.exe) 2012/12/28 19:34:57 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61842, Process: qvodterminal.exe) 2012/12/28 19:34:57 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61843, Process: qvodterminal.exe) 2012/12/28 19:34:57 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61844, Process: qvodterminal.exe) 2012/12/28 19:34:57 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61845, Process: qvodterminal.exe) 2012/12/28 19:35:05 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61851, Process: qvodterminal.exe) 2012/12/28 19:35:05 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61853, Process: qvodterminal.exe) 2012/12/28 19:35:05 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61858, Process: qvodterminal.exe) 2012/12/28 19:35:05 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61863, Process: qvodterminal.exe) 2012/12/28 19:35:05 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61864, Process: qvodterminal.exe) 2012/12/28 19:35:13 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61867, Process: qvodterminal.exe) 2012/12/28 19:35:13 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61881, Process: qvodterminal.exe) 2012/12/28 19:35:13 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61882, Process: qvodterminal.exe) 2012/12/28 19:35:13 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61903, Process: qvodterminal.exe) 2012/12/28 19:35:21 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61904, Process: qvodterminal.exe) 2012/12/28 19:35:21 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61905, Process: qvodterminal.exe) 2012/12/28 19:35:21 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61906, Process: qvodterminal.exe) 2012/12/28 19:35:21 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61908, Process: qvodterminal.exe) 2012/12/28 19:35:21 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61909, Process: qvodterminal.exe) 2012/12/28 19:35:29 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61912, Process: qvodterminal.exe) 2012/12/28 19:35:29 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61914, Process: qvodterminal.exe) 2012/12/28 19:35:29 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61915, Process: qvodterminal.exe) 2012/12/28 19:35:29 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61916, Process: qvodterminal.exe) 2012/12/28 19:35:37 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61917, Process: qvodterminal.exe) 2012/12/28 19:35:37 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61918, Process: qvodterminal.exe) 2012/12/28 19:35:37 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61919, Process: qvodterminal.exe) 2012/12/28 19:35:37 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61920, Process: qvodterminal.exe) 2012/12/28 19:35:37 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61921, Process: qvodterminal.exe) 2012/12/28 19:35:37 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61924, Process: qvodterminal.exe) 2012/12/28 19:35:37 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61925, Process: qvodterminal.exe) 2012/12/28 19:35:37 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61926, Process: qvodterminal.exe) 2012/12/28 19:35:54 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61931, Process: qvodterminal.exe) 2012/12/28 19:35:54 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61932, Process: qvodterminal.exe) 2012/12/28 19:35:54 +0800 KUNJIN-VAIO Kun Jin IP-BLOCK 218.8.249.60 (Type: outgoing, Port: 61933, Process: qvodterminal.exe)

oldman960

Post #37December 28, 2012, 4:46 PM UTC

Hi What is the website that QVODTERMINAL.EXE is trying access? I take it the ESET scan came back clean?

Edwinnnn

Post #38December 28, 2012, 5:27 PM UTC last edited December 28, 2012, 5:30 PM UTC

yup ESCAN detected nothing.. I'm not sure what purpose is QVOD used for , but i think it's a video player.. my bro dl-ed it .. i think it's harmless as i scanned it with avast,detected nothing ..usually when i view youtube, it will pop up the message .

Edwinnnn

Post #39December 28, 2012, 5:59 PM UTC

ok i unistalled qvodplayer , as i found out qvodterminal eat your bandwith and connection speed . probably not a good thing.

oldman960

Post #40December 29, 2012, 12:27 AM UTC

Hi Edwinnnn,

I do believe you are good to go. One little fix to do.

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:Files
C:\Users\Kun Jin\AppData\Roaming\Kingsoft

Then click the Run Fix button at the top

Let the program run unhindered

No need to post the log.

We'll clean up the tools now.

From your desktop, please delete, if present

any notepads/logs that we created
aswMBR.exe
mbr.zip
mbr.dat
help.zip
mirror.zip

Next

Click the Start button. Copy and paste the following line into the search box and click OK

Combofix /uninstall

Next

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep it updated and use it regularly.

Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Those you have now provided you are using a firewall. If you are not using a third party firewall Windows 7 has a built in firewall which is pretty good when set up. You can find some very good information HERE .

You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.

-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

- Make sure you have reset Windows Updates to your chosen option. Click your start button > Control Panel > System > Windows updates (lower left) > change settings

- Keep your antivirus program updated, as well as any other security programs you have.

-More tips and programs can be found HERE

Please post back if you have any problems.

Take care

Edwinnnn

Post #41December 29, 2012, 7:30 AM UTC

Thanks alot ! i appreciate the help you given me ! .

oldman960

Post #42December 29, 2012, 7:49 AM UTC

Hi Edwinnnn, You are more than welcome. Take care, keep safe.

oldman960

Post #43January 1, 2013, 8:08 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Window getting hijacked by spyware/malware, [Solved]

✨ Ask AI

Ask AI