Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

windows defender cannot be started, unknown software keep popping out for update


  • Please log in to reply
11 replies to this topic

#1 bsmile

bsmile

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:31 AM

Posted 26 December 2014 - 06:57 PM

My windows operation system is win 8.1. DDS suggested by bleeping computer does not work, giving a message of "DDS is not meant to run in 'Compatibility Mode'". The main issue of the computer is

 

(1) windows defender cannot be started.

(2) some unknown software update message keeps popping out.

 

Thanks for further help!



BC AdBot (Login to Remove)

 


#2 bsmile

bsmile
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:31 AM

Posted 26 December 2014 - 08:50 PM

Global Moderator recommended me to use RSIT 64-bit version to do a scan, the results are generated in two files, info and log, please let me know which one to attach and which one to append. Thanks,

 

(c:/rsit)



#3 nasdaq

nasdaq

  • Malware Response Team
  • 40,754 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:31 AM

Posted 29 December 2014 - 10:09 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

You can append both.

I will review them.

#4 nasdaq

nasdaq

  • Malware Response Team
  • 40,754 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:31 AM

Posted 04 January 2015 - 09:13 AM

Are you still with me.

#5 bsmile

bsmile
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:31 AM

Posted 04 January 2015 - 10:31 AM

Thanks, here is the attachments. Sorry for the delay, I was not around in the last few days.

Logfile of random's system information tool 1.10 (written by random/random)
Run by Lily's home_2 at 2015-01-04 10:20:55
Microsoft Windows 8.1
System drive C: has 75 GB (49%) free of 153 GB
Total RAM: 3968 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:21:01, on 2015/01/04
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17416)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ThinkSky\iTools 3\iToolsDaemon.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
D:\PPS.tv\PPStream\PPSKernel.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\WINDOWS\SysWOW64\rundll32.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\trend micro\Lily's home_2.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: WandoujiaBHO - {000DA090-57AA-424B-A8F0-621B7C08B8F4} - (no file)
O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
O2 - BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Xunlei BHO Platform - {DE05CF4A-7B0A-4775-B5E5-396244938679} - C:\Program Files (x86)\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
O2 - BHO: iToolsBHO - {E1499FE7-129D-4B6E-B681-DDF21E14172C} - C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\iToolsBHO.dll
O2 - BHO: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll
O2 - BHO: PPStream Video Acc Helper - {FB4F6285-4C32-49F2-950F-A5998F9CEC6C} - D:\PPS.tv\PPStream\plugins\IEHelper.dll
O3 - Toolbar: Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" 60
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\PPSKernel.exe
O4 - HKUS\S-1-5-19\..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\PPSKernel.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\PPSKernel.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [360sd] "C:\Program Files (x86)\360\360sd\360sdrun.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [360sd] "C:\Program Files (x86)\360\360sd\360sdrun.exe" (User 'Default user')
O8 - Extra context menu item: 导出到 Microsoft Excel(&X) - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE_32.exe
O9 - Extra 'Tools' menuitem: Classic IE Settings - {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE_32.exe
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF8EB408-302D-43BC-932D-8F3FD29D79A3}: NameServer = 209.18.47.61,209.18.47.62
O18 - Protocol: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - (no file)
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour 服务 (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: Dell Digital Delivery Service (DellDigitalDelivery) - Dell Products, LP. - c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
O23 - Service: Microsoft Device Health Machine Service (DeviceHealth) - Unknown owner - C:\Program Files (x86)\Microsoft Device Health\DhMachineSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Google 更新服务 (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google 更新服务 (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel® HD Graphics Control Panel Service (igfxCUIService1.0.0.0) - Unknown owner - C:\WINDOWS\system32\igfxCUIService.exe (file missing)
O23 - Service: Intel® Capability Licensing Service Interface - Intel® Corporation - c:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: iPod 服务 (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: NetBalancerService - SeriousBit - C:\Program Files\NetBalancer_2\SeriousBit.NetBalancer.Service.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: noteupdateservice service (noteupdateservice) - Beijing Hongda wanfang technology Co.,Ltd. - C:\Program Files (x86)\anote\anote.exe
O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Service KMSELDI - Unknown owner - C:\Program Files\KMSpico\Service_KMS.exe
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: ZAtheros Wlan Agent - Atheros - C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe

--
End of file - 11823 bytes

======Listing Processes======





wininit.exe

C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\igfxCUIService.exe
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Program Files (x86)\anote\anote.exe" -svc
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe"
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service
"C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe" /service
"C:\Program Files (x86)\Microsoft Device Health\DhMachineSvc.exe"
dashost.exe {573ff279-4fbb-4215-b8ca18d536f0a9b7}
"c:\Program Files\Intel\iCLS Client\HeciServer.exe"
"C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe"
"C:\Program Files\KMSpico\Service_KMS.exe"
C:\WINDOWS\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe"
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
"C:\Program Files\iPod\bin\iPodService.exe"
C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe"
"C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-07ad360c-a7b2-4e9b-943c-827a7c4c2ed0 -SystemEventPortName:HostProcess-70edce12-70ba-4ba4-9fcb-54eda6f642ee -IoCancelEventPortName:HostProcess-5c4abe04-1d83-4e81-880f-ecb21f362cb6 -NonStateChangingEventPortName:HostProcess-a0bf06d1-624b-4d62-a32e-eed4737810e6 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:6d53bbda-9552-4e8f-b40a-bddf6c4b6eae -DeviceGroupId:WudfDefaultDevicePool

C:\WINDOWS\System32\WinLogon.exe -SpecialSession
-hiberboot
taskeng.exe {8432A7E8-1FAD-43DA-B04F-C26FB28F0E2F}
"C:\Program Files (x86)\ThinkSky\iTools 3\iToolsDaemon.exe"
taskhostex.exe
C:\WINDOWS\Explorer.EXE
C:\Windows\System32\InputMethod\CHS\ChsIME.exe -Embedding
igfxEM.exe
igfxHK.exe
igfxTray.exe
ClassicStartMenu.exe -startup
"C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"D:\PPS.tv\PPStream\PPSKernel.exe"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
"C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"C:\Windows\System32\WWAHost.exe" -ServerName:Windows.Store
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe"
rundll32.exe "C:\Users\Lily's home_2.homesweethome\AppData\Roaming\CloudMedia\JadeHe.dat" startup
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"

"F:\software\security software\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\WINDOWS\tasks\iToolsDaemon.job - C:\Program Files (x86)\ThinkSky\iTools 3\iToolsDaemon.exe
C:\WINDOWS\tasks\微软设备健康助手开机检测.job - C:\Program Files (x86)\Microsoft Device Health\DhUpdate.exe /EnableDH
C:\WINDOWS\tasks\微软设备健康助手自动更新.job - C:\Program Files (x86)\Microsoft Device Health\DhUpdate.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Lily's home_2.homesweethome\AppData\Roaming\Mozilla\Firefox\Profiles\rmji1ni8.default

prefs.js - "browser.startup.homepage" - "www.5566.org"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 12.0.0.44 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes 检测器插件
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@baidu.com/BaidusdDetectNPPlugin]
"Description"=Baidusd detect NPAPI plugin
"Path"=C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\explugin\npBaiduSDDetectPlug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@baidu.com/npxbdcntb]
"Description"=Baiducnff Plugin
"Path"=C:\Program Files (x86)\Baidu\BaiduPinyin\2.7.2.131\npxbdcntb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@baidu.com/npxbdsetup]
"Description"=BaiduSetUp Plugin
"Path"=C:\WINDOWS\Downloaded Program Files\24412968\npxbdsetup.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@iqiyi.com/npclient]
"Description"=iQiyi Browser Plugin
"Path"=D:\PPS.tv\PPStream\npclient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@iqiyi.com/npWebPlayer]
"Description"=pps-webplayer-plugin
"Path"=D:\IQIYI Video\LStyle\npWebPlayer.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@itools.hk/npiTools, version=1.0.0]
"Description"=
"Path"=C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\npiTools.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@qq.com/QQPhotoDrawEx]
"Description"=QQPhotoDrawEx
"Path"=C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@qq.com/QzoneMusic]
"Description"=npQzoneMusic
"Path"=C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@qq.com/TXSSO]
"Description"=QQ QuickLogin Helper
"Path"=C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.2.45\Bin\npSSOAxCtrlForPTLogin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nppl3260;version=16.0.3.51]
"Description"=RealPlayer™ LiveConnect-Enabled Plug-In
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.3]
"Description"=RealNetworks™ RealDownloader Chrome Background Extension Plug-In
"Path"=C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.3]
"Description"=RealNetworks™ RealDownloader HTML5VideoShim Plug-In
"Path"=C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.3]
"Description"=RealNetworks™ RealDownloader Peppe rFlash Video Shim Plug-In
"Path"=C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpplugin;version=16.0.3.51]
"Description"=RealPlayer Download Plugin
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@realnetworks.com/npdlplugin;version=1]
"Description"=RealDownloader Plugin
"Path"=C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@rising.com.cn/nprising]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@xunlei.com/npxluser]
"Description"=Thunder user plugin
"Path"=C:\Program Files (x86)\Common Files\Thunder Network\UserAgent\npxluser2.0.2.3.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 12.0.0.44 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@iqiyi.com/npWebPlayer]
"Description"=pps-webplayer-plugin
"Path"=D:\IQIYI Video\LStyle\npWebPlayer.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@itools.hk/npiTools, version=1.0.0]
"Description"=
"Path"=C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\npiTools.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pps.tv/npWebPlayer]
"Description"=pps-webplayer-plugin
"Path"=C:\PPStream\npWebPlayer.dll


C:\Program Files (x86)\Mozilla Firefox\plugins\
NPOFF12.DLL
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
QuickTimePlugin.class

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{449D0D6E-2412-4E61-B68F-1CB625CD9E52}]
ExplorerBHO Class - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20 803520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14 2117216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E1499FE7-129D-4B6E-B681-DDF21E14172C}]
BHOImpl Class - C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\iToolsBHO64.dll [2014-12-29 137592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA801577-E6AD-4BD5-8F71-4BE0154331A4}]
ClassicIEBHO Class - C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2014-04-20 483520]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000DA090-57AA-424B-A8F0-621B7C08B8F4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealNetworks Download and Record Plugin for Internet Explorer - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14 542376]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{449D0D6E-2412-4E61-B68F-1CB625CD9E52}]
ExplorerBHO Class - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20 683200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14 1709152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE05CF4A-7B0A-4775-B5E5-396244938679}]
迅雷下载支持组件 - C:\Program Files (x86)\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll [2014-08-01 1707976]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E1499FE7-129D-4B6E-B681-DDF21E14172C}]
BHOImpl Class - C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\iToolsBHO.dll [2014-12-29 121208]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA801577-E6AD-4BD5-8F71-4BE0154331A4}]
ClassicIEBHO Class - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2014-04-20 440512]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}]
PPStream Video Acc Helper - D:\PPS.tv\PPStream\plugins\IEHelper.dll [2013-11-28 254840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{553891B7-A0D5-4526-BE18-D3CE461D6310} - Classic Explorer Bar - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20 803520]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{553891B7-A0D5-4526-BE18-D3CE461D6310} - Classic Explorer Bar - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20 683200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2012-06-12 6548112]
"Classic Start Menu"=C:\Program Files\Classic Shell\ClassicStartMenu.exe [2014-04-20 161984]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon"=C:\WINDOWS\system32\ctfmon.exe [2013-08-22 10240]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-12-11 30877280]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2014-12-12 7394584]
"PPS Accelerator"=D:\PPS.tv\PPStream\PPSKernel.exe [2014-01-09 5200248]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"=C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [2012-07-19 133440]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe [2012-09-12 56128]
"SDTray"=C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [2013-07-25 5624784]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2014-10-11 60712]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2014-10-15 157480]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2014-10-02 421888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
igfxdev.dll []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcpltsvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=221

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Doyo\DYService.exe"="C:\Program Files\Doyo\DYService.exe:*:Enabled:逗游下载服务"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"
"C:\Program Files (x86)\Meitu\KanKan\KanKan.exe"="C:\Program Files (x86)\Meitu\KanKan\KanKan.exe:*:Enabled:KanKan"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=lvcod64.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"MSVideo"=vfwwdm32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-12-26 20:36:56 ----D---- C:\Program Files\trend micro
2014-12-26 20:36:55 ----D---- C:\rsit
2014-12-25 12:30:25 ----A---- C:\WINDOWS\SYSWOW64\log.txt
2014-12-25 11:56:03 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\ClassicShell
2014-12-25 11:55:48 ----D---- C:\ProgramData\ClassicShell
2014-12-25 11:54:49 ----D---- C:\Program Files\Classic Shell
2014-12-21 17:54:53 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\PPStream
2014-12-19 18:58:59 ----D---- C:\Program Files\CCleaner
2014-12-17 18:07:37 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\ppslog
2014-12-17 17:58:04 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\IQIYI Video
2014-12-11 09:30:35 ----A---- C:\WINDOWS\system32\poqexec.exe
2014-12-11 09:30:34 ----A---- C:\WINDOWS\SYSWOW64\poqexec.exe
2014-12-10 17:07:29 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2014-12-10 17:03:18 ----D---- C:\WINDOWS\system32\appraiser
2014-12-10 14:22:29 ----A---- C:\WINDOWS\SYSWOW64\DeviceSetupStatusProvider.dll
2014-12-10 14:22:29 ----A---- C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 14:22:17 ----A---- C:\WINDOWS\SYSWOW64\crypt32.dll
2014-12-10 14:22:17 ----A---- C:\WINDOWS\system32\crypt32.dll
2014-12-10 14:07:49 ----A---- C:\WINDOWS\system32\appraiser.dll
2014-12-10 14:07:49 ----A---- C:\WINDOWS\system32\aepic.dll
2014-12-10 14:07:48 ----A---- C:\WINDOWS\system32\invagent.dll
2014-12-10 14:07:48 ----A---- C:\WINDOWS\system32\generaltel.dll
2014-12-10 14:07:48 ----A---- C:\WINDOWS\system32\devinv.dll
2014-12-10 14:07:48 ----A---- C:\WINDOWS\system32\aeinv.dll
2014-12-10 14:07:47 ----A---- C:\WINDOWS\SYSWOW64\WindowsCodecs.dll
2014-12-10 14:07:47 ----A---- C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 14:07:47 ----A---- C:\WINDOWS\system32\aepdu.dll
2014-12-10 14:07:44 ----A---- C:\WINDOWS\SYSWOW64\MrmCoreR.dll
2014-12-10 14:07:44 ----A---- C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 14:07:43 ----AC---- C:\WINDOWS\system32\drivers\sdbus.sys
2014-12-10 14:07:43 ----AC---- C:\WINDOWS\system32\drivers\intelpep.sys
2014-12-10 14:07:43 ----AC---- C:\WINDOWS\system32\drivers\dumpsd.sys
2014-12-10 14:07:43 ----A---- C:\WINDOWS\system32\drivers\pdc.sys
2014-12-10 14:07:36 ----A---- C:\WINDOWS\system32\mshtml.dll
2014-12-10 14:07:34 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2014-12-10 14:07:30 ----A---- C:\WINDOWS\system32\ieframe.dll
2014-12-10 14:07:28 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2014-12-10 14:07:27 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2014-12-10 14:07:27 ----A---- C:\WINDOWS\system32\wininet.dll
2014-12-10 14:07:27 ----A---- C:\WINDOWS\system32\jscript9.dll
2014-12-10 14:07:26 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2014-12-10 14:07:26 ----A---- C:\WINDOWS\system32\urlmon.dll
2014-12-10 14:07:26 ----A---- C:\WINDOWS\system32\iertutil.dll
2014-12-10 14:07:25 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2014-12-10 14:07:25 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2014-12-10 14:07:24 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2014-12-10 14:07:24 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 14:07:23 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2014-12-10 14:07:23 ----A---- C:\WINDOWS\SYSWOW64\msfeeds.dll
2014-12-10 14:07:23 ----A---- C:\WINDOWS\system32\msfeeds.dll
2014-12-10 14:07:23 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 14:07:22 ----A---- C:\WINDOWS\SYSWOW64\iedkcs32.dll
2014-12-10 14:07:22 ----A---- C:\WINDOWS\system32\vbscript.dll
2014-12-10 14:07:22 ----A---- C:\WINDOWS\system32\iepeers.dll
2014-12-10 14:07:22 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 14:07:21 ----A---- C:\WINDOWS\SYSWOW64\webcheck.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\SYSWOW64\mshtmled.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\SYSWOW64\MshtmlDac.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\SYSWOW64\inetcomm.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\SYSWOW64\iepeers.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\SYSWOW64\dxtrans.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\system32\webcheck.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\system32\mshtmled.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\system32\jscript.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\system32\inetcomm.dll
2014-12-10 14:07:21 ----A---- C:\WINDOWS\system32\dxtrans.dll
2014-12-09 12:00:26 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\RealNetworks
2014-12-09 09:22:10 ----D---- C:\Program Files (x86)\Mozilla Firefox
2014-12-05 09:40:14 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\Zoo
2014-12-05 09:40:02 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\CloudMedia
2014-12-05 09:35:01 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\DataRepair
2014-12-05 09:04:02 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\anote

======List of files/folders modified in the last 1 month======

2015-01-04 10:20:46 ----D---- C:\WINDOWS\Prefetch
2015-01-04 10:17:10 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\Skype
2015-01-04 10:12:30 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\TaobaoProtect
2015-01-04 10:02:00 ----D---- C:\WINDOWS\system32\sru
2015-01-04 09:44:24 ----D---- C:\WINDOWS\Microsoft.NET
2015-01-04 09:44:04 ----D---- C:\WINDOWS\Temp
2015-01-04 07:42:12 ----D---- C:\WINDOWS\system32\Tasks
2015-01-04 07:28:07 ----RD---- C:\WINDOWS\System32
2015-01-04 07:28:07 ----D---- C:\WINDOWS\Inf
2015-01-04 07:28:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-04 00:15:49 ----D---- C:\Program Files\KMSpico
2014-12-30 08:15:08 ----D---- C:\WINDOWS\AppReadiness
2014-12-27 19:49:18 ----D---- C:\WINDOWS\system32\NDF
2014-12-27 19:47:48 ----D---- C:\Program Files (x86)\Dell Backup and Recovery
2014-12-26 20:36:56 ----D---- C:\Program Files
2014-12-26 09:02:18 ----D---- C:\WINDOWS\system32\config
2014-12-25 13:43:53 ----D---- C:\WINDOWS\Registration
2014-12-25 13:35:51 ----D---- C:\WINDOWS\system32\drivers\etc
2014-12-25 13:13:46 ----RD---- C:\WINDOWS\ImmersiveControlPanel
2014-12-25 13:13:46 ----D---- C:\WINDOWS\system32\drivers
2014-12-25 12:30:25 ----D---- C:\WINDOWS\SysWOW64
2014-12-25 12:27:40 ----D---- C:\WINDOWS\debug
2014-12-25 12:27:30 ----D---- C:\Windows
2014-12-25 12:27:22 ----D---- C:\WINDOWS\Logs
2014-12-25 12:07:53 ----RD---- C:\Program Files (x86)
2014-12-25 11:55:48 ----HD---- C:\ProgramData
2014-12-25 11:54:55 ----SHD---- C:\WINDOWS\Installer
2014-12-25 11:54:54 ----SHD---- C:\Config.Msi
2014-12-25 11:54:39 ----SHD---- C:\System Volume Information
2014-12-21 18:00:08 ----D---- C:\ProgramData\LocalStorage
2014-12-20 10:40:57 ----D---- C:\ProgramData\Skype
2014-12-20 10:40:56 ----RD---- C:\Program Files (x86)\Skype
2014-12-19 20:07:58 ----D---- C:\WINDOWS\SoftwareDistribution
2014-12-19 19:42:26 ----D---- C:\WINDOWS\WinSxS
2014-12-19 19:40:14 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\Wise Disk Cleaner
2014-12-19 19:17:05 ----D---- C:\WINDOWS\system32\catroot2
2014-12-19 18:52:15 ----D---- C:\WINDOWS\system32\migwiz
2014-12-19 18:44:40 ----D---- C:\Program Files (x86)\YouKu
2014-12-19 18:24:57 ----D---- C:\WINDOWS\PLA
2014-12-19 18:01:16 ----D---- C:\Program Files (x86)\Rising
2014-12-19 18:00:31 ----RD---- C:\RavBin
2014-12-19 17:44:01 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-12-19 17:41:47 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-18 10:41:42 ----D---- C:\WINDOWS\CbsTemp
2014-12-18 00:17:16 ----HD---- C:\Program Files\WindowsApps
2014-12-12 10:47:34 ----D---- C:\WINDOWS\system32\DriverStore
2014-12-10 20:30:42 ----D---- C:\WINDOWS\rescache
2014-12-10 18:35:50 ----D---- C:\WINDOWS\system32\catroot
2014-12-10 17:03:19 ----D---- C:\WINDOWS\SYSWOW64\zh-CN
2014-12-10 17:03:19 ----D---- C:\WINDOWS\SYSWOW64\en-US
2014-12-10 17:03:19 ----D---- C:\WINDOWS\system32\zh-CN
2014-12-10 17:03:19 ----D---- C:\WINDOWS\system32\sr-Latn-RS
2014-12-10 17:03:19 ----D---- C:\WINDOWS\system32\sr-Latn-CS
2014-12-10 17:03:19 ----D---- C:\WINDOWS\system32\en-US
2014-12-10 17:03:18 ----SD---- C:\WINDOWS\system32\CompatTel
2014-12-10 17:03:18 ----SD---- C:\ProgramData\Microsoft
2014-12-10 17:03:18 ----D---- C:\WINDOWS\AppCompat
2014-12-10 17:03:15 ----D---- C:\WINDOWS\PolicyDefinitions
2014-12-10 17:03:15 ----D---- C:\Program Files\Internet Explorer
2014-12-10 17:03:15 ----D---- C:\Program Files (x86)\Internet Explorer
2014-12-10 15:16:25 ----D---- C:\ProgramData\Microsoft Help
2014-12-10 15:15:53 ----D---- C:\WINDOWS\system32\MRT
2014-12-10 15:11:46 ----A---- C:\WINDOWS\system32\MRT.exe
2014-12-09 19:16:10 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-09 17:14:34 ----D---- C:\ProgramData\Rising
2014-12-09 16:42:03 ----D---- C:\WINDOWS\Tasks
2014-12-09 16:42:03 ----D---- C:\Program Files (x86)\Wandoujia
2014-12-09 16:26:40 ----D---- C:\Users\Lily's home_2.homesweethome\AppData\Roaming\Wandoujia2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStorA;iaStorA; C:\WINDOWS\System32\drivers\iaStorA.sys [2012-10-27 651832]
R1 CLVirtualDrive;CLVirtualDrive; C:\WINDOWS\system32\DRIVERS\CLVirtualDrive.sys [2012-06-25 92536]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\WINDOWS\system32\DRIVERS\vwififlt.sys [2014-04-30 71680]
R3 athr;@athw8x.inf,%ATHR.Service.DispName%;Qualcomm Atheros Extensible Wireless LAN device driver; C:\WINDOWS\system32\DRIVERS\athw8x.sys [2013-06-18 3680256]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]
R3 igfx;igfx; C:\WINDOWS\system32\DRIVERS\igdkmd64.sys [2014-05-20 3791872]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RTKVHD64.sys [2012-06-19 4065296]
R3 IntcDAud;@oem10.inf,%IntcDAud.SvcDesc%;Intel® Display Audio; C:\WINDOWS\system32\DRIVERS\IntcDAud.sys [2012-06-19 342528]
R3 iwdbus;@oem109.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\WINDOWS\System32\drivers\iwdbus.sys [2014-05-06 27032]
R3 LVRS64;@oem113.inf,%lvrs.SrvDesc%;Logitech RightSound Filter Driver; C:\WINDOWS\system32\DRIVERS\lvrs64.sys [2012-10-26 351520]
R3 LVUVC64;@oem112.inf,%PID_0824_DD%(UVC);Logitech Webcam C160(UVC); C:\WINDOWS\system32\DRIVERS\lvuvc64.sys [2012-10-26 4758176]
R3 MEIx64;@oem57.inf,%HECI_SvcDesc%;Intel® Management Engine Interface ; C:\WINDOWS\System32\drivers\HECIx64.sys [2012-07-02 62784]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\WINDOWS\system32\DRIVERS\Rt630x64.sys [2013-06-18 591360]
R3 usbaudio;@wdma_usb.inf,%USBAudio.SvcDesc%;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2013-12-13 121088]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\WINDOWS\system32\DRIVERS\vwifimp.sys [2014-04-30 38912]
S3 intaud_WaveExtensible;@oem108.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\WINDOWS\system32\drivers\intelaud.sys [2014-05-06 38296]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [2014-12-25 129752]
S3 RSUSBSTOR;@oem12.inf,%RSUSBSTOR.SvcDesc%;RtsUStor.Sys Realtek USB Card Reader; C:\WINDOWS\System32\Drivers\RtsUStor.sys [2012-06-13 252048]
S3 RTL8192su;@net8192su64.inf,%RTL8192su.DeviceDesc.DispName%;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter; C:\WINDOWS\system32\DRIVERS\RTL8192su.sys [2013-06-18 694856]
S3 USBAAPL64;@oem117.inf,%USBAAPL64.SvcDesc%;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl64.sys [2014-08-15 54784]
S3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2013-08-22 212224]
S3 WinUsb;@wpdmtp.inf,%WinUsb.SvcDesc%;WinUsb; C:\WINDOWS\system32\DRIVERS\WinUsb.sys [2013-08-22 78848]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AERTFilters;Andrea RT Filters Service; C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-17 98208]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2014-10-07 60744]
R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R2 DeviceHealth;Microsoft Device Health Machine Service; C:\Program Files (x86)\Microsoft Device Health\DhMachineSvc.exe [2014-11-21 97432]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-09-01 14904]
R2 igfxCUIService1.0.0.0;Intel® HD Graphics Control Panel Service; C:\WINDOWS\system32\igfxCUIService.exe [2014-05-20 314696]
R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-06-19 634632]
R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [2012-07-19 166720]
R2 LMS;Intel® Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe [2012-07-19 277824]
R2 noteupdateservice;noteupdateservice service; C:\Program Files (x86)\anote\anote.exe [2014-09-04 1285520]
R2 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2013-10-15 3921880]
R2 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2013-09-20 1042272]
R2 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2013-09-13 171416]
R2 Service KMSELDI;Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [2013-03-28 454144]
R2 SftService;SoftThinks Agent Service; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [2013-10-09 1915408]
R2 UNS;Intel® Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-07-19 365376]
R3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2013-08-02 43696]
R3 iPod Service;iPod 服务; C:\Program Files\iPod\bin\iPodService.exe [2014-10-15 643880]
S2 DellDigitalDelivery;Dell Digital Delivery Service; c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [2013-06-25 196104]
S2 NetBalancerService;NetBalancerService; C:\Program Files\NetBalancer_2\SeriousBit.NetBalancer.Service.exe [2013-03-25 10752]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2014-12-11 315496]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-14 257928]
S3 Bonjour Service;Bonjour 服务; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-31 462184]
S3 cphs;Intel® Content Protection HECI Service; C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe [2014-05-20 278344]
S3 gupdate;Google 更新服务 (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-08 116648]
S3 gupdatem;Google 更新服务 (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-08 116648]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-12-09 114800]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-08-14 39056]
S4 BDKVRTP;BDKVRTP Service; C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\BaiduSdSvc.exe -r []
S4 BDMRTP;BDMRTP Service; C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\BaiduAnSvc.exe -r []
S4 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [2012-04-24 254512]

-----------------EOF-----------------

Attached Files

  • Attached File  info.txt   39.1KB   1 downloads
  • Attached File  log.txt   45.55KB   1 downloads

Edited by nasdaq, 04 January 2015 - 10:49 AM.


#6 nasdaq

nasdaq

  • Malware Response Team
  • 40,754 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:31 AM

Posted 04 January 2015 - 10:52 AM

Please run this tool it's compatible with Windows 8.

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

Wait for further instructions.

#7 bsmile

bsmile
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:31 AM

Posted 05 January 2015 - 10:02 PM

Hiere is running results for Farbar output in log

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2015
Ran by  (administrator) on  on 05-01-2015 21:45:19
Running from F:\software\security software
Loaded Profile:  (Available profiles: )
Platform: Windows 8.1 (X64) OS Language: 英语(美国)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Beijing  Hongda  wanfang  technology Co.,Ltd.) C:\Program Files (x86)\anote\anote.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
() C:\Program Files (x86)\Microsoft Device Health\DhMachineSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
() C:\Program Files\KMSpico\Service_KMS.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
() C:\Program Files (x86)\ThinkSky\iTools 3\iToolsDaemon.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(PPStream Inc.) D:\PPS.tv\PPStream\PPSKernel.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(杭州核新软件技术有限公司(Hexin)) D:\Level2\hexin.exe
(杭州核新软件技术有限公司) D:\Level2\zdsj.exe
(杭州核新软件技术有限公司) D:\Level2\glt.exe
(杭州核新软件技术有限公司(Hexin)) D:\Level2\UserGuide.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-19\...\Run: [PPS Accelerator] => D:\PPS.tv\PPStream\PPSKernel.exe [5200248 2014-01-09] (PPStream Inc.)
HKU\S-1-5-20\...\Run: [PPS Accelerator] => D:\PPS.tv\PPStream\PPSKernel.exe [5200248 2014-01-09] (PPStream Inc.)
HKU\S-1-5-21-2085915559-1108105436-2500099883-1007\...\Run: [ctfmon] => C:\WINDOWS\system32\ctfmon.exe [10240 2013-08-22] (Microsoft Corporation)
HKU\S-1-5-21-2085915559-1108105436-2500099883-1007\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-2085915559-1108105436-2500099883-1007\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-2085915559-1108105436-2500099883-1007\...\Run: [PPS Accelerator] => D:\PPS.tv\PPStream\PPSKernel.exe [5200248 2014-01-09] (PPStream Inc.)
HKU\S-1-5-21-2085915559-1108105436-2500099883-1007\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-18\...\Run: [360sd] => "C:\Program Files (x86)\360\360sd\360sdrun.exe"
HKU\S-1-5-18\...\Run: [PPS Accelerator] => D:\PPS.tv\PPStream\PPSKernel.exe [5200248 2014-01-09] (PPStream Inc.)
ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [FunOverlay] -> {A5662DF9-0C2E-4A56-9FE1-BACFF6966D88} => C:\Users\Public\Fundata\Lucifer.dll (Funshion)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hao.360.cn/?1004
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://hao.360.cn/?1004
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hao123.com/?tn=62002018_4_hao_pg
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hao123.com/?tn=62002018_4_hao_pg
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hao123.com/?tn=62002018_4_hao_pg
HKU\S-1-5-21-2085915559-1108105436-2500099883-1007\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dell13.msn.com/?pc=DCJB
SearchScopes: HKU\S-1-5-21-2085915559-1108105436-2500099883-1007 -> {B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} URL = http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&abar=2&tn=49029047_oem_dg&ch=33
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: BHOImpl Class -> {E1499FE7-129D-4B6E-B681-DDF21E14172C} -> C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\iToolsBHO64.dll (iTools.hk)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft)
BHO-x32: No Name -> {000DA090-57AA-424B-A8F0-621B7C08B8F4} ->  No File
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: 迅雷下载支持组件 -> {DE05CF4A-7B0A-4775-B5E5-396244938679} -> C:\Program Files (x86)\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll (深圳市迅雷网络技术有限公司)
BHO-x32: BHOImpl Class -> {E1499FE7-129D-4B6E-B681-DDF21E14172C} -> C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\iToolsBHO.dll (iTools.hk)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft)
BHO-x32: PPStream Video Acc Helper -> {FB4F6285-4C32-49F2-950F-A5998F9CEC6C} -> D:\PPS.tv\PPStream\plugins\IEHelper.dll (PPStream Inc.)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Handler: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File
Handler: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{EF8EB408-302D-43BC-932D-8F3FD29D79A3}: [NameServer] 209.18.47.61,209.18.47.62

FireFox:
========
FF ProfilePath: C:\Users\home_2.hwh\AppData\Roaming\Mozilla\Firefox\Profiles\rmji1ni8.default
FF DefaultSearchEngine: Google
FF Homepage: www.5566.org
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()
FF Plugin: @iqiyi.com/npWebPlayer -> D:\IQIYI Video\LStyle\npWebPlayer.dll No File
FF Plugin: @itools.hk/npiTools, version=1.0.0 -> C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\npiTools.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @pps.tv/npWebPlayer -> C:\PPStream\npWebPlayer.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @baidu.com/BaidusdDetectNPPlugin -> C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\explugin\npBaiduSDDetectPlug.dll No File
FF Plugin-x32: @baidu.com/npxbdcntb -> C:\Program Files (x86)\Baidu\BaiduPinyin\2.7.2.131\npxbdcntb.dll No File
FF Plugin-x32: @baidu.com/npxbdsetup -> C:\WINDOWS\Downloaded Program Files\24412968\npxbdsetup.dll No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @iqiyi.com/npclient -> D:\PPS.tv\PPStream\npclient.dll ()
FF Plugin-x32: @iqiyi.com/npWebPlayer -> D:\IQIYI Video\LStyle\npWebPlayer.dll No File
FF Plugin-x32: @itools.hk/npiTools, version=1.0.0 -> C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\npiTools.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @qq.com/TXSSO -> C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.2.45\Bin\npSSOAxCtrlForPTLogin.dll (Tencent)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @xunlei.com/npxluser -> C:\Program Files (x86)\Common Files\Thunder Network\UserAgent\npxluser2.0.2.3.dll No File
FF Plugin HKU\S-1-5-21-2085915559-1108105436-2500099883-1007: @iqiyi.com/npWebPlayer -> D:\IQIYI Video\LStyle\npWebPlayer.dll No File
FF Plugin HKU\S-1-5-21-2085915559-1108105436-2500099883-1007: @xunlei.com/npxluser -> C:\Program Files (x86)\Common Files\Thunder Network\UserAgent\npxluser2.0.2.3.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcn.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\baidu.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\baiduzhidao.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\creativecommons.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eachnet.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\paipai.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-zh-CN.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-09]

Chrome:
=======
CHR Profile: C:\Users\home_2.hwh\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (PPS风火轮加速器) - C:\Users\home_2.hwh\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkbilapedbkaolnbkikngodldjgfnkdc [2014-12-21]
CHR Extension: (RealDownloader) - C:\Users\home_2.hwh\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-11-25]
CHR Extension: (Google 鐢靛瓙閽卞寘) - C:\Users\home_2.hwh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-25]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 DeviceHealth; C:\Program Files (x86)\Microsoft Device Health\DhMachineSvc.exe [97432 2014-11-21] ()
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-20] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
S2 NetBalancerService; C:\Program Files\NetBalancer_2\SeriousBit.NetBalancer.Service.exe [10752 2013-03-25] (SeriousBit) [File not signed]
R2 noteupdateservice; C:\Program Files (x86)\anote\anote.exe [1285520 2014-09-04] (Beijing  Hongda  wanfang  technology Co.,Ltd.)
S3 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [454144 2013-03-28] () [File not signed]
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1915408 2013-10-09] (SoftThinks SAS)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [77824 2012-06-19] (Atheros) [File not signed]
S4 BDKVRTP; C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\BaiduSdSvc.exe -r [X]
S4 BDMRTP; C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\BaiduAnSvc.exe -r [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-25] (Malwarebytes Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-05 21:45 - 2015-01-05 21:45 - 00000000 ____D () C:\FRST
2015-01-01 13:33 - 2015-01-01 13:33 - 00014336 ___SH () C:\Users\home_2.hwh\Documents\Thumbs.db
2014-12-27 16:45 - 2014-12-27 16:45 - 00001329 _____ () C:\Users\home_2.hwh\AppData\Roaming\Microsoft\Windows\Start Menu\AppexFinance.lnk
2014-12-27 16:37 - 2014-12-27 16:37 - 00001221 _____ () C:\Users\home_2.hwh\AppData\Roaming\Microsoft\Windows\Start Menu\AppexNews.lnk
2014-12-26 20:36 - 2015-01-04 10:20 - 00000000 ____D () C:\Program Files\trend micro
2014-12-26 20:36 - 2014-12-26 20:37 - 00000000 ____D () C:\rsit
2014-12-25 12:32 - 2013-08-22 08:25 - 00000824 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.20141225-123238.backup
2014-12-25 12:28 - 2015-01-05 21:31 - 00003366 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2085915559-1108105436-2500099883-1007
2014-12-25 12:28 - 2015-01-05 21:31 - 00003314 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2085915559-1108105436-2500099883-1007
2014-12-25 12:27 - 2014-12-25 13:52 - 00088840 _____ () C:\WINDOWS\PFRO.log
2014-12-25 11:56 - 2015-01-05 21:44 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\ClassicShell
2014-12-25 11:55 - 2014-12-25 11:55 - 00000000 ____D () C:\ProgramData\ClassicShell
2014-12-25 11:55 - 2014-12-25 11:54 - 00002132 _____ () C:\Users\home_2.hwh\AppData\Roaming\Microsoft\Windows\Start Menu\startscreen.lnk
2014-12-25 11:54 - 2014-12-25 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
2014-12-25 11:54 - 2014-12-25 11:54 - 00000000 ____D () C:\Program Files\Classic Shell
2014-12-21 17:56 - 2014-12-21 17:56 - 00000735 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PPS 影音.lnk
2014-12-21 17:56 - 2014-12-21 17:56 - 00000731 _____ () C:\Users\Public\Desktop\PPS影音.lnk
2014-12-21 17:56 - 2014-12-21 17:56 - 00000000 ____D () C:\Users\Public\Documents\ppstream
2014-12-21 17:56 - 2014-12-21 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PPStream
2014-12-21 17:54 - 2014-12-23 17:24 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\PPStream
2014-12-19 19:13 - 2015-01-05 21:33 - 01396957 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-19 18:59 - 2014-12-19 18:59 - 00002788 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-12-19 18:58 - 2014-12-19 19:15 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-17 18:07 - 2014-12-19 00:06 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\ppslog
2014-12-17 17:59 - 2014-12-19 17:48 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Local\Unity
2014-12-17 17:58 - 2014-12-18 12:17 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\IQIYI Video
2014-12-16 10:30 - 2014-12-16 10:30 - 00000000 ____D () C:\Users\home_2.hwh\Documents\Youku Files
2014-12-14 12:33 - 2014-12-14 12:33 - 00007168 ___SH () C:\Users\home_2.hwh\Desktop\Thumbs.db
2014-12-11 09:30 - 2014-10-30 17:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-11 09:30 - 2014-10-30 17:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-10 17:07 - 2014-11-26 16:10 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-12-10 17:07 - 2014-11-26 16:10 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-10 17:03 - 2014-12-10 17:03 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2014-12-10 14:22 - 2014-11-09 21:29 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceSetupStatusProvider.dll
2014-12-10 14:22 - 2014-11-09 20:51 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceSetupStatusProvider.dll
2014-12-10 14:22 - 2014-10-30 18:39 - 01970432 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2014-12-10 14:22 - 2014-10-30 18:38 - 01612992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2014-12-10 14:07 - 2014-12-03 18:37 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-12-10 14:07 - 2014-12-03 18:09 - 00830464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2014-12-10 14:07 - 2014-12-02 18:09 - 01083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-12-10 14:07 - 2014-12-02 18:09 - 00740864 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2014-12-10 14:07 - 2014-12-02 18:09 - 00412672 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-12-10 14:07 - 2014-12-02 18:09 - 00396288 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-12-10 14:07 - 2014-12-02 18:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-12-10 14:07 - 2014-11-21 22:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 14:07 - 2014-11-21 21:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 14:07 - 2014-11-21 21:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 14:07 - 2014-11-21 21:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 14:07 - 2014-11-21 21:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 14:07 - 2014-11-21 21:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 14:07 - 2014-11-21 21:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 14:07 - 2014-11-21 21:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 14:07 - 2014-11-21 21:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 14:07 - 2014-11-21 21:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 14:07 - 2014-11-21 21:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 14:07 - 2014-11-21 21:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 14:07 - 2014-11-21 21:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 14:07 - 2014-11-21 21:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 14:07 - 2014-11-21 21:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 14:07 - 2014-11-21 20:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 14:07 - 2014-11-21 20:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 14:07 - 2014-11-21 20:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 14:07 - 2014-11-21 20:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 14:07 - 2014-11-21 20:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 14:07 - 2014-11-21 20:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 14:07 - 2014-11-21 20:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 14:07 - 2014-11-21 20:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 14:07 - 2014-11-21 20:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 14:07 - 2014-11-21 20:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 14:07 - 2014-11-21 20:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 14:07 - 2014-11-21 20:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 14:07 - 2014-11-21 20:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 14:07 - 2014-11-21 20:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 14:07 - 2014-11-21 20:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 14:07 - 2014-11-21 20:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 14:07 - 2014-11-21 20:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 14:07 - 2014-11-21 20:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 14:07 - 2014-11-21 20:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 14:07 - 2014-11-21 20:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 14:07 - 2014-11-21 20:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 14:07 - 2014-11-21 20:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 14:07 - 2014-11-21 19:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 14:07 - 2014-11-21 19:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-12-10 14:07 - 2014-11-06 23:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 14:07 - 2014-11-06 22:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 14:07 - 2014-10-31 18:57 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-12-10 14:07 - 2014-10-31 18:47 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-12-10 14:07 - 2014-10-12 21:43 - 00238912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2014-12-10 14:07 - 2014-10-12 21:43 - 00153920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2014-12-10 14:07 - 2014-10-12 21:43 - 00086336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2014-12-10 14:07 - 2014-10-12 21:43 - 00039744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys
2014-12-09 17:08 - 2014-12-09 17:08 - 00000000 ____D () C:\Users\home_2\Desktop\系统修复发现的可疑文件
2014-12-09 17:07 - 2014-12-09 17:07 - 00000000 ____D () C:\Users\home_2\AppData\Local\Giraffe
2014-12-09 16:47 - 2014-12-09 16:47 - 00000000 ____D () C:\Users\home_2\AppData\Roaming\DataRepair
2014-12-09 12:00 - 2014-12-09 12:00 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\RealNetworks
2014-12-09 09:22 - 2014-12-09 09:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-05 21:41 - 2014-11-24 13:49 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\Skype
2015-01-05 21:38 - 2014-11-26 16:00 - 00000000 ___HD () C:\Users\Public\Fundata
2015-01-05 21:35 - 2014-09-27 21:12 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\TaobaoProtect
2015-01-05 21:33 - 2014-09-28 04:48 - 00003932 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{5C131DE3-4F3B-4B1E-9377-AE2890BF159A}
2015-01-05 21:33 - 2014-01-08 12:51 - 00436346 _____ () C:\WINDOWS\system32\prfh0804.dat
2015-01-05 21:33 - 2014-01-08 12:51 - 00135868 _____ () C:\WINDOWS\system32\prfc0804.dat
2015-01-05 21:33 - 2013-09-29 23:04 - 01438230 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-05 21:31 - 2014-11-29 23:23 - 00000362 _____ () C:\WINDOWS\Tasks\iToolsDaemon.job
2015-01-05 21:31 - 2014-06-18 18:23 - 00003326 _____ () C:\WINDOWS\System32\Tasks\iToolsDaemon
2015-01-05 21:30 - 2014-01-22 21:30 - 00000000 _____ () C:\WINDOWS\system32\Drivers\lvuvc.hs
2015-01-05 21:30 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-04 09:59 - 2014-08-27 03:28 - 00000492 _____ () C:\WINDOWS\Tasks\微软设备健康助手自动更新.job
2015-01-04 09:19 - 2014-12-05 09:55 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Local\Giraffe
2015-01-04 09:19 - 2014-12-05 09:30 - 00000000 ___HD () C:\Users\Public\FunAcce
2015-01-04 00:15 - 2014-02-08 12:31 - 00000000 ____D () C:\Program Files\KMSpico
2015-01-03 23:55 - 2014-12-05 09:40 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\Zoo
2014-12-31 10:45 - 2014-11-25 21:58 - 00000000 ____D () C:\Users\home_2.hwh\Desktop\something concerned
2014-12-30 08:15 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-27 19:49 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-12-27 19:47 - 2013-09-28 00:49 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2014-12-27 19:40 - 2014-11-15 16:44 - 00000476 _____ () C:\WINDOWS\Tasks\微软设备健康助手开机检测.job
2014-12-27 19:40 - 2013-08-22 09:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-12-27 19:39 - 2014-09-27 21:12 - 00000000 ____D () C:\Users\home_2.hwh
2014-12-27 19:39 - 2013-08-22 08:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2014-12-27 17:54 - 2014-09-27 21:17 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2085915559-1108105436-2500099883-1007
2014-12-25 13:54 - 2014-06-27 15:47 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-12-25 13:43 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\Registration
2014-12-25 13:35 - 2014-11-25 21:49 - 00000000 ____D () C:\Users\home_2.hwh\Doctor Web
2014-12-25 13:13 - 2013-08-22 10:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-12-25 12:58 - 2014-12-05 09:40 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\CloudMedia
2014-12-21 18:00 - 2014-09-27 21:12 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Local\VirtualStore
2014-12-21 18:00 - 2014-01-15 08:55 - 00000000 ____D () C:\ProgramData\LocalStorage
2014-12-20 10:40 - 2014-03-21 23:46 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-20 10:40 - 2013-12-31 19:46 - 00000000 ____D () C:\ProgramData\Skype
2014-12-19 19:40 - 2014-11-02 16:03 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\Wise Disk Cleaner
2014-12-19 18:52 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\migwiz
2014-12-19 18:45 - 2014-04-02 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\美图
2014-12-19 18:44 - 2014-04-02 08:14 - 00000000 ____D () C:\Program Files (x86)\YouKu
2014-12-19 18:31 - 2014-10-31 10:14 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Local\Adobe
2014-12-19 18:24 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\PLA
2014-12-19 18:01 - 2014-11-29 22:36 - 00000000 ____D () C:\Program Files (x86)\Rising
2014-12-19 18:00 - 2014-11-29 23:33 - 00000000 ___RD () C:\RavBin
2014-12-19 17:44 - 2014-06-27 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-12-19 17:44 - 2014-06-27 15:46 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-12-19 17:41 - 2014-01-09 22:52 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-12-18 10:41 - 2012-07-26 02:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-15 11:32 - 2014-12-01 09:03 - 00003340 _____ () C:\WINDOWS\System32\Tasks\RsDelayLauncher_{8A34248E-7D35-4832-8378-7659E0B0A380}
2014-12-10 20:30 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-10 17:03 - 2014-07-10 05:57 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-12-10 17:03 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-10 17:03 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-10 17:03 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-10 17:03 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\AppCompat
2014-12-10 15:16 - 2014-02-08 12:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 15:15 - 2013-12-03 10:03 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-10 15:11 - 2013-12-03 10:03 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-09 19:16 - 2014-03-07 09:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-09 18:38 - 2013-12-13 10:30 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2085915559-1108105436-2500099883-1006
2014-12-09 17:14 - 2014-11-29 22:36 - 00000000 ____D () C:\ProgramData\Rising
2014-12-09 16:42 - 2014-11-29 22:37 - 00000000 ____D () C:\Program Files (x86)\Wandoujia
2014-12-09 16:41 - 2014-08-27 03:28 - 00000000 ____D () C:\Users\home_2\AppData\Roaming\TaobaoProtect
2014-12-09 16:33 - 2014-11-25 08:03 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Local\UCBrowser
2014-12-09 16:30 - 2014-09-22 16:30 - 00000000 ____D () C:\Users\home_2\SkyDrive
2014-12-09 16:26 - 2014-11-29 22:37 - 00000000 ____D () C:\Users\home_2.hwh\AppData\Roaming\Wandoujia2

Files to move or delete:
====================
C:\ProgramData\999.dat


Some content of TEMP:
====================
C:\Users\home_2\AppData\Local\Temp\1A74.exe
C:\Users\home_2\AppData\Local\Temp\1FC3.exe
C:\Users\home_2\AppData\Local\Temp\2071.exe
C:\Users\home_2\AppData\Local\Temp\2571.exe
C:\Users\home_2\AppData\Local\Temp\2637.exe
C:\Users\home_2\AppData\Local\Temp\30E0.exe
C:\Users\home_2\AppData\Local\Temp\6DA1.exe
C:\Users\home_2\AppData\Local\Temp\79BA.exe
C:\Users\home_2\AppData\Local\Temp\9170.exe
C:\Users\home_2\AppData\Local\Temp\A03B.exe
C:\Users\home_2\AppData\Local\Temp\A0E.exe
C:\Users\home_2\AppData\Local\Temp\AC8A.exe
C:\Users\home_2\AppData\Local\Temp\B54A.exe
C:\Users\home_2\AppData\Local\Temp\bzre1107.exe
C:\Users\home_2\AppData\Local\Temp\CBBC.exe
C:\Users\home_2\AppData\Local\Temp\D96.exe
C:\Users\home_2\AppData\Local\Temp\dd617.exe
C:\Users\home_2\AppData\Local\Temp\ddll.exe
C:\Users\home_2\AppData\Local\Temp\EA4A.exe
C:\Users\home_2\AppData\Local\Temp\EC87.exe
C:\Users\home_2\AppData\Local\Temp\HWSignature.dll
C:\Users\home_2\AppData\Local\Temp\qing_update.exe
C:\Users\home_2\AppData\Local\Temp\qqsafeud.exe
C:\Users\home_2\AppData\Local\Temp\rrd.exe
C:\Users\home_2\AppData\Local\Temp\SkypeSetup.exe
C:\Users\home_2\AppData\Local\Temp\sogou_pinyin_7.2.1.3736.exe
C:\Users\home_2.hwh\AppData\Local\Temp\masauto_runxx.dl.dll
C:\Users\home_2.hwh\AppData\Local\Temp\masflag_runxx.dl.dll
C:\Users\home_2.hwh\AppData\Local\Temp\QYAgent_runxx.dl.dll
C:\Users\home_2.hwh\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-02 10:26

==================== End Of Log ============================

 

 

Attached Files



#8 nasdaq

nasdaq

  • Malware Response Team
  • 40,754 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:31 AM

Posted 06 January 2015 - 09:33 AM


Run this tool to clean your Temporary files/Folders.

Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program.
  • TFC will close all open programs itself in order to run.
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted, it should not take long to finish.
  • Once it's finished, click OK to reboot.
  • If it does not reboot, reboot your system manually.
===

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
start

CloseProcesses:

() C:\Program Files\KMSpico\Service_KMS.exe
Winlogon\Notify\igfxcui: igfxdev.dll [X]
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2085915559-1108105436-2500099883-1007 -> {B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} URL = http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&abar=2&tn=49029047_oem_dg&ch=33
BHO-x32: No Name -> {000DA090-57AA-424B-A8F0-621B7C08B8F4} ->  No File
Handler: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File
Handler: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File
FF Plugin: @iqiyi.com/npWebPlayer -> D:\IQIYI Video\LStyle\npWebPlayer.dll No File
FF Plugin: @pps.tv/npWebPlayer -> C:\PPStream\npWebPlayer.dll No File
FF Plugin-x32: @baidu.com/BaidusdDetectNPPlugin -> C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\explugin\npBaiduSDDetectPlug.dll No File
FF Plugin-x32: @baidu.com/npxbdcntb -> C:\Program Files (x86)\Baidu\BaiduPinyin\2.7.2.131\npxbdcntb.dll No File
FF Plugin-x32: @baidu.com/npxbdsetup -> C:\WINDOWS\Downloaded Program Files\24412968\npxbdsetup.dll No File
FF Plugin-x32: @iqiyi.com/npWebPlayer -> D:\IQIYI Video\LStyle\npWebPlayer.dll No File
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @xunlei.com/npxluser -> C:\Program Files (x86)\Common Files\Thunder Network\UserAgent\npxluser2.0.2.3.dll No File
FF Plugin HKU\S-1-5-21-2085915559-1108105436-2500099883-1007: @iqiyi.com/npWebPlayer -> D:\IQIYI Video\LStyle\npWebPlayer.dll No File
FF Plugin HKU\S-1-5-21-2085915559-1108105436-2500099883-1007: @xunlei.com/npxluser -> C:\Program Files (x86)\Common Files\Thunder Network\UserAgent\npxluser2.0.2.3.dll No File
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\baidu.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\baiduzhidao.xml
CHR Extension: (Google ??????) - C:\Users\home_2.hwh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-25]
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [454144 2013-03-28] () [File not signed]
S4 BDKVRTP; C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\BaiduSdSvc.exe -r [X]
S4 BDMRTP; C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\BaiduAnSvc.exe -r [X]
Task: {5AB6753A-118B-4768-8BAD-F02D6B8B9491} - \KwRunAsStdUser Task9806 No Task File <==== ATTENTION
Task: {74C99F8B-3C1D-4F7A-BB1F-BB230A93D1A1} - \360SuperKiller\360SuperKiller No Task File <==== ATTENTION

End
Save the files as fixlist.txt into the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log Fixlog.txt please post it to your reply.
===

Download Security Check by screen317 from here
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
p.s.
If the SecurityCheck program fails to run for any reason, run it as an Administrator.

If the site is busy or not available use this mirror site:
http://www.bleepingcomputer.com/download/securitycheck/

How is the computer running now?

======

#9 bsmile

bsmile
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:31 AM

Posted 06 January 2015 - 11:26 AM

I followed your instruction, and tried to initialize windows defender again, but still failed. The outputs are giving below, Thanks for your further help,

 

Fixlog.txt  (due to some miscarefulness I ran it twice, this output is from the second time, sorry for that)

===================

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-01-2015
Ran by home_2 at 2015-01-06 10:51:09 Run:2
Running from F:\software\security software
Loaded Profile: home_2 (Available profiles: home & home_2)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start

CloseProcesses:

() C:\Program Files\KMSpico\Service_KMS.exe
Winlogon\Notify\igfxcui: igfxdev.dll [X]
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2085915559-1108105436-2500099883-1007 -> {B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} URL = http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&abar=2&tn=49029047_oem_dg&ch=33
BHO-x32: No Name -> {000DA090-57AA-424B-A8F0-621B7C08B8F4} ->  No File
Handler: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File
Handler: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File
FF Plugin: @iqiyi.com/npWebPlayer -> D:\IQIYI Video\LStyle\npWebPlayer.dll No File
FF Plugin: @pps.tv/npWebPlayer -> C:\PPStream\npWebPlayer.dll No File
FF Plugin-x32: @baidu.com/BaidusdDetectNPPlugin -> C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\explugin\npBaiduSDDetectPlug.dll No File
FF Plugin-x32: @baidu.com/npxbdcntb -> C:\Program Files (x86)\Baidu\BaiduPinyin\2.7.2.131\npxbdcntb.dll No File
FF Plugin-x32: @baidu.com/npxbdsetup -> C:\WINDOWS\Downloaded Program Files\24412968\npxbdsetup.dll No File
FF Plugin-x32: @iqiyi.com/npWebPlayer -> D:\IQIYI Video\LStyle\npWebPlayer.dll No File
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @xunlei.com/npxluser -> C:\Program Files (x86)\Common Files\Thunder Network\UserAgent\npxluser2.0.2.3.dll No File
FF Plugin HKU\S-1-5-21-2085915559-1108105436-2500099883-1007: @iqiyi.com/npWebPlayer -> D:\IQIYI Video\LStyle\npWebPlayer.dll No File
FF Plugin HKU\S-1-5-21-2085915559-1108105436-2500099883-1007: @xunlei.com/npxluser -> C:\Program Files (x86)\Common Files\Thunder Network\UserAgent\npxluser2.0.2.3.dll No File
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\baidu.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\baiduzhidao.xml
CHR Extension: (Google ??????) - C:\Users\home_2.hwh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-25]
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [454144 2013-03-28] () [File not signed]
S4 BDKVRTP; C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\BaiduSdSvc.exe -r [X]
S4 BDMRTP; C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\BaiduAnSvc.exe -r [X]
Task: {5AB6753A-118B-4768-8BAD-F02D6B8B9491} - \KwRunAsStdUser Task9806 No Task File <==== ATTENTION
Task: {74C99F8B-3C1D-4F7A-BB1F-BB230A93D1A1} - \360SuperKiller\360SuperKiller No Task File <==== ATTENTION

End
*****************

Processes closed successfully.
C:\Program Files\KMSpico\Service_KMS.exe => No running process found
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui => Key not found.
HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon => Key not found.
HKLM\SOFTWARE\Policies\Google => Key not found.
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => Key not found.
HKU\S-1-5-21-2085915559-1108105436-2500099883-1007\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} => Key not found.
HKCR\CLSID\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000DA090-57AA-424B-A8F0-621B7C08B8F4} => Key not found.
HKCR\Wow6432Node\CLSID\{000DA090-57AA-424B-A8F0-621B7C08B8F4} => Key not found.
HKCR\PROTOCOLS\Handler\KuGoo => Key not found.
HKCR\CLSID\{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} => Key not found.
HKCR\PROTOCOLS\Handler\KuGoo3 => Key not found.
HKCR\CLSID\{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} => Key not found.
HKLM\Software\MozillaPlugins\@iqiyi.com/npWebPlayer => Key not found.
HKLM\Software\MozillaPlugins\@pps.tv/npWebPlayer => Key not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@baidu.com/BaidusdDetectNPPlugin => Key not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@baidu.com/npxbdcntb => Key not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@baidu.com/npxbdsetup => Key not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@iqiyi.com/npWebPlayer => Key not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/QQPhotoDrawEx => Key not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/QzoneMusic => Key not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@xunlei.com/npxluser => Key not found.
HKU\S-1-5-21-2085915559-1108105436-2500099883-1007\Software\MozillaPlugins\@iqiyi.com/npWebPlayer => Key not found.
D:\IQIYI Video\LStyle\npWebPlayer.dll not found.
HKU\S-1-5-21-2085915559-1108105436-2500099883-1007\Software\MozillaPlugins\@xunlei.com/npxluser => Key not found.
C:\Program Files (x86)\Common Files\Thunder Network\UserAgent\npxluser2.0.2.3.dll not found.
"C:\Program Files (x86)\mozilla firefox\browser\searchplugins\baidu.xml" => not found.
"C:\Program Files (x86)\mozilla firefox\browser\searchplugins\baiduzhidao.xml" => not found.
C:\Users\home_2.hwh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => Moved successfully.
Service KMSELDI => Service not found.
BDKVRTP => Service not found.
BDMRTP => Service not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5AB6753A-118B-4768-8BAD-F02D6B8B9491}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5AB6753A-118B-4768-8BAD-F02D6B8B9491}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\KwRunAsStdUser Task9806" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{74C99F8B-3C1D-4F7A-BB1F-BB230A93D1A1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{74C99F8B-3C1D-4F7A-BB1F-BB230A93D1A1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\360SuperKiller\360SuperKiller" => Key deleted successfully.


The system needed a reboot.

==== End of Fixlog 10:51:10 ====

 

 

checkup.txt

============================

 Results of screen317's Security Check version 0.99.93  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Spybot - Search & Destroy
 Wise Disk Cleaner 8.34  
  Adobe Flash Player     12.0.0.44 Flash Player out of Date!  
 Mozilla Firefox (34.0.5)
 Google Chrome 34.0.1847.116 Google Chrome out of date!  
````````Process Check: objlist.exe by Laurent````````  
 Spybot Teatimer.exe is disabled!
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````

=======



#10 nasdaq

nasdaq

  • Malware Response Team
  • 40,754 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:31 AM

Posted 06 January 2015 - 01:12 PM


Critical vulnerabilities have been identified in old version of Adobe Flash Player please get the latest version.

Flash test site:
http://www.adobe.com/software/flash/about/
Install the new version or if you have the latest close the windows.

Flash Player Help / Find version
http://helpx.adobe.com/flash-player/kb/find-version-flash-player.html#main_Find_the_Flash_Player_version_installed_on_your_machine
===


Refer to this article and see if you can enable Windows Defender.
http://www.thewindowsclub.com/windows-defender-is-turned-off

===

p.s.
Spybot - Search & Destroy may be protecting it. Disable it and see what happens.

#11 nasdaq

nasdaq

  • Malware Response Team
  • 40,754 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:31 AM

Posted 12 January 2015 - 08:33 AM

Are you still with me?

#12 bsmile

bsmile
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:31 AM

Posted 12 January 2015 - 12:34 PM

thanks for your help, please give me a few more days ..., I am right now not around my computer.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users