Jump to content

Needed help on removal of funAcce and fundata

sheng12

By sheng12
in Resolved Malware Removal Logs

 Share

Recommended Posts

sheng12

sheng12

Posted
Posted

Hi I needed on removing funAcce and fundata folder which are leftover after uninstallation of funshion. I have read a similar post on this forum and run the farbar scanning tools but don't know how to proceed from there.

 

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-01-2015 01Ran by user (administrator) on USER-PC on 18-01-2015 00:45:23Running from C:\Users\user\DesktopLoaded Profiles: user (Available profiles: user)Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: Chrome)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(AMD) C:\Windows\System32\atiesrxx.exe(AMD) C:\Windows\System32\atieclxx.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr64.exe(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe() C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe() C:\Windows\SysWOW64\PnkBstrA.exe(Mentor Graphics Corporation) C:\Program Files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\remotesolverdispatcherservice.exe(Mentor Graphics Corporation) C:\Program Files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\dispatcher.exe(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe(Flux Software LLC) C:\Users\user\AppData\Local\FluxSoftware\Flux\flux.exe(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe(Google Inc.) C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10144288 2010-04-06] (Realtek Semiconductor)HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-04] (Avira Operations GmbH & Co. KG)HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2014-12-09] (Raptr, Inc)HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd)HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\MountPoints2: {2d6cde14-2bd2-11e2-b0a0-20cf3084e15e} - G:\setup.exeHKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-11-14] (Microsoft Corporation)ShellIconOverlayIdentifiers: [FunOverlay] -> {A5662DF9-0C2E-4A56-9FE1-BACFF6966D88} => C:\Users\Public\Fundata\Lucifer.dll (Funshion)==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-3098599808-827696543-3375896687-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-my/?ocid=iehpSearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} ->  No FileBHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)BHO-x32: Blog This in Windows Live v2 -> {3adefb8e-b923-35e6-86e2-2b7841f5d2a7} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)BHO-x32: No Name -> {4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA} ->  No FileBHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabHandler: kuwo - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0C} -  No FileWinsock: Catalog9 01 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Winsock: Catalog9 02 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Winsock: Catalog9 03 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Winsock: Catalog9 14 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Tcpip\Parameters: [DhcpNameServer] 192.168.1.1Tcpip\..\Interfaces\{8DA045F1-F476-428D-B575-98019D734C2B}: [NameServer] 208.67.222.222,202.188.1.5FireFox:========FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.defaultFF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()FF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @t.garena.com/garenatalk -> C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No FileFF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @wolfram.com/Mathematica -> C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.1.2063897\npmathplugin.dll (Wolfram Research, Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKU\S-1-5-21-3098599808-827696543-3375896687-1000: @tools.google.com/Google Update;version=3 -> C:\Users\user\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin HKU\S-1-5-21-3098599808-827696543-3375896687-1000: @tools.google.com/Google Update;version=9 -> C:\Users\user\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin HKU\S-1-5-21-3098599808-827696543-3375896687-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\user\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Extension: YouTube Video and Audio Downloader - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.default\Extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi [2013-10-19]FF Extension: Firebug - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.default\Extensions\firebug@software.joehewitt.com.xpi [2013-02-03]FF Extension: YouTube High Definition - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.default\Extensions\{7b1bf0b6-a1b9-42b0-b75d-252036438bdc}.xpi [2013-10-19]FF Extension: Download YouTube Videos as MP4 - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.default\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2013-10-19]FF HKLM-x32\...\Firefox\Extensions: [hotfix@mozilla.org] - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Extensions\MozillaHotfixFF Extension: Mozilla hotfix - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Extensions\MozillaHotfix [2012-06-05]FF HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\Firefox\Extensions: [hotfix@mozilla.org] - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Extensions\MozillaHotfixChrome: =======CHR HomePage: Default -> hxxp://www.google.com.my/CHR StartupUrls: Default -> "hxxp://www.google.com.my/"CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (FB Refresh) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdlfdaajmclngiomogmleihllaejcnni [2012-08-11]CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-08]CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-05-31]CHR Extension: (Facebook Chat Layout) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\boihdhneeghabgieifcfinfempokflon [2012-08-24]CHR Extension: (Color My Facebook) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb [2012-09-06]CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-05-31]CHR Extension: (ClariS Reunion Version) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\egfbplplgcbppikgcnmcnhinlogaijcm [2013-07-22]CHR Extension: (Chromium Wheel Smooth Scroller) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\khpcanbeojalbkpgpmjpdkjnkfcgfkhb [2012-07-26]CHR Extension: (Save to Pocket) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj [2013-06-01]CHR Extension: (Google Wallet) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-07-17]CHR Extension: (SPOI Options (Full Version)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojmgeoecaejeajjegjmijbcifhkbmgjd [2013-10-19]CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-05-31]CHR HKLM\...\Chrome\Extension: [jeaohhlajejodfjadcponpnjgkiikocn] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [Not Found]CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No PathCHR StartMenuInternet: Google Chrome - C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1044784 2014-11-25] (Avira Operations GmbH & Co. KG)R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [807672 2014-12-04] (Avira Operations GmbH & Co. KG)R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-04] (Avira Operations GmbH & Co. KG)R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-04] (Avira Operations GmbH & Co. KG)R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-04] (Avira Operations GmbH & Co. KG)R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [915584 2011-10-07] ()R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2011-10-07] ()R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [271920 2007-03-12] (Nero AG)R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-02-01] ()R2 RemoteSolverDispatcher; C:\Program Files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\remotesolverdispatcherservice.exe [51848 2012-09-13] (Mentor Graphics Corporation) [File not signed]S3 SolidWorks Licensing Service; C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2013-07-23] (SolidWorks) [File not signed]S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580232 2014-01-21] (WiseCleaner.com)==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2011-10-07] ()R3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-10-07] (MCCI Corporation)S3 ASUSstpt; C:\Windows\System32\DRIVERS\ASUSstpt.sys [24648 2011-10-07] (MCCI Corporation)S3 ASUSumsc; C:\Windows\System32\DRIVERS\ASUSumsc.sys [141896 2011-10-07] (MCCI Corporation)R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-07-06] (Avira GmbH)R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-07-06] (Avira GmbH)R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-09] (Avira Operations GmbH & Co. KG)R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-09] (Avira Operations GmbH & Co. KG)R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [43064 2014-10-09] (Avira Operations GmbH & Co. KG)R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-11-11] (DT Soft Ltd)S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [43664 2015-01-17] ()R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2011-10-07] ()R0 vsock; C:\Windows\System32\drivers\vsock.sys [76480 2014-11-17] (VMware, Inc.)S1 bd0001; system32\DRIVERS\bd0001.sys [X]S1 bd0004; system32\DRIVERS\bd0004.sys [X]S3 NPF; system32\drivers\NPF.sys [X]S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]S3 tsusbhub; system32\drivers\tsusbhub.sys [X]S3 VGPU; System32\drivers\rdvgkmd.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2015-01-18 00:45 - 2015-01-18 00:46 - 00019322 _____ () C:\Users\user\Desktop\FRST.txt2015-01-18 00:45 - 2015-01-18 00:45 - 00000000 ____D () C:\FRST2015-01-18 00:44 - 2015-01-18 00:44 - 02125824 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe2015-01-17 22:22 - 2015-01-18 00:07 - 00000000 ____D () C:\Program Files\Unlocker2015-01-17 21:43 - 2015-01-17 21:43 - 00043664 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys2015-01-17 21:43 - 2015-01-17 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro2015-01-17 21:43 - 2015-01-17 21:43 - 00000000 ____D () C:\Program Files\HitmanPro2015-01-17 21:42 - 2015-01-17 22:03 - 00000000 ____D () C:\ProgramData\HitmanPro2015-01-15 12:37 - 2015-01-15 13:36 - 05013680 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2015-01-10 21:34 - 2015-01-11 00:27 - 1028653056 ____R () C:\Users\user\Downloads\ubuntu-14.04.1-desktop-amd64.iso2015-01-10 21:24 - 2015-01-11 01:14 - 00000000 ____D () C:\Users\user\Documents\Virtual Machines2015-01-10 21:24 - 2015-01-10 21:24 - 00000000 ____D () C:\Users\user\AppData\Roaming\AMD2015-01-10 21:14 - 2015-01-17 20:19 - 00000000 ____D () C:\Users\user\AppData\Roaming\VMware2015-01-10 21:14 - 2015-01-17 20:19 - 00000000 ____D () C:\Users\user\AppData\Local\VMware2015-01-10 21:12 - 2014-11-20 18:44 - 00066752 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmx86.sys2015-01-10 21:12 - 2014-11-20 18:44 - 00033472 _____ (VMware, Inc.) C:\Windows\system32\Drivers\VMkbd.sys2015-01-10 21:12 - 2014-11-17 17:38 - 00076480 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vsock.sys2015-01-10 21:12 - 2014-11-17 17:38 - 00068288 _____ (VMware, Inc.) C:\Windows\system32\vsocklib.dll2015-01-10 21:12 - 2014-11-17 17:38 - 00064192 _____ (VMware, Inc.) C:\Windows\SysWOW64\vsocklib.dll2015-01-10 21:11 - 2015-01-18 00:23 - 00000000 ____D () C:\ProgramData\VMware2015-01-10 21:11 - 2015-01-10 21:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware2015-01-10 21:11 - 2015-01-10 21:11 - 00000000 ____D () C:\Program Files\Common Files\VMware2015-01-10 21:11 - 2015-01-10 21:11 - 00000000 ____D () C:\Program Files (x86)\VMware2015-01-10 21:11 - 2014-11-20 18:44 - 00931008 _____ (VMware, Inc.) C:\Windows\system32\vnetlib64.dll2015-01-10 21:11 - 2014-11-20 18:44 - 00438464 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe2015-01-10 21:11 - 2014-11-20 18:44 - 00359104 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe2015-01-10 21:11 - 2014-11-20 18:44 - 00026816 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmnetuserif.sys2015-01-10 21:11 - 2014-11-18 08:04 - 00055488 _____ (VMware, Inc.) C:\Windows\system32\Drivers\hcmon.sys2015-01-10 20:56 - 2015-01-10 21:09 - 79112888 _____ (VMware, Inc.) C:\Users\user\Downloads\VMware-player-7.0.0-2305329.exe2015-01-03 13:19 - 2015-01-17 20:23 - 00000000 ____D () C:\Users\user\AppData\Roaming\Zoo2015-01-02 14:55 - 2015-01-02 14:55 - 00011707 _____ () C:\Users\user\Documents\block 37 collection sheet.xlsx2015-01-01 17:32 - 2015-01-01 17:32 - 00000000 ____D () C:\Users\user\AppData\Roaming\DataRepair2015-01-01 16:44 - 2015-01-18 00:33 - 00000000 ____D () C:\Users\Public\FunAcce2014-12-29 12:43 - 2014-12-29 12:44 - 06354256 _____ (Tonec Inc.) C:\Users\user\Downloads\idman621build16.exe2014-12-26 21:09 - 2014-12-26 21:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2015-01-18 00:36 - 2012-07-31 10:09 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2015-01-18 00:33 - 2013-10-10 13:56 - 00000000 ____D () C:\Users\Public\Fundata2015-01-18 00:30 - 2009-07-14 12:45 - 00017168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-01-18 00:30 - 2009-07-14 12:45 - 00017168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-01-18 00:28 - 2014-12-12 21:50 - 01452769 _____ () C:\Windows\WindowsUpdate.log2015-01-18 00:24 - 2014-06-22 13:20 - 00000000 ____D () C:\Users\user\AppData\Roaming\Raptr2015-01-18 00:23 - 2014-12-12 21:47 - 00003282 _____ () C:\Windows\setupact.log2015-01-18 00:23 - 2014-05-10 18:30 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-01-18 00:23 - 2014-03-15 21:36 - 00000000 ____D () C:\Users\user\AppData\Roaming\Wise Care 3652015-01-18 00:23 - 2009-07-14 13:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-01-18 00:22 - 2014-12-12 21:47 - 00008150 _____ () C:\Windows\PFRO.log2015-01-18 00:19 - 2012-06-03 11:53 - 00000000 ____D () C:\Users\user\AppData\Roaming\DMCache2015-01-18 00:17 - 2013-03-11 00:22 - 00000000 ____D () C:\Users\user\AppData\Roaming\Syncios2015-01-18 00:07 - 2012-08-30 13:15 - 00000000 ____D () C:\Users\user\AppData\Local\PunkBuster2015-01-18 00:07 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\registration2015-01-17 22:03 - 2012-07-23 22:14 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3098599808-827696543-3375896687-1000UA.job2015-01-17 21:57 - 2012-09-16 20:36 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-01-17 21:26 - 2012-09-16 20:36 - 00000000 ____D () C:\Program Files (x86)\Google2015-01-17 21:25 - 2014-03-15 21:48 - 00000000 ____D () C:\Program Files (x86)\Auslogics2015-01-17 21:24 - 2014-06-03 02:54 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab2015-01-17 20:45 - 2013-10-18 23:05 - 00000000 ____D () C:\Program Files (x86)\Resident Evil 62015-01-17 20:43 - 2013-01-05 12:04 - 00770760 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI2015-01-17 20:43 - 2009-07-14 13:13 - 00770760 _____ () C:\Windows\system32\PerfStringBackup.INI2015-01-17 20:40 - 2013-08-15 18:55 - 00000000 ____D () C:\Windows\system32\MRT2015-01-17 20:33 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\system32\migwiz2015-01-17 20:31 - 2012-05-31 16:07 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2015-01-17 20:17 - 2014-10-01 21:01 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-01-16 19:03 - 2012-07-23 22:14 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3098599808-827696543-3375896687-1000Core.job2015-01-15 13:36 - 2012-07-31 10:09 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2015-01-15 13:36 - 2012-07-31 10:09 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2015-01-15 13:36 - 2012-07-31 10:09 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2015-01-12 01:27 - 2012-05-31 20:11 - 00007605 _____ () C:\Users\user\AppData\Local\Resmon.ResmonCfg2015-01-12 01:01 - 2014-06-12 22:12 - 00000600 _____ () C:\Users\user\AppData\Local\PUTTY.RND2015-01-11 22:15 - 2012-07-10 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira2015-01-09 13:40 - 2012-09-30 18:24 - 00000000 ___RD () C:\Users\user\Dropbox2015-01-09 13:40 - 2012-09-30 18:22 - 00000000 ____D () C:\Users\user\AppData\Roaming\Dropbox2015-01-03 22:17 - 2014-12-06 22:44 - 00000000 ____D () C:\Users\user\AppData\Local\Elliot Quest2014-12-29 12:48 - 2014-08-08 18:32 - 00000000 ____D () C:\Users\user\Desktop\IDM2014-12-27 12:37 - 2012-07-13 00:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service==================== Files in the root of some directories =======2013-10-10 13:57 - 2014-09-10 13:03 - 0000954 _____ () C:\Users\user\AppData\Roaming\coreavc.ini2014-12-10 16:01 - 2014-12-10 16:01 - 0009112 _____ () C:\Users\user\AppData\Roaming\lds_uninst.log2013-12-20 22:24 - 2013-12-20 22:24 - 0045270 _____ () C:\Users\user\AppData\Roaming\room_v3.dat2014-10-24 23:08 - 2014-10-24 23:08 - 0003584 _____ () C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2013-04-07 22:40 - 2013-04-07 22:40 - 0000337 _____ () C:\Users\user\AppData\Local\Perfmon.PerfmonCfg2014-06-12 22:12 - 2015-01-12 01:01 - 0000600 _____ () C:\Users\user\AppData\Local\PUTTY.RND2014-09-29 21:51 - 2014-09-29 21:51 - 0000846 _____ () C:\Users\user\AppData\Local\recently-used.xbel2012-05-31 20:11 - 2015-01-12 01:27 - 0007605 _____ () C:\Users\user\AppData\Local\Resmon.ResmonCfg2013-11-20 20:46 - 2013-11-20 20:46 - 0022486 _____ () C:\ProgramData\ie169.icoSome content of TEMP:====================C:\Users\user\AppData\Local\Temp\avgnt.exeC:\Users\user\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_fq9ye.dllC:\Users\user\AppData\Local\Temp\setuplauncher.exeC:\Users\user\AppData\Local\Temp\sfamcc00001.dllC:\Users\user\AppData\Local\Temp\utt6534.tmp.exe==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2015-01-15 14:02==================== End Of Log ============================

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-01-2015 01Ran by user at 2015-01-18 00:46:38Running from C:\Users\user\DesktopBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)Activision(R) (x32 Version: 1.00.0000 - Activision) HiddenAdobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 1.02.03 - ASUSTeK Computer Inc.)AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)Avira APC 0.1.0.1 (HKLM-x32\...\{18948029-33D5-4B93-8275-FE1FC7A43D51}_is1) (Version: 0.1.0.1 - Avira Operations GmbH & Co. KG)Avira Internet Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Canon E510 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_E510_series) (Version: 1.00 - Canon Inc.)Canon E510 series On-screen Manual (HKLM-x32\...\Canon E510 series On-screen Manual) (Version: 7.5.0 - Canon Inc.)Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.3.5.0 - Canon Inc.)Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - ‪Canon Inc.‬)Canon MP Navigator EX 3.0 (HKLM-x32\...\MP Navigator EX 3.0) (Version:  - )Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.)Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.)Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.0.0 - Canon Inc.)CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)CPUID CPU-Z 1.64.0 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )CPUID HWMonitor 1.23 (HKLM\...\CPUID HWMonitor_is1) (Version:  - )DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.46.1.0327 - DT Soft Ltd)Dev-C++ (HKLM-x32\...\Dev-C++) (Version: 5.4.0 - )Dropbox (HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)f.lux (HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\Flux) (Version:  - )gedit 2.30.1 (HKLM-x32\...\gedit_is1) (Version: 2.30.1 - GNOME)GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)Google Chrome (HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\Google Chrome) (Version: 40.0.2214.85 - Google Inc.)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenHitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.234 - SurfRight B.V.)iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)LuaEdit 2010 (x86 - 3.0.10.0) (HKLM-x32\...\LuaEdit 2010_is1) (Version:  - Open Source)Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)Mathematica Extras 8.0 (2063897) (HKLM\...\A-WIN-Extras 8.0.1 2063897_is1) (Version: 8.0.1 - Wolfram Research, Inc.)Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)Microsoft Office 2003 Web Components (HKLM-x32\...\{90120000-00A4-0409-0000-0000000FF1CE}) (Version: 12.0.6213.1000 - Microsoft Corporation)Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (HKLM\...\Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU) (Version:  - Microsoft Corporation)Microsoft Visual Studio 2005 Tools for Applications - ENU (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Applications - ENU) (Version:  - Microsoft Corporation)mIRC (HKLM-x32\...\mIRC) (Version: 7.36 - mIRC Co. Ltd.)MKVToolNix 6.9.1 (64bit) (HKLM-x32\...\MKVToolNix) (Version: 6.9.1 - Moritz Bunkus)Mozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)MPC-HC 1.7.6 (64-bit) (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.7.6 - MPC-HC Team)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)Nero 7 Ultra Edition (HKLM-x32\...\{43FFE159-3199-4188-A1CD-629166AD1033}) (Version: 7.02.6445 - Nero AG)NVIDIA PhysX (HKLM-x32\...\{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}) (Version: 9.12.0213 - NVIDIA Corporation)Raptr (HKLM-x32\...\Raptr) (Version:  - )Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6083 - Realtek Semiconductor Corp.)Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.28.1 - Renesas Electronics Corporation)Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.28.1 - Renesas Electronics Corporation) HiddenResident Evil 6 (HKLM-x32\...\Resident Evil 6_is1) (Version:  - R.G. Origami)Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)RuneScape Launcher 1.2.3 (HKLM-x32\...\{FAE99C85-0732-4C58-9C6B-10B5B12FA2E9}) (Version: 1.2.3 - Jagex Ltd)Samsung_MonSetup (HKLM-x32\...\{8EA79DBF-D637-448A-89D6-410A087A4493}) (Version: 1.00.0000 - Samsung)Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)SimCity 4 Rush Hour (HKLM-x32\...\{CBA2E782-C278-4B81-008D-4703FCBC1A2E}) (Version:  - )Sniper Elite 3 (HKLM-x32\...\U25pcGVyRWxpdGUz_is1) (Version: 1 - )SolidWorks 2013 x64 Edition SP0 (HKLM-x32\...\SolidWorks Installation Manager 20130-40000-1100-100) (Version: 21.0.0.5024 - SolidWorks Corporation)SolidWorks 2013 x64 Edition SP0 (Version: 21.100.5024 - SolidWorks) HiddenSolidWorks eDrawings 2013 x64 Edition SP0 (Version: 13.0.5016 - Dassault Syst鑝es SolidWorks Corp) HiddenSolidWorks Explorer 2013 SP0 x64 Edition (Version: 21.00.5024 - SolidWorks Corporation) HiddenSolidWorks Flow Simulation 2013 SP0 x64 Edition  (Version: 21.00.5025 - SolidWorks Corporation) HiddenSteam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)Strike Suit Zero (HKLM-x32\...\Strike Suit Zero_is1) (Version:  - )TeraCopy 2.3 beta 2 (HKLM\...\TeraCopy_is1) (Version:  - Code Sector)Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)Unity Web Player (HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\UnityWebPlayer) (Version: 4.5.5f1 - Unity Technologies ApS)Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)VMware Player (HKLM-x32\...\VMware_Player) (Version: 7.0.0 - VMware, Inc)VMware Player (Version: 7.0.0 - VMware, Inc.) HiddenWinDjView 2.0.2 (HKLM\...\WinDjView) (Version: 2.0.2 - Andrew Zhezherun)Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)WinRAR 4.11 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)Wise Care 365 2.95 (HKLM-x32\...\Wise Care 365_is1) (Version: 2.95 - WiseCleaner.com, Inc.)Wolfram Mathematica 8 (M-WIN-L 8.0.1 2063990) (HKLM\...\M-WIN-L 8.0.1 2063990_is1) (Version: 8.0.1 - Wolfram Research, Inc.)酷我音乐 2014 (HKLM-x32\...\KwMusic7) (Version: 7.8.0.1 - 酷我科技)==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)==================== Restore Points  =========================17-01-2015 20:31:04 Windows Update17-01-2015 21:23:51 Removed System Requirements Lab Detection17-01-2015 21:26:00 Removed Google Earth Plug-in.17-01-2015 22:02:04 Checkpoint by HitmanPro17-01-2015 22:03:06 Checkpoint by HitmanPro18-01-2015 00:04:11 Restore Operation==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-14 10:34 - 2009-06-11 05:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {0569B569-4E0C-4D40-9309-FE854BA2950A} - \KwRunAsStdUser Task27846 No Task File <==== ATTENTIONTask: {0A80F745-7C57-4E89-BF0F-C0E00E3D36DE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {147C818E-6462-494E-82A2-821093B383E6} - System32\Tasks\{80AC0CF5-B82A-46BA-8729-3EE01B1D970F} => pcalua.exe -a G:\Redist\vcredist_x86.exe -d G:\RedistTask: {1AE10270-0112-4281-88F6-E3622DB264A1} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2010-11-26] (ASUSTeK Computer Inc.)Task: {38426CA0-275F-4790-B195-A9CBBE2318E9} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3098599808-827696543-3375896687-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exeTask: {43FD6F09-E2C1-41AF-BE28-6B719F593D60} - System32\Tasks\ASUS\USB 3.0 Boost Service => C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr.exe [2011-09-09] ()Task: {50AE1EF3-DF66-41DC-921F-C027B741E91C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3098599808-827696543-3375896687-1000UA => C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-23] (Google Inc.)Task: {50F1198B-D59E-4A4A-8CC1-CB9421F2B9F0} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3098599808-827696543-3375896687-1000Core => C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-23] (Google Inc.)Task: {548991E9-33FF-41CB-8FFC-51552B033C0F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)Task: {79E81314-113A-4203-A206-E665AFE0ADDB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-16] (Google Inc.)Task: {92CD7746-2AE0-490C-8D18-EAE9B864619B} - System32\Tasks\{57DA6B0E-813A-4F23-8580-CE21756B8CD5} => pcalua.exe -a G:\Setup.exe -d G:\Task: {986E073A-D710-4B2E-971A-42E02C0BF642} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-22] (Piriform Ltd)Task: {9B16308B-0BF4-41B1-A6D1-05182D3D22D9} - System32\Tasks\{DE44EDE8-9A03-4857-95E3-415E52E83A08} => pcalua.exe -a "C:\Program Files\COMSOL\COMSOL43\bin\win64\comsoluninstall.exe" -d "C:\Program Files\COMSOL\COMSOL43" -c "C:\Program Files\COMSOL\COMSOL43"Task: {B1D4AF21-3076-4490-B72E-7DC5BA9A7BC3} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvcTask: {BADA80F4-86DC-4187-BD95-15AC52F23AF1} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3098599808-827696543-3375896687-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exeTask: {C3E0906A-E1D8-4A15-ADA3-A02F32A7FE48} - System32\Tasks\{C5141073-18C7-4F89-BD09-EA49E51D96FC} => pcalua.exe -a H:\Setup.exe -d H:\Task: {FFB32600-0CE7-469B-991F-976E712DA062} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-15] (Adobe Systems Incorporated)Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3098599808-827696543-3375896687-1000Core.job => C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3098599808-827696543-3375896687-1000UA.job => C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe==================== Loaded Modules (whitelisted) =============2012-06-04 00:21 - 2012-02-17 20:55 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll2013-03-24 22:57 - 2012-01-29 09:55 - 00657920 _____ () C:\Program Files\TeraCopy\TeraCopy64.dll2012-06-06 23:17 - 2011-10-07 11:34 - 00915584 _____ () C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe2012-06-06 23:17 - 2011-10-07 11:35 - 00586880 _____ () C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe2012-08-30 13:15 - 2013-02-01 11:58 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe2014-11-20 21:23 - 2014-11-20 21:23 - 00102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll2014-11-20 18:44 - 2014-11-20 18:44 - 01299136 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll2015-01-15 12:09 - 2015-01-14 13:02 - 01117512 _____ () C:\Users\user\AppData\Local\Google\Chrome\Application\40.0.2214.85\libglesv2.dll2015-01-15 12:09 - 2015-01-14 13:02 - 00211272 _____ () C:\Users\user\AppData\Local\Google\Chrome\Application\40.0.2214.85\libegl.dll2015-01-15 12:09 - 2015-01-14 13:02 - 09171784 _____ () C:\Users\user\AppData\Local\Google\Chrome\Application\40.0.2214.85\pdf.dll2015-01-15 12:09 - 2015-01-14 13:02 - 14913352 _____ () C:\Users\user\AppData\Local\Google\Chrome\Application\40.0.2214.85\PepperFlash\pepflashplayer.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) =============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== MSCONFIG/TASK MANAGER disabled items =========(Currently there is no automatic fix for this section.)MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SolidWorks 2013 Fast Start.lnk => C:\Windows\pss\SolidWorks 2013 Fast Start.lnk.CommonStartupMSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SolidWorks Background Downloader.lnk => C:\Windows\pss\SolidWorks Background Downloader.lnk.CommonStartupMSCONFIG\startupfolder: C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.StartupMSCONFIG\startupfolder: C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.StartupMSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"MSCONFIG\startupreg: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logonMSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITORMSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorunMSCONFIG\startupreg: F.lux => "C:\Users\user\AppData\Local\FluxSoftware\Flux\flux.exe" /noshowMSCONFIG\startupreg: GarenaPlus => "C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe" -autolaunchMSCONFIG\startupreg: Google Update => "C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe" /cMSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"MSCONFIG\startupreg: IDMan => C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onbootMSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"MSCONFIG\startupreg: QvodTerminal => "C:\Program Files (x86)\QvodPlayer\QvodTerminal.exe" -autorunMSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silentMSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"MSCONFIG\startupreg: TkBellExe => "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot========================= Accounts: ==========================Administrator (S-1-5-21-3098599808-827696543-3375896687-500 - Administrator - Disabled)Guest (S-1-5-21-3098599808-827696543-3375896687-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-3098599808-827696543-3375896687-1003 - Limited - Enabled)user (S-1-5-21-3098599808-827696543-3375896687-1000 - Administrator - Enabled) => C:\Users\user==================== Faulty Device Manager Devices =============Name: bd0001Description: bd0001Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}Manufacturer: Service: bd0001Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.Devices stay in this state if they have been prepared for removal.After you remove the device, this error disappears.Remove the device, and this error should be resolved.Name: bd0004Description: bd0004Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}Manufacturer: Service: bd0004Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.Devices stay in this state if they have been prepared for removal.After you remove the device, this error disappears.Remove the device, and this error should be resolved.==================== Event log errors: =========================Application errors:==================Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000430,SYSTEM\CurrentControlSet\Services\VSS\Diag\VssvcPublisher,0,REG_BINARY,0000000001D1EF50.72).  hr = 0x80070005, Access is denied..Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000324,(null),0,REG_BINARY,000000000366E480.72).  hr = 0x80070005, Access is denied..Operation:   BackupShutdown EventContext:   Execution Context: Writer   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}   Writer Name: System Writer   Writer Instance ID: {080a69ca-ea98-4ac4-b2ea-21fed4fe8c7a}Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x000008ec,(null),0,REG_BINARY,00000000184BDF00.72).  hr = 0x80070005, Access is denied..Operation:   BackupShutdown EventContext:   Execution Context: Writer   Writer Class Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}   Writer Name: WMI Writer   Writer Instance ID: {2a5bc525-390f-4541-a7e4-6428f522badc}Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000f2c,(null),0,REG_BINARY,000000000869E460.72).  hr = 0x80070005, Access is denied..Operation:   BackupShutdown EventContext:   Execution Context: Writer   Writer Class Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}   Writer Name: MSSearch Service Writer   Writer Instance ID: {23e6250b-293f-4c9d-a804-324ea23db97c}Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x000001fc,SYSTEM\CurrentControlSet\Services\VSS\Diag\Shadow Copy Optimization Writer,0,REG_BINARY,000000000196EA70.72).  hr = 0x80070005, Access is denied..Operation:   BackupShutdown EventContext:   Execution Context: Writer   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}   Writer Name: Shadow Copy Optimization Writer   Writer Instance ID: {5fc5b3d5-d22f-4ff3-b293-24042d0492ce}Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x000001bc,SYSTEM\CurrentControlSet\Services\VSS\Diag\Registry Writer,0,REG_BINARY,0000000001D9E930.72).  hr = 0x80070005, Access is denied..Operation:   BackupShutdown EventContext:   Execution Context: Writer   Writer Class Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}   Writer Name: Registry Writer   Writer Instance ID: {ad738b3b-4fa7-42a5-aa13-96623ec3655c}Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x000001c8,SYSTEM\CurrentControlSet\Services\VSS\Diag\COM+ REGDB Writer,0,REG_BINARY,000000000235F010.72).  hr = 0x80070005, Access is denied..Operation:   BackupShutdown EventContext:   Execution Context: Writer   Writer Class Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}   Writer Name: COM+ REGDB Writer   Writer Instance ID: {4a0e7cd3-43e3-4c7b-8fa2-5284996becac}Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000324,(null),0,REG_BINARY,000000000366E480.72).  hr = 0x80070005, Access is denied..Operation:   BackupShutdown EventContext:   Execution Context: Writer   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}   Writer Name: System Writer   Writer Instance ID: {080a69ca-ea98-4ac4-b2ea-21fed4fe8c7a}Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000f2c,(null),0,REG_BINARY,000000000869E460.72).  hr = 0x80070005, Access is denied..Operation:   BackupShutdown EventContext:   Execution Context: Writer   Writer Class Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}   Writer Name: MSSearch Service Writer   Writer Instance ID: {23e6250b-293f-4c9d-a804-324ea23db97c}Error: (01/17/2015 10:03:20 PM) (Source: VSS) (EventID: 8193) (User: )Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x000008ec,(null),0,REG_BINARY,00000000184BDF00.72).  hr = 0x80070005, Access is denied..Operation:   BackupShutdown EventContext:   Execution Context: Writer   Writer Class Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}   Writer Name: WMI Writer   Writer Instance ID: {2a5bc525-390f-4541-a7e4-6428f522badc}System errors:=============Error: (01/18/2015 00:24:08 AM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535Error: (01/18/2015 00:24:08 AM) (Source: Service Control Manager) (EventID: 7023) (User: )Description: The Peer Name Resolution Protocol service terminated with the following error: %%-2140993535Error: (01/18/2015 00:24:08 AM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535Error: (01/18/2015 00:24:08 AM) (Source: Service Control Manager) (EventID: 7023) (User: )Description: The Peer Name Resolution Protocol service terminated with the following error: %%-2140993535Error: (01/18/2015 00:24:08 AM) (Source: PNRPSvc) (EventID: 102) (User: )Description: 0x80630801Error: (01/18/2015 00:24:08 AM) (Source: PNRPSvc) (EventID: 102) (User: )Description: 0x80630801Error: (01/18/2015 00:23:57 AM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535Error: (01/18/2015 00:23:57 AM) (Source: Service Control Manager) (EventID: 7023) (User: )Description: The Peer Name Resolution Protocol service terminated with the following error: %%-2140993535Error: (01/18/2015 00:23:57 AM) (Source: PNRPSvc) (EventID: 102) (User: )Description: 0x80630801Error: (01/18/2015 00:23:34 AM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535Microsoft Office Sessions:============================================= Memory info =========================== Processor: AMD Phenom(tm) II X6 1055T ProcessorPercentage of memory in use: 29%Total physical RAM: 8191.18 MBAvailable physical RAM: 5794.11 MBTotal Pagefile: 16380.53 MBAvailable Pagefile: 13512.34 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.83 MB==================== Drives ================================Drive c: () (Fixed) (Total:292.87 GB) (Free:52.47 GB) NTFSDrive e: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]Drive f: (New Volume) (Fixed) (Total:638.54 GB) (Free:270.59 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 4330A8FB)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=292.9 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=638.5 GB) - (Type=07 NTFS)==================== End Of Log ============================

Thank you.

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted

Hello sheng12, welcome to Malwarebytes' Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. :)
 
General P2P/Piracy Notice: 
 

If you are using Peer to Peer (P2P) filesharing software such as uTorrent, BitTorrent or similar you must either fully uninstall or completely disable the programme(s) from running whilst receiving assistance at this forum. 
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked/keygen or similar software on the computer, please remove/uninstall the software now and read the policy on Piracy. Failure to do so will also result in your topic being closed.

 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

  • Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
  • If you are unable to copy/paste your logs directly into your post, please attach the file. 
  • Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
  • Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.
  • If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
  • Topics are locked if no response is made after 4 days. Please inform me if you will require additional time to complete my instructions.
  • Ensure you are following this topic. Click xetYzdbu.png.pagespeed.ic.U7AjmRUewW.png at the top of the page. 
     

======================================================

 

Please consider the following warning, and proceed with the instructions below.

 

goGMWSt.gifRegistry Cleaner Warning
 
------------------------------
 
I see you have registry cleaner/optimization software (Wise Care 365 2.95) installed on your computer. Registry cleaners and optimization tools that claim to speed up your computer should be avoided, and are potentially dangerous. By running a registry cleaner you risk rendering your machine unbootable. There is no statistical evidence to back claims that cleaning the registry will improve performance. Advertisements to do so are borderline scams intended to goad users into using an unnecessary and potential dangerous product.

  • Some registry cleaners employ aggressive cleaning routines that may cause substantial damage to your system, and could render your machine unbootable.
  • Not all registry cleaners backup the registry. If an issue arises you may not have a backup to rely on.
  • The usefulness of cleaning the registry is disputable; there is no statistical evidence to support the claim that cleaning the registry will improve system performance. 
Please refer to the following article on why you should not use registry cleaner software. I suggest reading why Microsoft does not support the use of registry cleaners as well.

 

STEP 1
6JO0hXH.png Revo Uninstaller

  • Double-click Revo Uninstaller to run the programme. 
  • From the list of programmes, locate the following, or anything similar and carry out the steps below one at a time.
    • 酷我音乐 2014 
  • ​Double-click the programme. 
  • When prompted if you want to uninstall click Yes.
  • Ensure the Moderate option is selected and click Next.
  • The programme uninstaller will run. If prompted again click Yes.
  • Work your way through the uninstaller, ensuring you read each page thoroughly.
  • Note: Ensure you decline offers of additional software if applicable. 
  • Once the built-in uninstaller is finished click Next.
  • Once the programme has searched for leftovers click Next.
  • Check items in bold only in the list and click Delete. You may have to expand folders by clicking the "+" mark.
  • When prompted click Yes, followed by Next.
  • Click Select all, followed by Delete.
  • When prompted click Yes, followed by Next.
  • Once done click Finish.
     

STEP 2
xlK5Hdb.png Farbar Recovery Scan Tool (FRST) Script

  • Press the Windows Key pdKOQKY.png + r on your keyboard at the same time. Type Notepad and click OK.
  • Copy the entire contents of the codebox below and paste into the Notepad document.
    startCreateRestorePoint:HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\MountPoints2: {2d6cde14-2bd2-11e2-b0a0-20cf3084e15e} - G:\setup.exeShellIconOverlayIdentifiers: [FunOverlay] -> {A5662DF9-0C2E-4A56-9FE1-BACFF6966D88} => C:\Users\Public\Fundata\Lucifer.dll (Funshion)C:\Users\Public\FundataBHO-x32: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} ->  No FileBHO-x32: Blog This in Windows Live v2 -> {3adefb8e-b923-35e6-86e2-2b7841f5d2a7} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)BHO-x32: No Name -> {4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA} ->  No FileHandler: kuwo - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0C} -  No FileWinsock: Catalog9 01 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Winsock: Catalog9 02 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Winsock: Catalog9 03 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Winsock: Catalog9 14 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)C:\Users\Public\FunAcceCHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No PathS1 bd0001; system32\DRIVERS\bd0001.sys [X]S1 bd0004; system32\DRIVERS\bd0004.sys [X]S3 NPF; system32\drivers\NPF.sys [X]S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]S3 tsusbhub; system32\drivers\tsusbhub.sys [X]S3 VGPU; System32\drivers\rdvgkmd.sys [X]2015-01-03 13:19 - 2015-01-17 20:23 - 00000000 ____D () C:\Users\user\AppData\Roaming\Zoo2014-12-29 12:43 - 2014-12-29 12:44 - 06354256 _____ (Tonec Inc.) C:\Users\user\Downloads\idman621build16.exe2013-11-20 20:46 - 2013-11-20 20:46 - 0022486 _____ () C:\ProgramData\ie169.icoC:\Users\user\AppData\Local\Temp\avgnt.exeC:\Users\user\AppData\Local\Temp\setuplauncher.exeC:\Users\user\AppData\Local\Temp\sfamcc00001.dllC:\Users\user\AppData\Local\Temp\utt6534.tmp.exeTask: {0569B569-4E0C-4D40-9309-FE854BA2950A} - \KwRunAsStdUser Task27846 No Task File <==== ATTENTIONCMD: ipconfig /flushdnsCMD: netsh winsock reset allCMD: netsh int ipv4 resetCMD: netsh int ipv6 resetEmptyTemp:end
  • Click File, Save As and type fixlist.txt as the File Name.
  • Important: The file must be saved in the same location as FRST64.exe.

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

  • Right-Click FRST64.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Click Fix.
  • A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
     

STEP 3
GfiJrQ9.png Malwarebytes Anti-Malware (MBAM)

  • Open Malwarebytes Anti-Malware and click Update Now.
  • Once updated, click the Settings tab, followed by Detection and Protection and tick Scan for rootkits.
  • Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
  • Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
  • If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  • Upon completion of the scan (or after the reboot), click the History tab.
  • Click Application Logs and double-click the Scan Log.
  • Click Copy to Clipboard and paste the log in your next reply. 
     

STEP 4
9SN2ePL.png ComboFix

  • Note: Please read through these instructions before running ComboFix. 
  • Please download ComboFix and save the file to your Desktop. << Important!
  • Temporarily disable your anti-virus software. For instructions, please refer to the following link.
  • Right-Click ComboFix.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Follow the prompts. 
     
  • Allow ComboFix to complete it's removal routine (please refer to Important Notes:).
  • Upon completion, a log (ComboFix.txt) will be created in the root directory (C:\). Copy the contents of the log and paste in your next reply.
  • Re-enable your anti-virus software.
     

Important Notes:

  • Do NOT mouse click ComboFix's window whilst it is running. This may cause the programme to stall.
  • Do NOT use your computer whilst ComboFix is running.
  • Your Desktop/taskbar may disappear whilst ComboFix is running; this is normal.
     
  • If you get the message Illegal operation attempted on registry key that has been marked for deletion please reboot your computer.
  • ComboFix will disconnect your machine from the Internet as soon as it starts.
  • Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
  • If you are unable to access the Internet after running ComboFix, please reboot your computer. 
     

STEP 5
YARWD1t.png TDSSKiller Scan

  • Please download TDSSKiller and save the file to your Desktop.
  • Right-Click TDSSKiller.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Click Change parameters. Place a checkmark next to:
    • Loaded Modules
    • Detect TDLFS file system
    • Verify file digital signatures
  • Note: If you receive the following message: Extended Monitoring Driver is required, click Reboot now, and continue from here following the reboot.
  • ​Click Start Scan. Do not use the computer during the scan.
  • If objects are found, change the action to skip.
  • Click Continue and close the window.
  • A log will be created and saved to the root directory (usually C:\). Attach the log in your next reply.
     

======================================================
 
STEP 6
pfNZP4A.png Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

  • Did the programme uninstall OK?
  • Fixlog.txt
  • MBAM log
  • ComboFix.txt
  • TDSSKiller log (attached!)
Link to post
Share on other sites
sheng12

sheng12

Posted
  • Author
Posted

Hi Adam, thanks for your prompt response. I will follow the steps tomorrow moring as it is already midnight here.

However, is the removal of  酷我音乐 2014 necessary? Is it related to the funAcce and fundata folder? It is a music software installed by my sister.

Thanks.

Link to post
Share on other sites
sheng12

sheng12

Posted
  • Author
Posted

Hi Adam I have completed the steps successfully. The folder funAcce and fundata are removed without problem. I did skip step 1 by the way.

However after running combofix and restarted the pc again (the normal startup component cannot load after it automatically restart), I noticed that the combofix also removed some component of chrome icon and .js files in user/appdata folder. Will this affect chrome appearance (I cannot recall the default style of chrome)?

 

Fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-01-2015Ran by user at 2015-01-18 12:39:30 Run:1Running from C:\Users\user\DesktopLoaded Profiles: user (Available profiles: user)Boot Mode: Normal==============================================Content of fixlist:*****************startCreateRestorePoint:HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1HKU\S-1-5-21-3098599808-827696543-3375896687-1000\...\MountPoints2: {2d6cde14-2bd2-11e2-b0a0-20cf3084e15e} - G:\setup.exeShellIconOverlayIdentifiers: [FunOverlay] -> {A5662DF9-0C2E-4A56-9FE1-BACFF6966D88} => C:\Users\Public\Fundata\Lucifer.dll (Funshion)C:\Users\Public\FundataBHO-x32: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} ->  No FileBHO-x32: Blog This in Windows Live v2 -> {3adefb8e-b923-35e6-86e2-2b7841f5d2a7} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)BHO-x32: No Name -> {4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA} ->  No FileHandler: kuwo - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0C} -  No FileWinsock: Catalog9 01 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Winsock: Catalog9 02 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Winsock: Catalog9 03 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)Winsock: Catalog9 14 C:\Users\Public\FunAcce\FunAcce.dll [187728] (Funshion Online Technologies Ltd.)C:\Users\Public\FunAcceCHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No PathS1 bd0001; system32\DRIVERS\bd0001.sys [X]S1 bd0004; system32\DRIVERS\bd0004.sys [X]S3 NPF; system32\drivers\NPF.sys [X]S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]S3 tsusbhub; system32\drivers\tsusbhub.sys [X]S3 VGPU; System32\drivers\rdvgkmd.sys [X]2015-01-03 13:19 - 2015-01-17 20:23 - 00000000 ____D () C:\Users\user\AppData\Roaming\Zoo2014-12-29 12:43 - 2014-12-29 12:44 - 06354256 _____ (Tonec Inc.) C:\Users\user\Downloads\idman621build16.exe2013-11-20 20:46 - 2013-11-20 20:46 - 0022486 _____ () C:\ProgramData\ie169.icoC:\Users\user\AppData\Local\Temp\avgnt.exeC:\Users\user\AppData\Local\Temp\setuplauncher.exeC:\Users\user\AppData\Local\Temp\sfamcc00001.dllC:\Users\user\AppData\Local\Temp\utt6534.tmp.exeTask: {0569B569-4E0C-4D40-9309-FE854BA2950A} - \KwRunAsStdUser Task27846 No Task File <==== ATTENTIONCMD: ipconfig /flushdnsCMD: netsh winsock reset allCMD: netsh int ipv4 resetCMD: netsh int ipv6 resetEmptyTemp:end*****************Restore point was successfully created.HKU\S-1-5-21-3098599808-827696543-3375896687-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoLowDiskSpaceChecks => value deleted successfully."HKU\S-1-5-21-3098599808-827696543-3375896687-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d6cde14-2bd2-11e2-b0a0-20cf3084e15e}" => Key deleted successfully.HKCR\CLSID\{2d6cde14-2bd2-11e2-b0a0-20cf3084e15e} => Key not found. "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\FunOverlay" => Key deleted successfully."HKCR\CLSID\{A5662DF9-0C2E-4A56-9FE1-BACFF6966D88}" => Key deleted successfully."C:\Users\Public\Fundata" directory move:C:\Users\Public\Fundata\bot.daw => Moved successfully.C:\Users\Public\Fundata\FunBSS64.dll => Moved successfully.C:\Users\Public\Fundata\FunNest64.dll => Moved successfully.C:\Users\Public\Fundata\FunWorks64.dll => Moved successfully.C:\Users\Public\Fundata\Lucifer.dll => Moved successfully.C:\Users\Public\Fundata\_bot.daw => Moved successfully.Could not move "C:\Users\Public\Fundata" directory. => Scheduled to move on reboot."HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}" => Key deleted successfully.HKCR\Wow6432Node\CLSID\{3049C3E9-B461-4BC5-8870-4C09146192CA} => Key not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3adefb8e-b923-35e6-86e2-2b7841f5d2a7}" => Key deleted successfully."HKCR\Wow6432Node\CLSID\{3adefb8e-b923-35e6-86e2-2b7841f5d2a7}" => Key deleted successfully."HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA}" => Key deleted successfully.HKCR\Wow6432Node\CLSID\{4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA} => Key not found. "HKCR\PROTOCOLS\Handler\kuwo" => Key deleted successfully.HKCR\CLSID\{3050f3DA-98B5-11CF-BB82-00AA00BDCE0C} => Key not found. Winsock: Catalog entry 000000000001 => Deleted successfully.Winsock: Catalog entry 000000000002 => Deleted successfully.Winsock: Catalog entry 000000000003 => Deleted successfully.Winsock: Catalog entry 000000000014 => Deleted successfully."C:\Users\Public\FunAcce" directory move:C:\Users\Public\FunAcce\FunAcce.dll => Moved successfully.Could not move "C:\Users\Public\FunAcce\RepData\20150118.daw" => Scheduled to move on reboot.C:\Users\Public\FunAcce\BaseData\20150118.daw => Moved successfully.Could not move "C:\Users\Public\FunAcce" directory. => Scheduled to move on reboot."HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk" => Key deleted successfully.bd0001 => Service deleted successfully.bd0004 => Service deleted successfully.NPF => Service deleted successfully.Synth3dVsc => Service deleted successfully.tsusbhub => Service deleted successfully.VGPU => Service deleted successfully.C:\Users\user\AppData\Roaming\Zoo => Moved successfully.C:\Users\user\Downloads\idman621build16.exe => Moved successfully.C:\ProgramData\ie169.ico => Moved successfully.C:\Users\user\AppData\Local\Temp\avgnt.exe => Moved successfully.C:\Users\user\AppData\Local\Temp\setuplauncher.exe => Moved successfully.C:\Users\user\AppData\Local\Temp\sfamcc00001.dll => Moved successfully.C:\Users\user\AppData\Local\Temp\utt6534.tmp.exe => Moved successfully."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0569B569-4E0C-4D40-9309-FE854BA2950A}" => Key deleted successfully."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0569B569-4E0C-4D40-9309-FE854BA2950A}" => Key deleted successfully."HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\KwRunAsStdUser Task27846" => Key deleted successfully.=========  ipconfig /flushdns =========Windows IP ConfigurationSuccessfully flushed the DNS Resolver Cache.========= End of CMD: ==================  netsh winsock reset all =========Sucessfully reset the Winsock Catalog.You must restart the computer in order to complete the reset.========= End of CMD: ==================  netsh int ipv4 reset =========Reseting Global, OK!Reseting Interface, OK!Reseting Unicast Address, OK!Restart the computer to complete this action.========= End of CMD: ==================  netsh int ipv6 reset =========Reseting Interface, OK!Restart the computer to complete this action.========= End of CMD: =========EmptyTemp: => Removed 1 GB temporary data.=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-01-18 12:41:57)<=C:\Users\Public\Fundata => Is moved successfully.C:\Users\Public\FunAcce\RepData\20150118.daw => Is moved successfully.C:\Users\Public\FunAcce => Is moved successfully.==== End of Fixlog 12:41:57 ====

Scan log

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 18/1/2015Scan Time: 1:18:38 PMLogfile: Administrator: YesVersion: 2.00.4.1028Malware Database: v2015.01.18.01Rootkit Database: v2015.01.14.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: userScan Type: Threat ScanResult: CompletedObjects Scanned: 351016Time Elapsed: 17 min, 9 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: WarnPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Physical Sectors: 0(No malicious items detected)(end)
Link to post
Share on other sites
sheng12

sheng12

Posted
  • Author
Posted

ComboFix.log

ComboFix 15-01-08.01 - user 1/2015 Sun  13:46:57.1.6 - x64Microsoft Windows 7 Ultimate   6.1.7601.1.936.86.1033.18.8191.6472 [GMT 8:00]Ö´ÐÐλÖÃ: c:\users\user\Desktop\ComboFix.exeAV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..(((((((((((((((((((((((((((((((((((((((   ±»É¾³ýµÄµµ°¸   )))))))))))))))))))))))))))))))))))))))))))))))))..c:\program files (x86)\smartdlc:\program files (x86)\smartdl\gunzip.exec:\program files (x86)\smartdl\status-oc:\programdata\ntuser.polc:\users\user\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_cfajjdadjnjfiaongopenjclfpogiemb_0c:\users\user\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_cfajjdadjnjfiaongopenjclfpogiemb_0\6c:\users\user\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_cfajjdadjnjfiaongopenjclfpogiemb_0\7c:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiembc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\background.htmlc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\crossriderManifest.jsonc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\icons\actions\1.pngc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\icons\icon128.pngc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\icons\icon16.pngc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\icons\icon48.pngc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\api\chrome.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\api\cookie.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\api\message.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\background.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\app_api.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\async_api.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\bg_app_api.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\cookie_store.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\data_store.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\delegate.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\events.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\onBGDocumentLoad.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\reports.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\js\lib\util.jsc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\manifest.jsonc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfajjdadjnjfiaongopenjclfpogiemb\1.20.129_0\popup.htmlc:\users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cfajjdadjnjfiaongopenjclfpogiemb_0.localstoragec:\users\user\AppData\Local\Google\Chrome\User Data\Default\Preferencesc:\users\user\AppData\Roaming\MCommonc:\users\user\AppData\Roaming\MCommon\config.datc:\users\user\AppData\Roaming\MCommon\sites.datc:\users\user\AppData\Roaming\MCommon\uid.datc:\users\user\AppData\Roaming\MCommon\uinfo.datc:\users\user\AppData\Roaming\MCommon\vinfo.datc:\windows\KwYlx.datc:\windows\SysWow64\Packet.dllF:\install.exe..(((((((((((((((((((((((((((((((((((((((   Çý¶¯/·þÎñ   )))))))))))))))))))))))))))))))))))))))))))))))))..-------\Legacy_BD0001-------\Legacy_NPF..(((((((((((((((((((((((((  2014-12-18 ÖÁ 2015-01-18 µÄеĵµ°¸  )))))))))))))))))))))))))))))))..2015-01-18 05:53 . 2015-01-18 05:53	--------	d-----w-	c:\users\Default\AppData\Local\temp2015-01-17 16:45 . 2015-01-18 04:53	--------	d-----w-	C:\FRST2015-01-17 14:22 . 2015-01-17 16:07	--------	d-----w-	c:\program files\Unlocker2015-01-17 13:43 . 2015-01-17 13:43	43664	----a-w-	c:\windows\system32\drivers\hitmanpro37.sys2015-01-17 13:43 . 2015-01-17 13:43	--------	d-----w-	c:\program files\HitmanPro2015-01-17 13:42 . 2015-01-17 14:03	--------	d-----w-	c:\programdata\HitmanPro2015-01-15 04:37 . 2015-01-15 05:36	5013680	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe2015-01-10 13:24 . 2015-01-10 13:24	--------	d-----w-	c:\users\user\AppData\Roaming\AMD2015-01-10 13:14 . 2015-01-17 17:19	--------	d-----w-	c:\users\user\AppData\Local\VMware2015-01-10 13:14 . 2015-01-17 17:01	--------	d-----w-	c:\users\user\AppData\Roaming\VMware2015-01-10 13:12 . 2014-11-17 09:38	68288	----a-w-	c:\windows\system32\vsocklib.dll2015-01-10 13:12 . 2014-11-17 09:38	64192	----a-w-	c:\windows\SysWow64\vsocklib.dll2015-01-10 13:12 . 2014-11-17 09:38	76480	----a-w-	c:\windows\system32\drivers\vsock.sys2015-01-10 13:12 . 2014-11-20 10:44	66752	----a-w-	c:\windows\system32\drivers\vmx86.sys2015-01-10 13:12 . 2014-11-20 10:44	33472	----a-w-	c:\windows\system32\drivers\VMkbd.sys2015-01-10 13:11 . 2014-11-20 10:44	359104	----a-w-	c:\windows\SysWow64\vmnetdhcp.exe2015-01-10 13:11 . 2014-11-20 10:44	438464	----a-w-	c:\windows\SysWow64\vmnat.exe2015-01-10 13:11 . 2014-11-20 10:44	26816	----a-w-	c:\windows\system32\drivers\vmnetuserif.sys2015-01-10 13:11 . 2014-11-20 10:44	931008	----a-w-	c:\windows\system32\vnetlib64.dll2015-01-10 13:11 . 2014-11-18 00:04	55488	----a-w-	c:\windows\system32\drivers\hcmon.sys2015-01-10 13:11 . 2015-01-10 13:11	--------	d-----w-	c:\program files\Common Files\VMware2015-01-10 13:11 . 2015-01-18 05:55	--------	d-----w-	c:\programdata\VMware2015-01-10 13:11 . 2015-01-10 13:11	--------	d-----w-	c:\program files (x86)\VMware2015-01-10 13:11 . 2015-01-10 13:11	--------	d-----w-	c:\program files (x86)\Common Files\VMware2015-01-03 12:21 . 2014-12-02 10:26	11870360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{EDBF63D3-2DEC-4580-AC4E-A712B4D81E66}\mpengine.dll2015-01-01 09:32 . 2015-01-01 09:32	--------	d-----w-	c:\users\user\AppData\Roaming\DataRepair...((((((((((((((((((((((((((((((((((((((((   ÔÚÈý¸öÔÂÄÚ±»Ð޸ĵĵµ°¸   )))))))))))))))))))))))))))))))))))))))))))))))))))).2015-01-18 05:56 . 2012-07-24 10:13	77824	----a-w-	c:\windows\KMSEmulator.exe2015-01-18 05:15 . 2014-10-01 13:01	129752	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys2015-01-17 12:31 . 2012-05-31 08:07	113365784	----a-w-	c:\windows\system32\MRT.exe2015-01-15 05:36 . 2012-07-31 02:09	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl2015-01-15 05:36 . 2012-07-31 02:09	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe2014-11-24 06:04 . 2012-05-31 06:29	275080	------w-	c:\windows\system32\MpSigStub.exe2014-11-21 02:44 . 2014-11-21 02:44	78432	----a-w-	c:\windows\system32\atimpc64.dll2014-11-21 02:44 . 2014-11-21 02:44	78432	----a-w-	c:\windows\system32\amdpcom64.dll2014-11-21 02:44 . 2014-11-21 02:44	71704	----a-w-	c:\windows\SysWow64\atimpc32.dll2014-11-21 02:44 . 2014-11-21 02:44	71704	----a-w-	c:\windows\SysWow64\amdpcom32.dll2014-11-21 02:44 . 2011-04-19 17:21	144328	----a-w-	c:\windows\system32\atiuxp64.dll2014-11-21 02:44 . 2014-11-21 02:44	126848	----a-w-	c:\windows\SysWow64\atiuxpag.dll2014-11-21 02:44 . 2014-09-15 22:31	118096	----a-w-	c:\windows\system32\atiu9p64.dll2014-11-21 02:44 . 2012-04-06 01:09	100032	----a-w-	c:\windows\SysWow64\atiu9pag.dll2014-11-21 02:44 . 2011-04-19 18:07	1348928	----a-w-	c:\windows\system32\aticfx64.dll2014-11-21 02:44 . 2012-04-06 02:21	1127496	----a-w-	c:\windows\SysWow64\aticfx32.dll2014-11-21 02:44 . 2011-04-19 17:49	11076784	----a-w-	c:\windows\system32\atidxx64.dll2014-11-21 02:44 . 2014-11-21 02:44	9401480	----a-w-	c:\windows\SysWow64\atidxx32.dll2014-11-21 02:43 . 2011-04-19 17:30	7558816	----a-w-	c:\windows\SysWow64\atiumdva.dll2014-11-21 02:43 . 2011-04-19 17:38	7077776	----a-w-	c:\windows\SysWow64\atiumdag.dll2014-11-21 02:43 . 2014-09-15 22:31	8379720	----a-w-	c:\windows\system32\atiumd6a.dll2014-11-21 02:43 . 2014-09-15 22:31	8369408	----a-w-	c:\windows\system32\atiumd64.dll2014-11-21 02:41 . 2014-11-21 02:41	294600	----a-w-	c:\windows\system32\drivers\amdacpksd.sys2014-11-21 02:40 . 2014-11-21 02:40	18959360	----a-w-	c:\windows\system32\drivers\atikmdag.sys2014-11-21 02:33 . 2014-11-21 02:33	235008	----a-w-	c:\windows\system32\clinfo.exe2014-11-21 02:33 . 2014-11-21 02:33	98816	----a-w-	c:\windows\system32\OpenVideo64.dll2014-11-21 02:33 . 2014-11-21 02:33	83456	----a-w-	c:\windows\SysWow64\OpenVideo.dll2014-11-21 02:33 . 2014-11-21 02:33	86528	----a-w-	c:\windows\system32\OVDecode64.dll2014-11-21 02:33 . 2014-11-21 02:33	73216	----a-w-	c:\windows\SysWow64\OVDecode.dll2014-11-21 02:33 . 2014-11-21 02:33	47899136	----a-w-	c:\windows\system32\amdocl64.dll2014-11-21 02:32 . 2014-11-21 02:32	40987136	----a-w-	c:\windows\SysWow64\amdocl.dll2014-11-21 02:31 . 2014-11-21 02:31	65024	----a-w-	c:\windows\system32\OpenCL.dll2014-11-21 02:31 . 2014-11-21 02:31	58880	----a-w-	c:\windows\SysWow64\OpenCL.dll2014-11-21 02:24 . 2014-11-21 02:24	28354560	----a-w-	c:\windows\system32\atio6axx.dll2014-11-21 02:19 . 2014-11-21 02:19	23621632	----a-w-	c:\windows\SysWow64\atioglxx.dll2014-11-21 02:19 . 2014-11-21 02:19	49664	----a-w-	c:\windows\system32\amdmmcl6.dll2014-11-21 02:19 . 2014-11-21 02:19	38912	----a-w-	c:\windows\SysWow64\amdmmcl.dll2014-11-21 02:18 . 2014-11-21 02:18	127488	----a-w-	c:\windows\system32\mantle64.dll2014-11-21 02:18 . 2014-11-21 02:18	113664	----a-w-	c:\windows\SysWow64\mantle32.dll2014-11-21 02:18 . 2014-11-21 02:18	5837312	----a-w-	c:\windows\system32\amdmantle64.dll2014-11-21 02:17 . 2014-11-21 02:17	367104	----a-w-	c:\windows\system32\atiapfxx.exe2014-11-21 02:17 . 2014-11-21 02:17	62464	----a-w-	c:\windows\system32\aticalrt64.dll2014-11-21 02:17 . 2014-11-21 02:17	52224	----a-w-	c:\windows\SysWow64\aticalrt.dll2014-11-21 02:16 . 2014-11-21 02:16	55808	----a-w-	c:\windows\system32\aticalcl64.dll2014-11-21 02:16 . 2014-11-21 02:16	49152	----a-w-	c:\windows\SysWow64\aticalcl.dll2014-11-21 02:16 . 2014-11-21 02:16	15716352	----a-w-	c:\windows\system32\aticaldd64.dll2014-11-21 02:16 . 2014-11-21 02:16	14302208	----a-w-	c:\windows\SysWow64\aticaldd.dll2014-11-21 02:15 . 2014-11-21 02:15	4590592	----a-w-	c:\windows\SysWow64\amdmantle32.dll2014-11-21 02:13 . 2014-11-21 02:13	91648	----a-w-	c:\windows\system32\mantleaxl64.dll2014-11-21 02:13 . 2014-11-21 02:13	85504	----a-w-	c:\windows\SysWow64\mantleaxl32.dll2014-11-21 02:12 . 2014-11-21 02:12	31232	----a-w-	c:\windows\system32\atimuixx.dll2014-11-21 02:12 . 2014-09-15 22:03	442368	----a-w-	c:\windows\system32\atidemgy.dll2014-11-21 02:12 . 2014-11-21 02:12	774656	----a-w-	c:\windows\system32\atieclxx.exe2014-11-21 02:12 . 2014-11-21 02:12	244736	----a-w-	c:\windows\system32\atiesrxx.exe2014-11-21 02:12 . 2014-11-21 02:12	190976	----a-w-	c:\windows\system32\atitmm64.dll2014-11-21 02:10 . 2014-11-21 02:10	843776	----a-w-	c:\windows\system32\coinst_14.50.dll2014-11-21 02:09 . 2014-09-15 21:59	1214976	----a-w-	c:\windows\system32\atiadlxx.dll2014-11-21 02:09 . 2014-11-21 02:09	903168	----a-w-	c:\windows\SysWow64\atiadlxy.dll2014-11-21 02:09 . 2014-11-21 02:09	75264	----a-w-	c:\windows\system32\atig6pxx.dll2014-11-21 02:09 . 2014-11-21 02:09	69632	----a-w-	c:\windows\SysWow64\atiglpxx.dll2014-11-21 02:09 . 2014-11-21 02:09	69632	----a-w-	c:\windows\system32\atiglpxx.dll2014-11-21 02:08 . 2014-11-21 02:08	146944	----a-w-	c:\windows\system32\atig6txx.dll2014-11-21 02:08 . 2014-11-21 02:08	133632	----a-w-	c:\windows\SysWow64\atigktxx.dll2014-11-21 02:08 . 2014-11-21 02:08	589312	----a-w-	c:\windows\system32\drivers\atikmpag.sys2014-11-21 02:08 . 2014-11-21 02:08	43520	----a-w-	c:\windows\system32\drivers\ati2erec.dll2014-11-20 22:14 . 2014-10-01 13:00	63704	----a-w-	c:\windows\system32\drivers\mwac.sys2014-11-20 22:14 . 2014-10-01 13:00	93400	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys2014-11-20 22:14 . 2013-07-06 08:24	25816	----a-w-	c:\windows\system32\drivers\mbam.sys2014-11-20 13:36 . 2014-11-20 13:36	51200	----a-w-	c:\windows\system32\kdbsdk64.dll2014-11-20 13:35 . 2014-11-20 13:35	38912	----a-w-	c:\windows\SysWow64\kdbsdk32.dll2014-11-20 10:44 . 2014-11-20 10:44	81088	----a-w-	c:\windows\system32\vmnetbridge.dll2014-11-20 10:44 . 2014-11-20 10:44	49856	----a-w-	c:\windows\system32\vnetinst.dll2014-11-20 10:44 . 2014-11-20 10:44	48832	----a-w-	c:\windows\system32\drivers\vmnetbridge.sys2014-11-20 10:44 . 2014-11-20 10:44	28864	----a-w-	c:\windows\system32\drivers\vmnetadapter.sys2014-11-20 10:44 . 2014-11-20 10:44	27328	----a-w-	c:\windows\system32\drivers\vmnet.sys2014-11-17 09:38 . 2014-11-17 09:38	85584	----a-w-	c:\windows\system32\drivers\vmci.sys2014-11-16 04:05 . 2014-11-16 04:05	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe2014-11-16 04:05 . 2014-11-16 04:05	194048	----a-w-	c:\windows\SysWow64\elshyph.dll2014-11-16 04:05 . 2014-11-16 04:05	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe2014-11-16 04:05 . 2014-11-16 04:05	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll2014-11-16 04:05 . 2014-11-16 04:05	62464	----a-w-	c:\windows\SysWow64\tdc.ocx2014-11-16 04:05 . 2014-11-16 04:05	60416	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll2014-11-16 04:05 . 2014-11-16 04:05	337408	----a-w-	c:\windows\SysWow64\html.iec2014-11-16 04:05 . 2014-11-16 04:05	235008	----a-w-	c:\windows\system32\elshyph.dll2014-11-16 04:05 . 2014-11-16 04:05	1892864	----a-w-	c:\windows\SysWow64\wininet.dll2014-11-16 04:05 . 2014-11-16 04:05	182272	----a-w-	c:\windows\SysWow64\msls31.dll2014-11-16 04:04 . 2014-11-16 04:04	942592	----a-w-	c:\windows\system32\jsIntl.dll2014-11-16 04:04 . 2014-11-16 04:04	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll2014-11-16 04:04 . 2014-11-16 04:04	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe2014-11-16 04:04 . 2014-11-16 04:04	64000	----a-w-	c:\windows\SysWow64\MshtmlDac.dll2014-11-16 04:04 . 2014-11-16 04:04	62464	----a-w-	c:\windows\SysWow64\iesetup.dll2014-11-16 04:04 . 2014-11-16 04:04	620032	----a-w-	c:\windows\SysWow64\jscript9diag.dll2014-11-16 04:04 . 2014-11-16 04:04	501248	----a-w-	c:\windows\SysWow64\vbscript.dll2014-11-16 04:04 . 2014-11-16 04:04	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll2014-11-16 04:04 . 2014-11-16 04:04	47616	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll2014-11-16 04:04 . 2014-11-16 04:04	4298240	----a-w-	c:\windows\SysWow64\jscript9.dll2014-11-16 04:04 . 2014-11-16 04:04	36352	----a-w-	c:\windows\SysWow64\imgutil.dll2014-11-16 04:04 . 2014-11-16 04:04	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb2014-11-16 04:04 . 2014-11-16 04:04	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll2014-11-16 04:04 . 2014-11-16 04:04	2051072	----a-w-	c:\windows\SysWow64\inetcpl.cpl..(((((((((((((((((((((((((((((((((((((   ÖØÒªµÇÈëµã   ))))))))))))))))))))))))))))))))))))))))))))))))))..*×¢Òâ* ¿Õ°×ÓëºÏ·¨È±Ê¡µÇ¼½«²»»á±»ÏÔʾ REGEDIT4.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt1]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2014-08-17 04:09	131480	----a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt2]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2014-08-17 04:09	131480	----a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt3]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2014-08-17 04:09	131480	----a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-11-06 3673728].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-09-16 115048]"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-12-04 702768]"StartCCC"="c:\program files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2014-11-20 767176]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-11-20 1021128].c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SolidWorks Background Downloader.lnk - c:\program files (x86)\Common Files\SolidWorks Installation Manager\BackgroundDownloading\sldBgDwld.exe /launch_from 0 [2013-7-23 2737768].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\SolidWorks 2013 Fast Start.lnk - c:\windows\Installer\{B6B5EA7E-B91F-443D-A958-B0062FB53804}\NewShortcut2_87EDF6C81D0A4B7B84F42FE0C6A9D608.exe [2013-7-23 335872].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]"Userinit"="userinit.exe".[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]"LoadAppInit_DLLs"=1 (0x1).[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]@="".[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]@="".R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]R3 ASUSstpt;ASUS USB 3.0 Boost Storage Driver (Storage Driver);c:\windows\system32\DRIVERS\ASUSstpt.sys;c:\windows\SYSNATIVE\DRIVERS\ASUSstpt.sys [x]R3 ASUSumsc;ASUS USB 3.0 Boost Storage Driver (WDM);c:\windows\system32\DRIVERS\ASUSumsc.sys;c:\windows\SYSNATIVE\DRIVERS\ASUSumsc.sys [x]R3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe;c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [x]R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys;c:\windows\SYSNATIVE\drivers\hitmanpro37.sys [x]R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys;c:\windows\SYSNATIVE\drivers\vsock.sys [x]S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys;c:\windows\SYSNATIVE\DRIVERS\avfwot.sys [x]S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]S2 AMD FUEL Service;AMD FUEL Service;c:\program files\AMD\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [x]S2 AntiVirFirewallService;Avira FireWall;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [x]S2 AntiVirMailService;Avira Mail Protection;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]S2 AntiVirWebService;Avira Web Protection;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]S2 AODDriver4.3;AODDriver4.3;c:\program files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe;c:\program files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [x]S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [x]S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]S2 RemoteSolverDispatcher;Remote Solver for Flow Simulation 2013;c:\program files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\remotesolverdispatcherservice.exe SOFTWARE\SRAC\COSMOS_FloWorks 2013;c:\program files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\remotesolverdispatcherservice.exe SOFTWARE\SRAC\COSMOS_FloWorks 2013 [x]S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [x]S3 ASUSFILTER;ASUSFILTER;SysWow64\drivers\ASUSFILTER.sys;SysWow64\drivers\ASUSFILTER.sys [x]S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys;c:\windows\SYSNATIVE\DRIVERS\avfwim.sys [x]S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]..[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]XLServicePlatform	REG_MULTI_SZ   	XLServicePlatform. ¡®¼Æ»®ÈÎÎñ¡¯ Îļþ¼Ð ÀïµÄÄÚÈÝ.2015-01-18 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-31 05:36].2015-01-18 c:\windows\Tasks\AutoKMS.job- c:\windows\AutoKMS\AutoKMS.exe [2012-07-24 10:14].2015-01-18 c:\windows\Tasks\AutoKMSDaily.job- c:\windows\AutoKMS\AutoKMS.exe [2012-07-24 10:14].2015-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-16 12:36].2015-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-16 12:36].2015-01-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3098599808-827696543-3375896687-1000Core.job- c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-23 14:14].2015-01-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3098599808-827696543-3375896687-1000UA.job- c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-23 14:14]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt1]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2014-08-17 04:10	164760	----a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt2]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2014-08-17 04:10	164760	----a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt3]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2014-08-17 04:10	164760	----a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutorunsDisabled\DropboxExt4]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2014-08-17 04:10	164760	----a-w-	c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-06 10144288].------- ¶øÍâµÄɨÃè -------.uLocal Page = c:\windows\system32\blank.htmmLocal Page = c:\windows\SysWOW64\blank.htmuInternet Settings,ProxyOverride = *.localTCP: DhcpNameServer = 192.168.1.1TCP: Interfaces\{8DA045F1-F476-428D-B575-98019D734C2B}: NameServer = 208.67.222.222,202.188.1.5FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.default\FF - ExtSQL: !HIDDEN! 2012-06-05 18:40; hotfix@mozilla.org; c:\users\user\AppData\Roaming\Mozilla\Firefox\Extensions\MozillaHotfix.- - - - ORPHANS REMOVED - - - -.Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exeHKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]@Denied: (2) (LocalSystem)"{3ADEFB8E-B923-35E6-86E2-2B7841F5D2A7}"=hex:51,66,7a,6c,4c,1d,38,12,e0,f8,cd,   3e,11,f7,88,70,f9,f4,68,38,44,ab,96,b3"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,   2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,   fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,   b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b.[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]@Denied: (2) (LocalSystem)"Timestamp"=hex:f1,59,b6,23,6b,ad,ce,01.[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]@Denied: (2) (LocalSystem)"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,f4,73,94,55,9b,5b,48,9e,ac,fd,\"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,f4,73,94,55,9b,5b,48,9e,ac,fd,\.[HKEY_USERS\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]@Denied: (Full) (Everyone)@Allowed: (Read) (RestrictedCode)"scansk"=hex(0):5e,e4,84,78,50,c3,6c,f1,96,96,54,95,91,7c,a5,e5,6d,a2,a5,7a,31,   fd,71,26,7c,84,d0,07,36,d0,86,f4,d6,7d,85,1c,11,10,7a,b8,00,00,00,00,00,00,\.[HKEY_USERS\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]@Denied: (Full) (Everyone)@Allowed: (Read) (RestrictedCode)"scansk"=hex(0):a6,fd,3f,9b,5d,73,86,c7,67,69,d1,80,19,d8,79,7b,65,4a,19,ee,1a,   d6,aa,4c,fd,88,62,d6,01,0a,46,38,2c,c6,90,c0,f8,e7,ab,d4,00,00,00,00,00,00,\.[HKEY_USERS\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\Wow6432Node\CLSID\{9f944074-1ddc-44be-8d53-54f96a9b14ca}]@Denied: (Full) (Everyone)@Allowed: (Read) (RestrictedCode)"Model"=dword:0000016a"Therad"=dword:00000030"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,   38,95,44,fc,89,1b,fe,41,cf,14,c5,c2,24,c0,98,e9,f1,17,68,3a,92,9c,99,ea,cb,\.[HKEY_USERS\S-1-5-21-3098599808-827696543-3375896687-1000_Classes\Wow6432Node\CLSID\{af264f78-4a30-487a-91b7-291f74570032}]@Denied: (Full) (Everyone)@Allowed: (Read) (RestrictedCode)"Model"=dword:0000011d"Therad"=dword:0000001b"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,   38,95,44,98,f1,45,19,ba,88,5e,0d,95,fb,58,71,24,cc,ee,2f,eb,b1,e3,d1,d7,1a,\.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_257_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_257_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]@Denied: (A 2) (Everyone)@="IFlashBroker6".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_257_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_257_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.16".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_257.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]@Denied: (A 2) (Everyone)@="IFlashBroker6".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]@Denied: (A) (Everyone)"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}".[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]@Denied: (A) (Everyone).[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]"Key"="ActionsPane3""Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd".[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).------------------------ ÆäËûÔËÐнø³Ì ------------------------.c:\program files (x86)\ASUS\AI Suite II\AsRoutineController.exec:\program files (x86)\ASUS\AI Suite II\AI Suite II.exec:\program files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exec:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exec:\program files (x86)\Avira\AntiVir Desktop\avguard.exec:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exec:\windows\SysWOW64\PnkBstrA.exec:\windows\SysWOW64\vmnat.exec:\program files (x86)\VMware\VMware Player\vmware-authd.exec:\windows\SysWOW64\vmnetdhcp.exec:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exec:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe.**************************************************************************.Íê³Éʱ¼ä: 2015-01-18  14:00:54 - µçÄÔÒÑÖØÐÂÆô¶¯ComboFix-quarantined-files.txt  2015-01-18 06:00.Pre-Run: 61,115,338,752 bytes freePost-Run: 59,915,517,952 bytes free.- - End Of File - - 5994D12F58954F41CCA6ABD549D632E5A36C5E4F47E84449FF07ED3517B43A31
Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted

Hello, 
 

I noticed that the combofix also removed some component of chrome icon and .js files in user/appdata folder.

ComboFix removed files/folders associated with a Chrome extension. You shouldn't have any issues with Chrome because of this. 
Let me know if you do. 
 
Please provide an update on your computer after completing the steps below. Are there any outstanding issues?
 
STEP 1
BY4dvz9.png AdwCleaner

  • Please download AdwCleaner and save the file to your Desktop.
  • Right-Click AdwCleaner.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Follow the prompts. 
  • Click Scan. 
  • Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate. 
  • Ensure anything you know to be legitimate does not have a checkmark, and click Clean. 
  • Follow the prompts and allow your computer to reboot. 
  • After rebooting, a log (AdwCleaner[s0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and folder backups are made for items removed using this tool. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 

STEP 2
E3feWj5.png Junkware Removal Tool (JRT)

  • Please download Junkware Removal Tool and save the file to your Desktop.
  • Create a System Restore Point. For instructions, please refer to the following link (W7).
  • Temporarily disable your anti-virus software. For instructions, please refer to the following link.
  • Right-Click JRT.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Follow the prompts and allow the scan to run uninterrupted. 
  • Upon completion, a log (JRT.txt) will open on your desktop.
  • Re-enable your anti-virus software.
  • Copy the contents of JRT.txt and paste in your next reply.
     

STEP 3
GzlsbnV.png ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

  • Please download ESET Online Scan and save the file to your Desktop.
  • Temporarily disable your anti-virus software. For instructions, please refer to the following link.
  • Double-click esetsmartinstaller_enu.exe to run the programme. 
  • Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
  • Agree to the Terms of Use once more and click Start. Allow components to download.
  • Place a checkmark next to Enable detection of potentially unwanted applications.
  • Click Advanced settings. Place a checkmark next to:
    • Scan archives
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • Ensure Remove found threats is unchecked.
  • Click Start.
  • Wait for the scan to finish. Please be patient as this can take some time.
  • Upon completion, click esetListThreats.png. If no threats were found, skip the next two bullet points. 
  • Click esetExport.png and save the file to your Desktop, naming it something such as "MyEsetScan".
  • Push the Back button.
  • Place a checkmark next to xKN1w2nv.png.pagespeed.ic.JWqIaEgZi7.png and click SzOC1p0.png.pagespeed.ce.OWDP45O6oG.png.
  • Re-enable your anti-virus software.
  • Copy the contents of the log and paste in your next reply.
     

======================================================

STEP 4
pfNZP4A.png Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

  • AdwCleaner[s0].txt
  • JRT.txt
  • ESET log
Link to post
Share on other sites
sheng12

sheng12

Posted
  • Author
Posted

As far as I notice, there is no any outstanding issue.

 

AdwCleaner[s0].txt

 

 

# AdwCleaner v4.108 - Report created 19/01/2015 at 21:05:07
# Updated 17/01/2015 by Xplode
# Database : 2015-01-18.1 [Live]
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : user - USER-PC
# Running from : C:\Users\user\Desktop\AdwCleaner.exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
Folder Deleted : C:\ProgramData\baidu
Folder Deleted : C:\ProgramData\QuickSet
Folder Deleted : C:\ProgramData\StarApp
Folder Deleted : C:\ProgramData\WinterSoft
Folder Deleted : C:\ProgramData\9eb18e8454813816
Folder Deleted : C:\Program Files (x86)\baidu
Folder Deleted : C:\Program Files (x86)\Common Files\baidu
Folder Deleted : C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\baidu
Folder Deleted : C:\users\user\AppData\LocalLow\baidu
Folder Deleted : C:\users\user\AppData\Roaming\baidu
Folder Deleted : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj
Folder Deleted : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfmkllfplegemejikoabfpjdaoncphip
File Deleted : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.default\invalidprefs.js
 
***** [ Scheduled Tasks ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{AC329328-7EC4-4C34-B672-0A2B90CB9B00}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\AppDataLow\Software\Baidu
Key Deleted : HKLM\SOFTWARE\PIP
Key Deleted : HKLM\SOFTWARE\SProtector
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v11.0.9600.17420
 
 
-\\ Mozilla Firefox v35.0 (x86 en-US)
 
 
-\\ Google Chrome v
 
 
-\\ Chromium v
 
 
*************************
 
AdwCleaner[R0].txt - [2129 octets] - [19/01/2015 21:01:22]
AdwCleaner[s0].txt - [2043 octets] - [19/01/2015 21:05:07]
 
########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [2103 octets] ##########

 

 
 
 
 
 
JRT.txt
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Ultimate x64
Ran by user on Mon 19/01/2015 at 21:20:30.76
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-3098599808-827696543-3375896687-1000\Software\Microsoft\Internet Explorer\Main\\Start Page
 
 
 
~~~ Registry Keys
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
 
 
~~~ FireFox
 
Successfully deleted the following from C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\vettfgcb.default\prefs.js
 
user_pref("extensions.t6s1.scode", "try{(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>
Emptied folder: C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\vettfgcb.default\minidumps [6 files]
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 19/01/2015 at 21:24:00.66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
Eset log
 
 
C:\AdwCleaner\Quarantine\C\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.default\invalidprefs.js.vir Win32/Adware.MultiPlug.DU application
C:\FRST\Quarantine\C\Users\user\AppData\Local\Temp\utt6534.tmp.exe.xBAD a variant of Win32/Bundled.Toolbar.Ask.E potentially unsafe application
C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application
C:\Program Files (x86)\Steam\steamapps\common\strikesuitzero\pc\main\Binary\steam_api.dll Win32/HackTool.Crack.BQ potentially unsafe application
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Extensions\MozillaHotfix\chrome\content\update.js JS/Adware.Chromex.B application
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.default\prefs.js Win32/Adware.MultiPlug.DU application
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\vettfgcb.default\prefs.js.BAK Win32/Adware.MultiPlug.DU application
C:\Users\user\Desktop\Limbo.PCGame.rar Win32/HackTool.Crack.B potentially unsafe application
C:\Users\user\Desktop\Games Installer\DmC Devil may Cry\Binaries\Win32\steam_api.dll a variant of Win32/HackTool.Crack.BQ potentially unsafe application
C:\Users\user\Desktop\Games Installer\SMCITY\Stop.exe a variant of Win32/HiddenStart.A potentially unsafe application
C:\Users\user\Desktop\warcraft 3\ucw3.dll a variant of Win32/Packed.Themida potentially unwanted application
C:\Users\user\Downloads\ccsetup411.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\user\Downloads\syncios.exe Win32/OpenCandy potentially unsafe application
C:\Users\user\Downloads\Compressed\2368545-thfv14.rar a variant of Win32/HackTool.Crack.CS potentially unsafe application
C:\Users\user\Downloads\Compressed\IDM 6.21 (Full Version).rar Win32/HackTool.Patcher.A potentially unsafe application
C:\Users\user\Downloads\Programs\ccsetup500.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
 
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

1 or more of the following files indicate piracy. Please either remove or provide proof they are not pirated.

C:\Users\user\Desktop\Limbo.PCGame.rar Win32/HackTool.Crack.B potentially unsafe application

C:\Users\user\Desktop\Games Installer\DmC Devil may Cry\Binaries\Win32\steam_api.dll a variant of Win32/HackTool.Crack.BQ potentially unsafe application

C:\Users\user\Downloads\Compressed\2368545-thfv14.rar a variant of Win32/HackTool.Crack.CS potentially unsafe application

C:\Users\user\Downloads\Compressed\IDM 6.21 (Full Version).rar Win32/HackTool.Patcher.A potentially unsafe application

Piracy Policy

Thanks

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted

Hello, 
 
Please reset your browsers. 
 
b8zkrsY.png Browser Reset
 
Instructions on how to backup your Favourites/Bookmarks and other data can be found below.

Proceed with the reset once done.

We now need to update your vulnerable software to reduce the risk of reinfection. 
 
STEP 1
CXrghb6.png Update Outdated Software
Outdated software contain security risks that must be patched. Please download and install the latest version of the programmes below.

STEP 2
EtQetiM.png Remove Outdated Software

  • Press the Windows Key pdKOQKY.png + r on your keyboard at the same time. Type appwiz.cpl and click OK.
  • Search for the following programmes, right-click and click Uninstall one at a time.
  • Note: The programmes below may not be present. If this is the case, please skip to the next step.
    • Java 7 Update 71
    • JavaFX 2.1.1
  • Follow the prompts, and reboot if necessary.
     

STEP 3
zANS9oB.png Disable Java in Your Browser
Due to frequent exploits we recommend you disable Java in your browser.
For information on Java vulnerabilities, please read the following article (point #7).

  • Click the 29Fou9c.jpg Windows Start Button  and type Java Control Panel (or javacpl) in the search bar. 
  • Click on the Java Control Panel. Once opened, click the Security tab.
  • Deselect the check box for Enable Java content in the browser. This will disable the Java plug-in in the browser. 
  • Click Apply. When the AVOiBNU.jpg Windows User Account Control (UAC) appears, allow permissions to make the changes. 
  • Click OK in the Java Plug-in confirmation window.
  • Restart your browser(s) for changes to take effect.
  • More information can be found here and here.
     

STEP 4
oxliOQk.png Security Check

  • Please download SecurityCheck and save the file to your Desktop.
  • Double-click SecurityCheck.exe and follow the onscreen instructions inside the black box.
  • A log (checkup.txt) will automatically open on your Desktop.
  • Copy the contents of the log and paste in your next reply.
     

======================================================
 
STEP 5
pfNZP4A.png Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

  • checkup.txt
  • How is your computer performing? Are there any outstanding issues?
Link to post
Share on other sites
sheng12

sheng12

Posted
  • Author
Posted
 checkup.txt

 

Results of screen317's Security Check version 0.99.95  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Disabled!  

Avira Desktop   

 Antivirus up to date!   

`````````Anti-malware/Other Utilities Check:````````` 

 Java 8 Update 31  

 Java version 32-bit out of Date! 

  Java 64-bit 8 Update 31  

 Adobe Flash Player 16.0.0.257  

 Adobe Reader XI  

 Mozilla Firefox (35.0) 

 Google Chrome (40.0.2214.69) 

 Google Chrome (40.0.2214.85) 

 Google Chrome (plugins...) 

````````Process Check: objlist.exe by Laurent````````  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 0% 

````````````````````End of Log`````````````````````` 

 

 

 

I think there are no outstanding issue.

Link to post
Share on other sites
LiquidTension

LiquidTension

Posted
Posted

Hello, 
 
With that in mind -
 
All Clean!
Congratulations, your computer appears clean!  :)
I no longer see signs of malware on your computer, and feel satisfied that our work here is done. The steps below will remove the tools we have used, and reset any settings changed. I have also provided a list of resources and tools that you may find useful. 
 
My help will always be free. But if you are happy with the help provided, and would like to support my fight against malware and/or buy me a beer, please consider a donation. YSCcjW7.png
 
 
STEP 1
9SN2ePL.png ComboFix Uninstall

  • Press the Windows Key + r on your keyboard at the same time. Type the following text into the Run box:
    ComboFix /Uninstall
  • Click OK.
  • Note: It may appear as if Combofix is installing. This is not the case; the programme is uninstalling. Please do not interrupt the process.
     

STEP 2
AFZxnZc.jpg DelFix

  • Please download DelFix and save the file to your Desktop.
  • Double-click DelFix.exe to run the programme.
  • Place a checkmark next to the following items:
    • Activate UAC
    • Remove disinfection tools
    • Create registry backup
    • Purge system restore
    • Reset system settings
  • Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
 
======================================================
 
I have compiled below a list of resources you may find useful. The articles document information on computer security, common infection vectors and how you can stay safe on the Internet.

The following programmes come highly recommended in the security community.

  • xKsUqI5A.png.pagespeed.ic.vn1Hlvqi8h.jpg AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
  • E8I37RF.pngCryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware. 
  • EG85Vjt.png Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
  • x6YRrgUC.png.pagespeed.ic.HjgFxjvw2Z.jpg Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
  • xjv4nhMJ.png.pagespeed.ic.A5YbWn1eDO.png NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
  • 3O8r9Uq.png Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
  • DgW1XL2.png.pagespeed.ce.v1OlJl_ZAS.png Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
  • xj1OLIec.png.pagespeed.ic.k6hhwopU0q.jpg SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
  • xJEP5iWI.png.pagespeed.ic.4tmM1lM7DQ.png Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

-- Please feel free to ask if you have any questions or concerns on computer security or the programmes above.
 
======================================================
 
Please confirm you have no outstanding issues, and are happy with the state of your computer. Once I have confirmation things are in order, we can wrap things up and I will close this thread. 
 
Thank you for using Malwarebytes.
 
Safe Surfing. :)    
Adam

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.