This topic is locked
When I opened Internet Explorer earlier, it will try to load the homepage for a while before automatically closing it. I managed to solve this using Malwarebytes' Anti-Malware. However, the scan showed 900 over files infected and when I tried to remove all of it, Malwarebytes' Anti-Malware hanged. After that, I removed only the files Malwarebytes' Anti-Malware auto-selected (sorry, I cannot remember all names of the files) and Internet Explorer is working after that.
Now when I use Malwarebytes' Anti-Malware's scan, there are still over 900 files infected, I think the name of the malware is PUP.Optional.QuickShare.A. When I tried to use Chrome now, the homepage turned to Snap.do. Now when I try to launch Microsoft Security Essentials, it says "The file can not be accessed by the system".
Here's the OTL log:
s OTL logfile created on: 11/11/2013 8:30:09 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\User\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.97 Gb Total Physical Memory | 0.48 Gb Available Physical Memory | 16.13% Memory free
4.81 Gb Paging File | 2.55 Gb Available in Paging File | 52.95% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.87 Gb Total Space | 13.85 Gb Free Space | 5.95% Space Free | Partition Type: NTFS
Drive E: | 232.88 Gb Total Space | 5.28 Gb Free Space | 2.27% Space Free | Partition Type: NTFS
Drive F: | 58.59 Gb Total Space | 0.48 Gb Free Space | 0.81% Space Free | Partition Type: NTFS
Drive G: | 174.29 Gb Total Space | 0.14 Gb Free Space | 0.08% Space Free | Partition Type: NTFS
Drive H: | 189.92 Gb Total Space | 6.63 Gb Free Space | 3.49% Space Free | Partition Type: NTFS
Computer Name: USER-8CE73256DD | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013/11/11 20:30:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Desktop\OTL.exe
PRC - [2013/10/31 11:35:46 | 000,070,880 | ---- | M] () -- C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
PRC - [2013/10/24 14:27:22 | 000,191,840 | ---- | M] (PPLive Corporation) -- C:\Program Files\Common Files\PPLiveNetwork\PPAP.exe
PRC - [2013/10/20 11:25:02 | 000,182,696 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2013/10/10 18:39:12 | 001,261,184 | ---- | M] (Shenzhen QVOD Technology Co.,Ltd) -- H:\Program Files\QvodPlayer\QvodTerminal.exe
PRC - [2013/09/10 23:18:16 | 002,476,312 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
PRC - [2013/09/10 23:18:16 | 001,435,928 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
PRC - [2013/07/04 02:52:24 | 001,033,488 | ---- | M] (Youku.com) -- C:\Program Files\YouKu\youkuclient\YoukuDesktop.exe
PRC - [2013/07/04 02:52:14 | 003,885,336 | ---- | M] (Youku.com) -- C:\Program Files\YouKu\youkuclient\YoukuMediaCenter.exe
PRC - [2013/05/29 11:34:28 | 000,449,248 | ---- | M] (Sony) -- C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe
PRC - [2012/10/03 19:29:08 | 004,273,940 | ---- | M] () -- C:\Program Files\gogobox\gogobox_e.exe
PRC - [2012/10/03 19:28:49 | 001,446,016 | ---- | M] (NEXTLiNK Technology Co., Ltd.) -- C:\Program Files\gogobox\gogobox.exe
PRC - [2011/12/11 00:03:31 | 001,525,168 | ---- | M] (土豆网) -- C:\Program Files\Tudou\iTudou\iTudou.exe
PRC - [2010/11/09 11:50:46 | 000,303,104 | ---- | M] () -- C:\Program Files\RaySource\RaySource.exe
PRC - [2010/05/05 04:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe
PRC - [2008/12/31 01:53:48 | 004,993,024 | ---- | M] (FS2YOU) -- C:\Program Files\GridService\peer.exe
PRC - [2008/12/31 01:53:46 | 000,249,856 | ---- | M] (FS2YOU) -- C:\Program Files\GridService\PeerAdapter.exe
PRC - [2008/12/03 18:11:42 | 002,514,744 | ---- | M] (www.BitComet.com) -- C:\Program Files\BitComet\BitComet.exe
PRC - [2008/04/14 11:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/14 11:42:16 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\conime.exe
========== Modules (No Company Name) ==========
MOD - [2013/11/11 05:53:43 | 000,146,464 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll
MOD - [2013/11/08 19:46:14 | 000,180,560 | ---- | M] () -- C:\Program Files\Common Files\PPLiveNetwork\3.4.0.0111\tipsflash.dll
MOD - [2013/11/08 19:44:19 | 000,493,968 | ---- | M] () -- C:\Program Files\Common Files\PPLiveNetwork\3.4.0.0111\tipsclient.dll
MOD - [2013/11/08 19:43:24 | 000,108,960 | ---- | M] () -- C:\Program Files\Common Files\PPLiveNetwork\3.4.0.0111\tipsdone.dll
MOD - [2013/10/31 11:35:46 | 000,070,880 | ---- | M] () -- C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
MOD - [2013/10/24 14:27:46 | 002,310,992 | ---- | M] () -- C:\WINDOWS\system32\shellfire.dll
MOD - [2013/10/24 14:27:08 | 000,568,656 | ---- | M] () -- C:\Program Files\Common Files\PPLiveNetwork\3.4.0.0111\MngModule.dll
MOD - [2013/10/09 16:06:48 | 000,978,944 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\1b7600e7fe5e152f21ba6d79f3c0c3b6\System.Configuration.ni.dll
MOD - [2013/10/09 16:05:01 | 012,434,432 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\02257c6b67db33c194fa3beccf977afb\System.Windows.Forms.ni.dll
MOD - [2013/10/09 14:51:11 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2013/09/26 17:55:04 | 000,137,648 | ---- | M] () -- H:\Program Files\QvodPlayer\NetUtil.dll
MOD - [2013/09/13 10:02:30 | 000,208,896 | ---- | M] () -- C:\Program Files\Sony\Sony PC Companion\MExplorer.dll
MOD - [2013/09/02 18:19:24 | 003,069,568 | ---- | M] () -- H:\Program Files\QvodPlayer\image_hash.dll
MOD - [2013/09/02 18:19:18 | 004,218,288 | ---- | M] () -- H:\Program Files\QvodPlayer\QvodRes.dll
MOD - [2013/09/02 18:19:18 | 000,243,752 | ---- | M] () -- H:\Program Files\QvodPlayer\QvodImageInfo.dll
MOD - [2013/08/20 05:52:10 | 000,991,984 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportMS.dll
MOD - [2013/08/14 19:32:34 | 001,840,640 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\40ea80adb0fbe21bc953ac641f033a04\System.Web.Services.ni.dll
MOD - [2013/08/14 19:29:18 | 005,462,016 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll
MOD - [2013/08/14 19:29:04 | 001,593,344 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll
MOD - [2013/08/14 19:26:20 | 006,616,576 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\5013900c3c0610c88059fcb8f1f4acb4\System.Data.ni.dll
MOD - [2013/08/14 19:25:31 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll
MOD - [2013/07/11 00:27:34 | 011,497,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll
MOD - [2012/10/03 19:29:08 | 004,273,940 | ---- | M] () -- C:\Program Files\gogobox\gogobox_e.exe
MOD - [2012/07/20 13:36:06 | 000,098,304 | ---- | M] () -- H:\Program Files\56ican\SysCMenuEx.dll
MOD - [2012/07/17 10:56:14 | 000,587,776 | ---- | M] () -- C:\Program Files\Sony\Sony PC Companion\PhoneUpdate.dll
MOD - [2012/06/27 15:09:06 | 000,557,056 | ---- | M] () -- C:\Program Files\Trusteer\Rapport\bin\js32.dll
MOD - [2012/04/30 10:57:42 | 000,039,936 | ---- | M] () -- C:\Program Files\Sony\Sony PC Companion\TMonitorAPI.dll
MOD - [2011/07/07 14:54:36 | 000,233,984 | ---- | M] () -- C:\Program Files\Sony\Sony PC Companion\Report.dll
MOD - [2010/11/09 11:51:08 | 000,192,512 | ---- | M] () -- C:\Program Files\RaySource\RoxFileHistoryPlugin.dll
MOD - [2010/11/09 11:50:46 | 000,303,104 | ---- | M] () -- C:\Program Files\RaySource\RaySource.exe
MOD - [2010/11/09 11:50:16 | 000,286,720 | ---- | M] () -- C:\Program Files\RaySource\RoxFileDownloadPlugin.dll
MOD - [2010/11/09 11:49:38 | 000,188,416 | ---- | M] () -- C:\Program Files\RaySource\RoxFileUploadPlugin.dll
MOD - [2010/11/09 11:49:06 | 000,401,408 | ---- | M] () -- C:\Program Files\RaySource\RoxBaseClass.dll
MOD - [2010/03/16 10:53:57 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2010/01/11 15:44:54 | 000,053,248 | ---- | M] () -- C:\Program Files\Sony\Sony PC Companion\VObject.dll
========== Services (SafeList) ==========
SRV - File not found [Auto | Stopped] -- C:\Program Files\Google\Desktop\Install\{2b7fb92b-5d5c-3ba4-2663-1d0a87e81ccc}\ \ \ﯹ๛\{2b7fb92b-5d5c-3ba4-2663-1d0a87e81ccc}\GoogleUpdate.exe < [WARNING: C:\Program Files\Google\Desktop\Install\{2b7fb92b-5d5c-3ba4-2663-1d0a87e81ccc}\ \ \???\{2b7fb92b-5d5c-3ba4-2663-1d0a87e81ccc}\GoogleUpdate.exe <] -- (etadpug)
SRV - [2013/11/10 14:35:30 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/10/24 14:28:14 | 000,478,032 | ---- | M] (PPTV) [Auto | Running] -- C:\WINDOWS\system32\PPTVSvc.dll -- (PPTVService)
SRV - [2013/10/20 11:25:02 | 000,182,696 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/09/10 23:18:16 | 001,435,928 | ---- | M] (Trusteer Ltd.) [Auto | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe -- (RapportMgmtService)
SRV - [2013/08/12 10:12:38 | 000,022,208 | ---- | M] () [Auto | Stopped] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2013/02/04 17:43:22 | 000,155,824 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011/03/16 10:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/05/05 04:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbfake.sys -- (hwusbfake)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2013/11/11 20:22:47 | 000,054,016 | ---- | M] () [Kernel | Boot | Unknown] -- C:\WINDOWS\system32\drivers\mivlvts.sys -- (xyvhgc)
DRV - [2013/09/10 23:18:28 | 000,222,416 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys -- (RapportPG)
DRV - [2013/09/10 23:18:28 | 000,148,688 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys -- (RapportEI)
DRV - [2013/09/10 23:18:28 | 000,097,008 | ---- | M] (Trusteer Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\RapportKELL.sys -- (RapportKELL)
DRV - [2013/08/20 05:52:05 | 000,330,960 | ---- | M] () [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_56758.sys -- (RapportCerberus_56758)
DRV - [2012/12/30 04:59:38 | 000,024,184 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)
DRV - [2012/07/21 19:42:37 | 000,025,200 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2012/07/21 19:42:37 | 000,012,400 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
DRV - [2010/11/09 14:35:30 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\cpuz135_x32.sys -- (cpuz135)
DRV - [2010/10/05 18:11:24 | 006,164,584 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2010/09/09 15:13:02 | 000,234,728 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2010/07/29 00:25:42 | 000,025,112 | ---- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ivusb.sys -- (ivusb)
DRV - [2010/05/17 17:11:22 | 000,006,272 | ---- | M] (BIOSTAR Group) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\BS_I2cIo.sys -- (BS_I2cIo)
DRV - [2009/11/18 07:17:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2009/11/18 07:16:00 | 001,691,480 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2009/04/08 03:32:48 | 000,116,224 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2008/04/14 08:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2005/03/16 14:23:54 | 000,013,696 | R--- | M] (BIOSTAR Group) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\BIOS.sys -- (BIOS)
DRV - [2001/08/23 20:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [1996/04/04 03:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {F7AF02FD-F5FE-4175-AE15-A0E004D02D4E}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...Date=11/11/2013
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{F7AF02FD-F5FE-4175-AE15-A0E004D02D4E}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...Date=11/11/2013
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...Date=11/11/2013
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.soccernet.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...Date=11/11/2013
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...Date=11/11/2013
IE - HKCU\..\SearchScopes,DefaultScope = {F7AF02FD-F5FE-4175-AE15-A0E004D02D4E}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...Date=11/11/2013
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{F7AF02FD-F5FE-4175-AE15-A0E004D02D4E}: "URL" = http://www.google.co...1I7NDKB_enSG548
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdyy: H:\Program Files\Baidu\BaiduPlayer\1.17.0.172\npxbdyy.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pptv.com/plugin: C:\Program Files\Internet Explorer\PPLite\plugin\3.4.0.0111\npplugin2.dll (PPLive Corporation)
FF - HKLM\Software\MozillaPlugins\@qq.com/QQlive: C:\Program Files\Tencent\QQLive\LiveOcx\npQQLive.dll File not found
FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodInsert: H:\Program Files\QvodPlayer\npQvodInsert.dll (Shenzhen QVOD Technology Co.,Ltd)
FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodShare: H:\Program Files\QvodPlayer\npShareModule.dll (Shenzhen QVOD Technology Co.,Ltd)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.46: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@sohu.com/npifox: H:\Program Files\搜狐影音\npifox.dll ()
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@www.56.com/56icanplugin: H:\Program Files\56ican\np56icanplugin.dll (www.56.com)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@qvod.com/QvodInsert: H:\Program Files\QvodPlayer\npQvodInsert.dll (Shenzhen QVOD Technology Co.,Ltd)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\User\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\KuaiWanInsert: H:\Program Files\QvodPlayer\AddIn\KWWebgame\npKWWebGame.dll (Shenzhen QVOD Technology Co.,Ltd)
========== Chrome ==========
CHR - default_search_provider: Web (Enabled)
CHR - default_search_provider: search_url = http://feed.snapdo.c...Date=11/11/2013
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms},
CHR - homepage: http://feed.snapdo.c...Date=11/11/2013
CHR - plugin: First user (Enabled) = H:\Program Files\鎼滅嫄褰遍煶\npifox.dll
CHR - plugin: Error reading preferences file
CHR - Extension: Snap.Do = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0\
CHR - Extension: Google Docs = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Google Wallet = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\
CHR - Extension: Gmail = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2013/07/23 06:38:58 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll (BitComet)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D297} - H:\Program Files\QvodPlayer\QvodExtend\5.0.97.0\QvodExtend.dll (Shenzhen QVOD Technology Co.,Ltd)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll File not found
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [994534e] C:\Documents and Settings\All Users\Documents\My Music\6b12d9994\6b12d9994.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QvodTerminal] H:\Program Files\QvodPlayer\QvodTerminal.exe (Shenzhen QVOD Technology Co.,Ltd)
O4 - HKCU..\Run: [494bec] C:\Documents and Settings\User\Application Data\278c5f494\278c5f494.exe ()
O4 - HKCU..\Run: [Browser Infrastructure Helper] C:\Documents and Settings\User\Local Settings\Application Data\Smartbar\Application\SnapDo.exe ()
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\User\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [Google Update] Reg Error: Value error. File not found
O4 - HKCU..\Run: [Grid Service] C:\Program Files\GridService\peer.exe (FS2YOU)
O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background File not found
O4 - HKCU..\Run: [PPAP] C:\Program Files\Common Files\PPLiveNetwork\PPAP.exe (PPLive Corporation)
O4 - HKCU..\Run: [Sony PC Companion] C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe (Sony)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &使用FLVCD获取本页视频的下载地址 - C:\Documents and Settings\User\Application Data\flvcd\flvcd_link.htm ()
O8 - Extra context menu item: &使用FLVCD获取该视频的下载地址 - C:\Documents and Settings\User\Application Data\flvcd\flvcd_href.htm ()
O8 - Extra context menu item: Download with Mipony - H:\Program Files\MiPony\Browser\IEContext.htm ()
O8 - Extra context menu item: 使用快播按图找片 - H:\Program Files\QvodPlayer\AddIn\ImgSeed.htm ()
O8 - Extra context menu item: 收藏到搜狐影音 - Reg Error: Value error. File not found
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPTV\PPLive.exe (PPLive Corporation)
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPTV\PPLive.exe (PPLive Corporation)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll (BitComet)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\YouKu\youkuclient\ikutm.dll (youku.com)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\YouKu\youkuclient\ikutm.dll (youku.com)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Program Files\YouKu\youkuclient\ikutm.dll (youku.com)
O15 - HKLM\..Trusted Domains: gogobox.com.tw ([]gb2 in Trusted sites)
O15 - HKLM\..Trusted Domains: gogobox.com.tw ([]http in Trusted sites)
O16 - DPF: {1DABF8D5-8430-4985-9B7F-A30E53D709B3} http://dl_dir.qq.com...MMInstaller.cab (InstallHelper Class)
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bit...m/qsax/qsax.cab (Bitdefender QuickScan Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.45.2)
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} http://ax.emsisoft.c...oft_webscan.cab (Emsisoft Web Malware Scan)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.45.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.ad...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 202.156.1.16 218.186.2.16 218.186.2.6
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{84BB2E11-9558-430C-8909-EDB3C4C1FB8B}: DhcpNameServer = 202.156.1.16 218.186.2.16 218.186.2.6
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{99500004-75DD-4DC2-A969-0129C59083B3}: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/01/07 07:24:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2013/06/15 09:36:56 | 001,029,537 | ---- | M] () - H:\AutoClick.rar -- [ NTFS ]
O33 - MountPoints2\{1af53b09-c268-11e0-8308-003067a72b32}\Shell - "" = AutoRun
O33 - MountPoints2\{1af53b09-c268-11e0-8308-003067a72b32}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1af53b09-c268-11e0-8308-003067a72b32}\Shell\AutoRun\command - "" = I:\Startme.exe
O33 - MountPoints2\{92e934f0-19ef-11e0-9bf7-00138f9363a1}\Shell - "" = AutoRun
O33 - MountPoints2\{92e934f0-19ef-11e0-9bf7-00138f9363a1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{92e934f0-19ef-11e0-9bf7-00138f9363a1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{b9d0d698-19ec-11e0-9bf6-bfec7e776b98}\Shell - "" = AutoRun
O33 - MountPoints2\{b9d0d698-19ec-11e0-9bf6-bfec7e776b98}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b9d0d698-19ec-11e0-9bf6-bfec7e776b98}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{b9d0d69e-19ec-11e0-9bf6-bfec7e776b98}\Shell - "" = AutoRun
O33 - MountPoints2\{b9d0d69e-19ec-11e0-9bf6-bfec7e776b98}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b9d0d69e-19ec-11e0-9bf6-bfec7e776b98}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{d4b6eaa5-0add-11e2-869a-003067a72b32}\Shell - "" = AutoRun
O33 - MountPoints2\{d4b6eaa5-0add-11e2-869a-003067a72b32}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d4b6eaa5-0add-11e2-869a-003067a72b32}\Shell\AutoRun\command - "" = I:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013/11/11 20:30:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\User\Desktop\OTL.exe
[2013/11/11 19:45:51 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2013/11/11 05:54:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\systweak
[2013/11/11 05:53:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\Smartbar
[2013/11/11 00:03:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Real
[2013/11/11 00:03:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
[2013/11/10 22:56:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2013/11/10 22:56:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2013/11/10 22:49:46 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\User\Application Data\278c5f494
[2013/11/10 14:00:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\InstallMate
[2013/11/08 19:46:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\.android
[2013/11/08 19:46:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Wandoujia2
[2013/11/05 20:19:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\Downloads
[2013/11/01 06:01:27 | 000,000,000 | ---D | C] -- C:\King of Lan Ling
[2013/10/30 21:30:24 | 000,000,000 | ---D | C] -- C:\Love of Seven Fairy Maidens
[2013/10/30 21:29:16 | 000,000,000 | ---D | C] -- C:\十二生肖传奇
[2013/10/24 14:28:14 | 000,478,032 | ---- | C] (PPTV) -- C:\WINDOWS\System32\PPTVSvc.dll
[2013/10/24 14:28:12 | 000,399,824 | ---- | C] (PPLive Corporation) -- C:\WINDOWS\System32\PPTVLauncher.exe
[2013/10/20 11:25:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2013/10/20 11:25:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Java
[2013/10/16 22:00:50 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Device
[2013/10/16 22:00:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\baiduAddr
[2013/10/16 22:00:45 | 000,000,000 | ---D | C] -- C:\Program Files\Baidu
[2013/10/16 22:00:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\快播软件
[2013/10/16 22:00:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\KuaiWan
[2013/10/16 21:59:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\QvodPlayer
========== Files - Modified Within 30 Days ==========
[2013/11/11 20:30:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Desktop\OTL.exe
[2013/11/11 20:28:01 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/11/11 20:22:47 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\mivlvts.sys
[2013/11/11 20:22:00 | 000,000,536 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/11/11 20:18:14 | 000,000,002 | ---- | M] () -- C:\ylog.dxq
[2013/11/11 19:48:04 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/11/11 19:47:50 | 000,000,878 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/11/11 19:47:41 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/11/11 18:26:01 | 000,000,994 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-343818398-179605362-1801674531-1003UA.job
[2013/11/11 06:26:00 | 000,000,972 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-343818398-179605362-1801674531-1003Core.job
[2013/11/11 06:13:03 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/11/11 05:54:09 | 000,002,073 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Search.lnk
[2013/11/11 05:50:44 | 000,248,578 | ---- | M] () -- C:\Documents and Settings\User\UTS.exe
[2013/11/10 22:00:44 | 000,000,216 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Football Manager 2014.url
[2013/11/10 20:32:27 | 000,216,064 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/11/10 17:01:34 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/11/10 13:15:27 | 000,000,138 | ---- | M] () -- C:\WINDOWS\vsfilter.INI
[2013/11/09 08:23:37 | 000,165,912 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/11/08 20:00:53 | 000,000,149 | ---- | M] () -- C:\WINDOWS\phw.ini
[2013/11/06 05:52:15 | 000,001,739 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Sony PC Companion 2.1.lnk
[2013/11/05 07:55:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/10/27 09:27:56 | 000,000,954 | ---- | M] () -- C:\Documents and Settings\User\Application Data\coreavc.ini
[2013/10/24 14:28:14 | 000,478,032 | ---- | M] (PPTV) -- C:\WINDOWS\System32\PPTVSvc.dll
[2013/10/24 14:28:12 | 000,399,824 | ---- | M] (PPLive Corporation) -- C:\WINDOWS\System32\PPTVLauncher.exe
[2013/10/24 14:27:46 | 002,310,992 | ---- | M] () -- C:\WINDOWS\System32\shellfire.dll
[2013/10/21 21:36:12 | 000,000,004 | ---- | M] () -- C:\authres.html
[2013/10/18 20:32:06 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/10/16 22:00:40 | 000,000,684 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\快播.lnk
========== Files Created - No Company Name ==========
[2013/11/11 20:22:47 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\mivlvts.sys
[2013/11/11 20:18:14 | 000,000,002 | ---- | C] () -- C:\ylog.dxq
[2013/11/11 05:54:46 | 000,017,280 | ---- | C] () -- C:\WINDOWS\System32\roboot.exe
[2013/11/11 05:54:09 | 000,002,073 | ---- | C] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Search.lnk
[2013/11/11 05:50:40 | 000,248,578 | ---- | C] () -- C:\Documents and Settings\User\UTS.exe
[2013/11/10 22:00:43 | 000,000,216 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Football Manager 2014.url
[2013/10/24 14:27:46 | 002,310,992 | ---- | C] () -- C:\WINDOWS\System32\shellfire.dll
[2013/10/16 22:00:40 | 000,000,684 | ---- | C] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\快播.lnk
[2013/09/22 21:31:15 | 000,000,149 | ---- | C] () -- C:\WINDOWS\phw.ini
[2013/06/14 23:52:56 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\fusioncache.dat
[2012/11/30 06:28:11 | 000,000,305 | ---- | C] () -- C:\WINDOWS\System32\bdsecushr.dat
[2012/10/07 14:08:32 | 000,000,138 | ---- | C] () -- C:\WINDOWS\vsfilter.INI
[2012/10/07 14:08:25 | 000,000,954 | ---- | C] () -- C:\Documents and Settings\User\Application Data\coreavc.ini
[2012/02/16 12:48:37 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/02/23 17:13:02 | 000,601,390 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-343818398-179605362-1801674531-1003-0.dat
[2011/02/23 17:13:01 | 000,140,758 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/01/07 12:32:53 | 000,216,064 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
========== ZeroAccess Check ==========
[2011/01/07 12:29:56 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[2013/11/11 05:48:54 | 000,005,632 | -HS- | M] () -- C:\WINDOWS\assembly\GAC\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 11:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 20:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 11:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2013/04/17 22:09:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AlawarEntertainment
[2011/01/07 07:39:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2013/01/20 21:42:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Application Data
[2011/01/11 12:38:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Awem
[2012/10/07 14:05:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Baidu
[2013/11/11 18:11:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2013/07/07 01:52:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grid
[2013/11/10 14:00:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallMate
[2013/01/20 21:48:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Jlcm
[2011/01/07 07:41:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kingsoft
[2013/10/16 22:00:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\KuaiWan
[2012/04/27 21:43:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2011/02/08 15:11:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NatGeoGames
[2011/02/02 13:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst
[2013/11/08 19:42:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PPLive
[2012/03/09 05:50:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony
[2011/02/19 14:31:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sports Interactive
[2013/04/18 10:06:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2013/07/07 19:38:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Trusteer
[2013/11/10 22:49:46 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\User\Application Data\278c5f494
[2013/04/17 22:09:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\AlawarEntertainment
[2012/04/27 21:37:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Anarchy
[2011/10/20 07:27:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Awem
[2012/10/07 14:06:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Baidu
[2013/10/17 22:19:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\baiduAddr
[2011/01/20 13:20:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\BlamGames
[2013/03/23 11:43:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Building the Great Wall of China
[2012/07/26 09:26:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\CometPlayer
[2011/01/09 02:32:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\DAEMON Tools Pro
[2011/09/09 23:38:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\dekovir
[2013/08/22 20:19:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\flvcd
[2012/06/08 17:00:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\FMRTEv5
[2011/02/02 12:58:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Go-Go Gourmet Chef of the Year
[2013/04/16 23:32:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Happy Kingdom
[2013/07/22 23:13:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\HipSoft
[2011/01/09 02:33:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\IObit
[2011/01/07 07:41:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Kingsoft
[2012/09/28 22:06:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mipony
[2011/02/08 15:11:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\NatGeoGames
[2011/02/02 13:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\PlayFirst
[2013/02/02 18:13:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\PPlive
[2013/11/09 08:23:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\PPStream
[2013/09/22 21:12:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\PPStreamSetup
[2013/07/05 22:27:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\QuickScan
[2011/08/09 20:42:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Sony
[2011/02/19 14:30:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Sports Interactive
[2011/01/08 15:38:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Supermarket Mania 2
[2013/11/11 05:57:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\systweak
[2013/11/10 18:01:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\tigerplayer
[2013/11/08 19:46:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Wandoujia2
[2013/09/11 20:51:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\youku
========== Purity Check ==========
========== Files - Unicode (All) ==========
[2012/08/09 09:57:41 | 000,000,000 | ---D | M](C:\Program Files\??êó) -- C:\Program Files\˶Êó
[2012/08/09 09:57:41 | 000,000,000 | ---D | M](C:\Program Files\??êó) -- C:\Program Files\˶Êó
(C:\Program Files\??êó) -- C:\Program Files\˶Êó
========== Alternate Data Streams ==========
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CC386FD2
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:63C68F03
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38D2EA83
< End of report >
I suspect the malware is not totally cleared. Can it be totally removed from my system?
Thank you.
Sign In
Create Account
