This topic is locked
My Laptop is infected by Hohosearch and Tencent\QQPCMgr Virus. Laptop is now so slow. The virus is deleting my documents. Despite these icons appearing on the control panel programs, I cannot find them when I click uninstall. Duplicate programs appear on the destop with a $ like sign. . Im using Win 8.1. Please help
FIRST TEXT
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:19-05-2016
Ran by oliver (administrator) on TOSHIBA (20-05-2016 12:31:18)
Running from C:\Users\oliver\Downloads
Loaded Profiles: oliver (Available Profiles: oliver & Administrator)
Platform: Windows 8.1 Single Language (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Program Files (x86)\Weness\Application\chrome.exe" "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCRTP.exe
(Windows ® Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(tsvr.com) C:\Users\oliver\AppData\Roaming\TSv\TSvr.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(Toshiba Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe
(TODO: <Company name>) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
() C:\ProgramData\Weness\Weness.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Smadsoft) C:\Program Files (x86)\SMADAV\SMΔRTP.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCTray.exe
(BitTorrent Inc.) C:\Users\oliver\AppData\Roaming\uTorrent\uTorrent.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
() C:\Program Files (x86)\3G Voice Modem\HSPALauncher.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(BitTorrent Inc.) C:\Users\oliver\AppData\Roaming\uTorrent\updates\3.4.7_42330\utorrentie.exe
(BitTorrent Inc.) C:\Users\oliver\AppData\Roaming\uTorrent\updates\3.4.7_42330\utorrentie.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Google Inc.) C:\Program Files (x86)\Weness\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Weness\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Weness\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Weness\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Weness\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Weness\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Weness\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296520 2013-09-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [HSDPALauncher] => C:\Program Files (x86)\3G Voice Modem\HSPALauncher.exe [233472 2012-02-22] ()
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792 2013-01-17] (Research In Motion Limited)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1085656 2015-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ic-0.9d8fbedaf301b8.exe -start] => C:\Users\oliver\AppData\Local\Temp\113257328\ic-0.9d8fbedaf301b8.exe -start <===== ATTENTION
HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCTRAY.EXE [362304 2016-05-13] (Tencent)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\Run: [uTorrent] => C:\Users\oliver\AppData\Roaming\uTorrent\uTorrent.exe [2133504 2016-05-17] (BitTorrent Inc.)
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {19471a77-b763-11e3-8259-a4db30eaa69f} - "E:\autorun.exe"
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {19471aa6-b763-11e3-8259-a4db30eaa69f} - "F:\autorun.exe"
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {19471c18-b763-11e3-8259-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {19471d04-b763-11e3-8259-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {207c0123-c1a6-11e3-825e-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {207c0976-c1a6-11e3-825e-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {63fe9841-0c39-11e5-8264-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {63fe9936-0c39-11e5-8264-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {b09f42fb-8162-11e4-825f-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {cd6cbf1e-6786-11e4-825f-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {e6d772f0-fa56-11e4-8261-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 168.210.2.2 196.14.239.2
Tcpip\..\Interfaces\{290EC7AD-1445-480D-A04F-A1F7C70EF173}: [DhcpNameServer] 168.210.2.2 196.14.239.2
Tcpip\..\Interfaces\{2DE2FEA3-6B46-4870-967F-A3D0A56DA5D4}: [DhcpNameServer] 192.168.42.129
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.2345.com/?34838
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.2345.com/?34838
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGOUcyNt0DW4u3xua6OEIjxXE6rj78xewePDXA8skQ6and42-Vc4VE3AlAbL71lTa9DdzBDQY7y1qKslq3sKhvnivVDWMqska49aCk79TNgmTbBZjRBYQRI4G864z3a1c5JnWVBdzXBchgF0KfJYVWYXpd4q4qsyNKozaxxBeg,,&q={searchTerms}
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TEJB
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.toshibamea.com
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.toshibamea.com
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGOUcyNt0DW4u3xua6OEIjxXE6rj78xewePDXA8skQ6and42-Vc4VE3AlAbL71lTa9DdzBDQY7y1qKslq3sKhvnivVDWMqska49aCk79TNgmTbBZjRBYQRI4G864z3a1c5JnWVBdzXBchgF0KfJYVWYXpd4q4qsyNKozaxxBeg,,&q={searchTerms}
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGOUcyNt0DW4u3xua6OEIjxXE6rj78xewePDXA8skQ6and42-Vc4VE3AlAbL71lTa9DdzBDQY7y1qKslq3sKhvnivVDWMqska49aCk79TNgmTbBZjRBYQRI4G864z3a1c5JnWVBdzXBchgF0KfJYVWYXpd4q4qsyNKozaxxBeg,,&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGOUcyNt0DW4u3xua6OEIjxXE6rj78xewePDXA8skQ6and42-Vc4VE3AlAbL71lTa9DdzBDQY7y1qKslq3sKhvnivVDWMqska49aCk79TNgmTbBZjRBYQRI4G864z3a1c5JnWVBdzXBchgF0KfJYVWYXpd4q4qsyNKozaxxBeg,,&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2472899907-1604452211-935407213-1001 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGOUcyNt0DW4u3xua6OEIjxXE6rj78xewePDXA8skQ6and42-Vc4VE3AlAbL71lTa9DdzBDQY7y1qKslq3sKhvnivVDWMqska49aCk79TNgmTbBZjRBYQRI4G864z3a1c5JnWVBdzXBchgF0KfJYVWYXpd4q4qsyNKozaxxBeg,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2472899907-1604452211-935407213-1001 -> {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGOUcyNt0DW4u3xua6OEIjxXE6rj78xewePDXA8skQ6and42-Vc4VE3AlAbL71lTa9DdzBDQY7y1qKslq3sKhvnivVDWMqska49aCk79TNgmTbBZjRBYQRI4G864z3a1c5JnWVBdzXBchgF0KfJYVWYXpd4q4qsyNKozaxxBeg,,&q={searchTerms}
BHO: 电脑管家网页防火墙 -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TSWebMon64.dat [2016-05-13] (Tencent)
BHO-x32: Ó¦Óñ¦Ò»¼ü°²×°²å¼þ -> {50F4150A-48B2-417A-BE4C-C83F580FB904} -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3192\npQQPhoneManagerExt.dll [2014-05-30] (腾讯公司)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default
FF NewTab: hxxp://www.hohosearch.com/?ts=AHEqAn4rB38sC0..&v=20160513&uid=D65811CD2053B48C3A5F6FABEFC539D4&ptid=ftp&mode=loadm
FF DefaultSearchEngine: hohosearch
FF DefaultSearchEngine.US: data:text/plain,browser.search.defaultenginename.US=hohosearch
FF SelectedSearchEngine: hohosearch
FF Homepage: hxxp://www.hohosearch.com/?ts=AHEqAn4rB38sC0..&v=20160513&uid=D65811CD2053B48C3A5F6FABEFC539D4&ptid=ftp&mode=loadm
FF Keyword.URL: hxxp://www.hohosearch.com/chrome.php?uid=D65811CD2053B48C3A5F6FABEFC539D4&ptid=ftp&ts=AHEqAn4rB38sC0..&v=20160513&mode=ffexttoolbar&q=
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3192\npQQPhoneManagerExt.dll [2014-05-30] (腾讯公司)
FF Plugin-x32: @qq.com/QQPCMgr -> C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\npQMExtensionsMozilla.dll [2016-05-13] (Tencent Technology (Shenzhen) Company Limited)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2012-12-13] ()
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-03-17] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-07-13] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\searchplugins\isdnex4i.xml [2016-05-13]
FF Extension: GsearchFinder - C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\Extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi [2016-05-13]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [312448 2013-08-22] (Windows ® Win 7 DDK provider) [File not signed]
R3 Blackberry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited) [File not signed]
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [235008 2013-07-16] (TODO: <Company name>) [File not signed]
R2 IhPul; C:\Users\oliver\AppData\Roaming\TSv\TSvr.exe [376592 2016-05-17] (tsvr.com)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [279488 2016-01-25] (McAfee, Inc.)
R2 QQPCRTP; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCRTP.exe [313936 2016-05-13] (Tencent)
U2 QQRepair394; C:\Program Files (x86)\Tencent\QQPCMGR\QQRepair394 [147176 2016-05-19] ()
S2 QQRepairFixSVC; C:\Program Files (x86)\Tencent\QQPCMGR\QQRepairFixSVC [147176 2016-05-20] ()
S4 THAccelSvc; C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [216976 2013-07-16] (TOSHIBA CORPORATION)
S2 twsHlpSrv; C:\Program Files (x86)\Tawesh\twsHlpSrv.exe [984232 2016-05-12] ()
R2 VMCService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [14336 2008-07-04] (Vodafone) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
R2 WenessP; C:\ProgramData\Weness\Weness.exe [365440 2016-05-18] ()
S2 WenessU; C:\Program Files (x86)\Weness\Update\WenessUpdate.exe [490880 2016-05-18] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
S2 CloudPrinter; C:\ProgramData\\CloudPrinter\\CloudPrinter.exe shuz -f "C:\ProgramData\\CloudPrinter\\CloudPrinter.dat" -l -a
S2 didedobyzbt; C:\Program Files (x86)\20668AF2-1463173963-E311-AB28-008CFA7E37CB\knsx3D97.tmpfs [X]
S2 dowidoly; C:\Program Files (x86)\20668AF2-1463173963-E311-AB28-008CFA7E37CB\jnsd6559.tmp [X]
S2 GooCorporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [351656 2016-01-29] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70600 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [847608 2016-01-29] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R1 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMUdisk64.sys [184952 2016-05-18] (Tencent)
R2 QQSysMonX64; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQSysMonX64.sys [154744 2016-05-13] (电脑管家)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [78336 2013-01-03] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2014-08-06] (Synaptics Incorporated)
R1 softaal; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\softaal64.sys [44664 2016-05-13] (Tencent)
R1 SRepairDrv; \??\C:\Program Files (x86)\Tencent\QQPCMGR\SRepairDrv [179320 2016-05-20] ()
R3 TAOAccelerator; C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys [99480 2016-05-13] (Tencent)
R2 TAOKernelDriver; C:\WINDOWS\system32\Drivers\TAOKernelEx64.sys [143992 2016-05-13] (Tencent Technology(Shenzhen) Company Limited)
R3 TFsFlt; C:\Windows\System32\Drivers\TFsFltX64.sys [97400 2016-05-13] (电脑管家)
R0 THAccel; C:\Windows\System32\DRIVERS\THAccel.sys [110976 2013-03-25] (TOSHIBA Corporation)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows ® Win 7 DDK provider)
R3 TS888x64; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TS888x64.sys [38520 2016-05-20] (Tencent)
S1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TSDefenseBT64.sys [28984 2016-05-13] (Tencent)
R2 tsnethlpx64; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TsNetHlpX64.sys [57976 2016-05-13] ()
R4 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TSSysKit64.sys [96888 2016-05-13] (电脑管家)
S3 usbrndis6; C:\Windows\System32\drivers\usb80236.sys [20992 2015-04-25] (Microsoft Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 wirelessusbser; C:\Windows\system32\DRIVERS\3GDatausbser64.sys [120832 2009-11-09] (Haier Incorporated)
R4 Avguniva; system32\DRIVERS\avguniva.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ADDITION TEXT
Additional scan result of Farbar Recovery Scan Tool (x64) Version:19-05-2016
Ran by oliver (2016-05-20 12:34:06)
Running from C:\Users\oliver\Downloads
Windows 8.1 Single Language (X64) (2014-10-20 08:34:12)
Boot Mode: Normal
==================== Accounts: =============================
Administrator (S-1-5-21-2472899907-1604452211-935407213-500 - Administrator - Disabled) => C:\Users\Administrator
Guest (S-1-5-21-2472899907-1604452211-935407213-501 - Limited - Disabled)
oliver (S-1-5-21-2472899907-1604452211-935407213-1001 - Administrator - Enabled) => C:\Users\oliver
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: 电脑管家系统防护 (Enabled - Up to date) {6F9C3F92-B625-0E47-F0B1-447602EC65F5}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: 电脑管家系统防护 (Enabled - Up to date) {D4FDDE76-901F-01C9-CA01-7F04796B2F48}
==================== Loaded Modules (Whitelisted) ==============
2016-05-18 09:44 - 2016-05-18 06:37 - 00365440 _____ () C:\ProgramData\Weness\Weness.exe
2016-03-03 21:18 - 2011-12-07 12:40 - 00193536 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2012-02-22 14:31 - 2012-02-22 14:31 - 00233472 _____ () C:\Program Files (x86)\3G Voice Modem\HSPALauncher.exe
2012-07-18 19:38 - 2012-07-18 19:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2013-08-13 04:52 - 2013-08-13 04:52 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2013-08-22 09:19 - 2013-08-22 08:54 - 00174592 _____ () C:\WINDOWS\system32\WinMetadata\Windows.UI.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00050176 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Data.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00030208 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Foundation.winmd
2013-08-22 21:13 - 2013-08-22 21:13 - 00012728 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbwe\Microsoft.PerfTrack.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00054784 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Globalization.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00020480 _____ () C:\WINDOWS\system32\WinMetadata\Windows.System.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00096256 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Storage.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00134144 _____ () C:\WINDOWS\system32\WinMetadata\Windows.ApplicationModel.winmd
2014-04-12 00:20 - 2014-04-12 00:34 - 00551440 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbwe\SqliteWrapper.dll
2013-08-22 21:13 - 2013-08-22 21:13 - 00660920 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbwe\Sqlite3.dll
2016-05-11 22:06 - 2016-05-11 22:06 - 00280064 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbwe\Microsoft.Bing.AppEx.Telemetry.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00066560 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Security.winmd
2014-04-12 00:20 - 2014-04-12 00:34 - 00016912 _____ () C:\Program Files\WindowsApps\Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbwe\SqliteWrapper.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00112640 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Networking.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00093696 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Web.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00049664 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Graphics.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00169472 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Devices.winmd
2016-05-13 23:13 - 2016-05-13 23:13 - 00088416 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\zlib.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00115904 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMAntiInject.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00488640 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\sqlite.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00100704 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\tinyxml.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00046784 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\plugins\sysspeeduprtpplugin\SysSpeedupRtpPlugin.dll
2016-05-13 23:17 - 2016-03-28 21:11 - 00070848 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\plugins\qmiemalrtpplugin\qmiemalrtpplugin.dll
2016-05-13 23:12 - 2016-02-28 00:55 - 00036128 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\oDayProtect.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00128192 _____ () c:\program files (x86)\tencent\qqpcmgr\11.5.17490.219\qmrtpcontroller.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00169152 _____ () c:\program files (x86)\tencent\qqpcmgr\11.5.17490.219\qmhipslogpolicy.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00115904 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TavPedc.dll
2013-11-12 01:43 - 2013-09-03 17:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00194912 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\xImage.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00342368 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\arkGraphic.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 02156896 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\GF.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00092512 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\xGraphic32.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00158048 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\libpng.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00285024 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\libjpegturbo.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00137568 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\libexpatw.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00045408 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\jgImage.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00014176 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\jgIOStub.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00083136 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\MemDefrag.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00337088 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMTrayPlugin\QMAutoTaskPlugin\SubPlugins\OperationFileCloudMgr.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00379232 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\DlForQd.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00251072 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMWlanMacDll.dll
2015-11-11 03:41 - 2015-11-11 03:41 - 00756376 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
2016-05-18 09:44 - 2016-05-18 06:37 - 01708416 _____ () C:\Program Files (x86)\Weness\Application\libglesv2.dll
2016-05-18 09:44 - 2016-05-18 06:37 - 00080256 _____ () C:\Program Files (x86)\Weness\Application\libegl.dll
2016-05-18 09:44 - 2016-05-18 06:37 - 17530752 _____ () C:\Program Files (x86)\Weness\Application\PepperFlash\pepflashplayer.dll
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2016-05-20 09:59 - 00001006 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{AFA7664F-4339-4BFF-BEA5-E4348581EA7F}] => (Allow) C:\Users\oliver\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{4FC6104F-5332-4C91-B6F9-865E9ED9A7DB}] => (Allow) C:\Users\oliver\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{2991F92C-F468-4A74-8C63-B231ADA46514}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{8F9E0023-9C48-4536-A04B-2B81667B9012}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [TCP Query User{3693C593-2BCB-4353-B1DA-3CF65A170CAA}C:\program files (x86)\symantec\norton online backup\nobuclient.exe] => (Block) C:\program files (x86)\symantec\norton online backup\nobuclient.exe
FirewallRules: [UDP Query User{286332D7-CAFA-4DC1-AD56-C19A5CC5DC4E}C:\program files (x86)\symantec\norton online backup\nobuclient.exe] => (Block) C:\program files (x86)\symantec\norton online backup\nobuclient.exe
FirewallRules: [{9EF185E1-B126-4718-B7FC-AAA0B4BADD16}] => (Allow) C:\Program Files (x86)\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe
FirewallRules: [{A6794C50-F486-4611-B3F9-F08E2BE1CD77}] => (Allow) C:\Program Files (x86)\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe
FirewallRules: [{29E6EA8B-2EE2-4AB6-B4D9-98F656DE21F3}] => (Allow) LPort=4481
FirewallRules: [{A3E5BB69-CD2F-4054-80A6-2CD4148B492D}] => (Allow) LPort=4481
FirewallRules: [{28D15ECE-0217-476C-95FD-48B398B08C95}] => (Allow) LPort=4482
FirewallRules: [{4AC3ACA7-6174-4851-840A-5411A0DB2F63}] => (Allow) LPort=4482
FirewallRules: [{5063CBF1-D5FE-4F16-972D-3D8A7B9ABEE0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F3984F31-D74F-4D54-BE56-4B973327C5C6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{CA2530F3-785D-42F6-9D2A-3D6B96CCC625}C:\program files (x86)\symantec\norton online backup\nobuclient.exe] => (Block) C:\program files (x86)\symantec\norton online backup\nobuclient.exe
FirewallRules: [UDP Query User{F6AC9B01-1EFD-40BA-8EA8-3A72D0C89CB4}C:\program files (x86)\symantec\norton online backup\nobuclient.exe] => (Block) C:\program files (x86)\symantec\norton online backup\nobuclient.exe
FirewallRules: [{7AAD88D3-89A9-4BB5-8436-0329BEDBE951}] => (Allow) C:\Users\oliver\AppData\Local\Temp\113257328\download\MiniThunderPlatform.exe
FirewallRules: [{2901F26E-F099-4876-AB35-91F5B26262DC}] => (Allow) C:\Users\oliver\AppData\Local\Temp\113257328\download\MiniThunderPlatform.exe
FirewallRules: [{82D9C473-2D97-428C-A409-EBB198731E9C}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{52D109BA-1C48-4DAA-A7EC-D00F820D3AFB}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCmgrInstallGuide.exe
FirewallRules: [{FF5B06E8-21DC-4CF4-9158-81AD115A2475}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe
FirewallRules: [{491FCB4C-B249-4025-8CB4-EE4000CFE774}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCTray.exe
FirewallRules: [{347195AA-E229-4564-BEF4-517A0F0C0409}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCMgr.exe
FirewallRules: [{CC677246-B20D-49B7-B32E-909BBC09A4AF}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCRTP.exe
FirewallRules: [{CE8B7490-A48E-4A24-8D15-C3C7087CA891}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMDL.exe
FirewallRules: [{9607B9A9-9A66-414A-8CE0-EE542240469D}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\bugreport.exe
FirewallRules: [{44F2C5E0-DBF0-4EF4-8386-679FC9198D27}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCFileOpen.exe
FirewallRules: [{63890222-C44E-413A-8A3C-9C7B35F63D67}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCLeakScan.exe
FirewallRules: [{6D3FB261-2114-4A99-9D68-7390B82742D9}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPConfig.exe
FirewallRules: [{2A9CE69E-F549-4049-8CC1-E5357914951B}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCSoftMgr.exe
FirewallRules: [{D7F9DD3F-EF99-4A3B-A8E8-DB696C6682F8}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\plugins\QMNetMon\QQPCNetFlow.exe
FirewallRules: [{32971A39-B97D-48B1-9230-8E7E713024B9}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCBTU.exe
FirewallRules: [{DEF4880F-337F-4A32-9BC9-39705962CEBB}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCClinic.exe
FirewallRules: [{9B6754D9-BFE0-4C5A-9B9E-9E7D1E99BBD6}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCLaunch.exe
FirewallRules: [{74DDF6E6-EEFE-4FE5-B55C-4BA6C7AE4526}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMUpdate\QQPCMgrUpdate.exe
FirewallRules: [{12BD19D5-8906-419A-85A8-41928D8E5CEE}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCSoftGame.exe
FirewallRules: [{E9E447E5-F41D-409D-BB1B-912C1BF94A3C}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCSysOptimize.exe
FirewallRules: [{4CDA80AF-9E28-41A0-9B82-8C4B8D0DC7DB}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCUpdateAVLib.exe
FirewallRules: [{48EA8908-D563-4370-9117-DCBFAE38EB66}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQRepair.exe
FirewallRules: [{6366A041-76E0-4A70-AC11-C85C4FE088E9}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\Uninst.exe
FirewallRules: [{5F58CE07-55EC-445A-9686-1F2AD2D38983}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCPatch.exe
FirewallRules: [{B872AAC2-A9B0-4CA3-BE02-DCE0256A32C5}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TpkUpdate.exe
FirewallRules: [{28FA86E9-6646-4A29-8F72-26A0CFA0DCD6}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMRouterMgr.exe
FirewallRules: [{47005EFD-8E05-428B-8062-21198CB5143B}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMAccountProtection.exe
FirewallRules: [{EDACF653-D870-42D2-A1C0-6FAD88B07037}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMAdBlock.exe
FirewallRules: [{AD563E48-9E59-4538-8BE8-2688FBBFF20F}] => (Allow) C:\Windows\Temp\download\MiniThunderPlatform.exe
FirewallRules: [{D7C74366-A051-41F7-9E0C-D63025416878}] => (Allow) C:\Windows\Temp\download\MiniThunderPlatform.exe
FirewallRules: [{C2D35217-18D0-466A-A347-E2CB4EC7EF94}] => (Allow) C:\Program Files (x86)\Weness\Update\WenessUpdate.exe
FirewallRules: [{F9024118-639E-4682-BA33-9EA7328E342A}] => (Allow) C:\Program Files (x86)\Weness\Application\chrome.exe
FirewallRules: [{745C808F-7CE7-48E6-A3BC-EEC01EF33F49}] => (Allow) C:\ProgramData\Weness\Weness.exe
==================== Restore Points =========================
16-05-2016 19:35:50 avast! antivirus system restore point
18-05-2016 17:46:36 avast! antivirus system restore point
20-05-2016 10:03:24 Installed AVG 2016
20-05-2016 10:04:11 Installed AVG
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/20/2016 11:35:49 AM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2005) (User: NT AUTHORITY)
Description: There was an error communicating to the Orion DCS server
Error: (05/20/2016 10:44:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: WenessUpdate.exe, version: 1.0.0.1, time stamp: 0x573bf19e
Faulting module name: WenessUpdate.exe, version: 1.0.0.1, time stamp: 0x573bf19e
Exception code: 0xc0000409
Fault offset: 0x0004497a
Faulting process id: 0x17a0
Faulting application start time: 0xWenessUpdate.exe0
Faulting application path: WenessUpdate.exe1
Faulting module path: WenessUpdate.exe2
Report Id: WenessUpdate.exe3
Faulting package full name: WenessUpdate.exe4
Faulting package-relative application ID: WenessUpdate.exe5
Error: (05/20/2016 10:05:50 AM) (Source: MsiInstaller) (EventID: 10005) (User: Toshiba)
Description: SA_Error1709: StandardAction(0xC00706AD): Product: AVG -- Error 27046. CA_Error27046: DriverInstallation(0xE0010054): Driver installation failed
Error: (05/20/2016 10:05:50 AM) (Source: MsiInstaller) (EventID: 10005) (User: Toshiba)
Description: SA_Error1709: StandardAction(0xC00706AD): Product: AVG -- Error 27046. CA_Error27046: DriverInstallationFun(0xE0010054): Driver installation failed
Error: (05/20/2016 09:49:22 AM) (Source: VMCService) (EventID: 0) (User: )
Description: GetLoggedOnUser
Error: (05/20/2016 09:49:20 AM) (Source: VMCService) (EventID: 0) (User: )
Description: GetLoggedOnUser
Error: (05/19/2016 09:59:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: FreshPaint.exe, version: 2.0.15133.1, time stamp: 0x568eb2f4
Faulting module name: combase.dll, version: 6.3.9600.18202, time stamp: 0x569e6792
Exception code: 0xc000027b
Fault offset: 0x00121311
Faulting process id: 0x9e8
Faulting application start time: 0xFreshPaint.exe0
Faulting application path: FreshPaint.exe1
Faulting module path: FreshPaint.exe2
Report Id: FreshPaint.exe3
Faulting package full name: FreshPaint.exe4
Faulting package-relative application ID: FreshPaint.exe5
Error: (05/19/2016 06:59:41 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (05/19/2016 06:54:50 PM) (Source: MsiInstaller) (EventID: 1018) (User: Toshiba)
Description: The application 'Kaspersky Internet Security 2012' cannot be installed because it is not compatible with this version of Windows. Contact the application vendor for an update.
Error: (05/19/2016 05:33:49 PM) (Source: VMCService) (EventID: 0) (User: )
Description: GetLoggedOnUser
System errors:
=============
Error: (05/20/2016 11:57:09 AM) (Source: DCOM) (EventID: 10010) (User: Toshiba)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (05/20/2016 11:56:39 AM) (Source: DCOM) (EventID: 10010) (User: Toshiba)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (05/20/2016 11:42:03 AM) (Source: DCOM) (EventID: 10016) (User: Toshiba)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}ToshibaoliverS-1-5-21-2472899907-1604452211-935407213-1001LocalHost (Using LRPC)Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbweS-1-15-2-508114518-3340871649-811464485-526616082-4258465299-1774086546-1865468257
Error: (05/20/2016 11:41:03 AM) (Source: DCOM) (EventID: 10016) (User: Toshiba)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}ToshibaoliverS-1-5-21-2472899907-1604452211-935407213-1001LocalHost (Using LRPC)Microsoft.BingNews_3.0.4.344_x64__8wekyb3d8bbweS-1-15-2-508114518-3340871649-811464485-526616082-4258465299-1774086546-1865468257
Error: (05/20/2016 10:46:56 AM) (Source: Schannel) (EventID: 4116) (User: Toshiba)
Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is client.wns.windows.com. The SSL connection request has failed. The attached data contains the server certificate.
Error: (05/20/2016 10:46:56 AM) (Source: Schannel) (EventID: 4120) (User: Toshiba)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 43. The Windows SChannel error state is 552.
Error: (05/20/2016 10:41:14 AM) (Source: Schannel) (EventID: 4116) (User: Toshiba)
Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is client.wns.windows.com. The SSL connection request has failed. The attached data contains the server certificate.
Error: (05/20/2016 10:41:14 AM) (Source: Schannel) (EventID: 4120) (User: Toshiba)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 43. The Windows SChannel error state is 552.
Error: (05/20/2016 10:35:37 AM) (Source: Schannel) (EventID: 4116) (User: Toshiba)
Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is client.wns.windows.com. The SSL connection request has failed. The attached data contains the server certificate.
Error: (05/20/2016 10:35:37 AM) (Source: Schannel) (EventID: 4120) (User: Toshiba)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 43. The Windows SChannel error state is 552.
CodeIntegrity:
===================================
Date: 2016-05-10 17:35:15.879
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-04-28 20:01:23.310
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-04-24 22:48:43.375
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-03-19 10:39:53.298
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-03-11 11:03:19.304
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel® Celeron® CPU 1037U @ 1.80GHz
Percentage of memory in use: 66%
Total physical RAM: 3975.27 MB
Available physical RAM: 1322.96 MB
Total Virtual: 8071.27 MB
Available Virtual: 5259.03 MB
==================== Drives ================================
Drive c: (TI31142400B) (Fixed) (Total:454.84 GB) (Free:207.19 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)
Partition: GPT.
==================== End of Addition.txt ============================
Attached Files
-
FRST.txt 438.75KB
225 downloads
-
Addition.txt 38.65KB
240 downloads
Sign In
Create Account
