Prosím o kontrolu logu
Napsal: 03 pro 2017 12:15
Mám nainštalovanú oficiálnu čínsku hudobnú streamingovú službu Kuwo. Problém je ten, že som ju už chcel odinštalovať,ale nedá sa to klasickým spôsobom cez programy. Ako ju mám odstrániť. Problém, sú aj tie čínske znaky.
Logfile of random's system information tool 1.10 (written by random/random)
Run by Martin at 2017-12-03 12:10:00
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 21 GB (19%) free of 110 GB
Total RAM: 8154 MB (80% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:10:11, on 3. 12. 2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\360\360Safe\safemon\360Tray.exe
C:\Program Files (x86)\kuwo\kuwomusic\8.7.4.0_W1_2\bin\KwService.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\trend micro\Martin.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://hao.360.cn/?installer
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://hao.360.cn/?installer
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - C:\Program Files (x86)\360\360Safe\safemon\safemon.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [iSkysoft Helper Compact.exe] C:\Program Files (x86)\Common Files\iSkysoft\iSkysoft Helper Compact\ISHelper.exe
O4 - HKLM\..\Run: [kwmusic] "C:\Program Files (x86)\kuwo\kuwomusic\8.7.4.0_W1_2\Kwmusic.exe" /autorun
O4 - HKLM\..\Run: [360Safetray] "C:\Program Files (x86)\360\360Safe\safemon\360tray.exe" /start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [TIDAL] C:\Users\Martin\AppData\Local\TIDAL\update.exe --processStart TIDAL.exe --process-start-args " -autostart -minimized"
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&oslať do programu OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://*.hola.org
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DbxSvc - Unknown owner - C:\Windows\system32\DbxSvc.exe (file missing)
O23 - Service: dsmainsrv - 360.cn - C:\Program Files (x86)\360\360Safe\deepscan\dsmain.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: ???? (ZhuDongFangYu) - 360.cn - C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe
--
End of file - 6944 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
"C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
C:\Windows\Explorer.EXE
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Windows\system32\DbxSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\360\360Safe\safemon\360Tray.exe" /start
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files (x86)\kuwo\kuwomusic\8.7.4.0_W1_2\bin\KwService.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
rundll32.exe "C:\Users\Martin\AppData\Roaming\kclap5962\kclap5962_core.dll",runDll
"C:\Windows\system32\rundll32.exe" "C:\Users\Martin\AppData\Roaming\kclap5962\task\1010\1010.dll",runDll /taskid:1010 /from:1 /ipcserver:262178
C:\Windows\servicing\TrustedInstaller.exe
"C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min /NOSPLASH /SETUPSTART
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_00000fe0
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
taskeng.exe {77DED90A-70E5-464B-BDCF-280A99071E1B}
"C:\Users\Martin\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-11-07 255088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}]
SafeMon Class - C:\Program Files (x86)\360\360Safe\safemon\safemon64.dll [2017-09-11 1648224]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-11-07 193136]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}]
SafeMon Class - C:\Program Files (x86)\360\360Safe\safemon\safemon.dll [2017-09-18 2187872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-11-07 255088]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-11-07 193136]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TIDAL"=C:\Users\Martin\AppData\Local\TIDAL\update.exe [2017-06-20 1783520]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [2015-07-28 767176]
"iSkysoft Helper Compact.exe"=C:\Program Files (x86)\Common Files\iSkysoft\iSkysoft Helper Compact\ISHelper.exe [2016-10-08 2138272]
"kwmusic"=C:\Program Files (x86)\kuwo\kuwomusic\8.7.4.0_W1_2\Kwmusic.exe [2017-11-16 68592]
"360Safetray"=C:\Program Files (x86)\360\360Safe\safemon\360tray.exe [2017-12-03 398432]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2014-11-24 702768]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=221
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=221
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 month======
2017-12-03 12:10:00 ----D---- C:\rsit
2017-12-03 12:10:00 ----D---- C:\Program Files\trend micro
2017-12-03 12:06:44 ----D---- C:\Users\Martin\AppData\Roaming\Avira
2017-12-03 12:05:40 ----A---- C:\Windows\system32\drivers\avkmgr.sys
2017-12-03 12:05:40 ----A---- C:\Windows\system32\drivers\avipbb.sys
2017-12-03 12:05:40 ----A---- C:\Windows\system32\drivers\avgntflt.sys
2017-12-03 12:05:39 ----D---- C:\ProgramData\Avira
2017-12-03 12:05:39 ----D---- C:\Program Files (x86)\Avira
2017-12-03 11:34:15 ----D---- C:\ProgramData\{plbackup-CFE0-66E8-660553B4C955}
2017-12-03 11:32:51 ----D---- C:\Users\Martin\AppData\Roaming\360Login
2017-12-03 11:32:29 ----A---- C:\Windows\system32\drivers\360Sensor64.sys
2017-12-03 11:32:28 ----A---- C:\Windows\system32\drivers\360reskit64.sys
2017-12-03 11:32:23 ----D---- C:\ProgramData\360safe
2017-12-03 11:32:22 ----D---- C:\Users\Martin\AppData\Roaming\360mobilemgr
2017-12-03 11:32:04 ----A---- C:\Windows\system32\drivers\360LanProtect.sys
2017-12-03 11:32:04 ----A---- C:\Windows\system32\drivers\360fsflt.sys
2017-12-03 11:32:03 ----A---- C:\Windows\system32\drivers\360Hvm64.sys
2017-12-03 11:32:03 ----A---- C:\Windows\system32\drivers\360Hvm64.dat
2017-12-03 11:32:03 ----A---- C:\Windows\system32\drivers\360AntiHijack64.sys
2017-12-03 11:32:03 ----A---- C:\Windows\system32\drivers\360AntiHacker64.sys
2017-12-03 11:32:02 ----RSHD---- C:\360SANDBOX
2017-12-03 11:32:02 ----A---- C:\Windows\system32\drivers\360Camera64.sys
2017-12-03 11:32:02 ----A---- C:\Windows\system32\drivers\360Box64.sys
2017-12-03 11:31:59 ----A---- C:\Windows\system32\drivers\BAPIDRV64.SYS
2017-12-03 11:31:49 ----A---- C:\Windows\system32\drivers\360netmon.sys
2017-12-03 11:31:46 ----D---- C:\Program Files (x86)\360
2017-12-03 11:23:56 ----D---- C:\Users\Martin\AppData\Roaming\360Safe
2017-12-03 11:18:04 ----D---- C:\Users\Martin\AppData\Roaming\kclap5962
2017-12-03 11:17:47 ----D---- C:\ProgramData\kuwodata
2017-12-03 11:17:40 ----D---- C:\Program Files (x86)\kuwo
2017-11-30 17:32:11 ----D---- C:\Program Files (x86)\GUM58B1.tmp
2017-11-16 03:25:32 ----A---- C:\Windows\KwYlx.dat
2017-11-14 18:02:15 ----D---- C:\Program Files (x86)\GUMFF98.tmp
2017-11-06 18:13:15 ----D---- C:\Program Files (x86)\GUMF627.tmp
======List of files/folders modified in the last 1 month======
2017-12-03 12:10:05 ----D---- C:\Windows\temp
2017-12-03 12:10:00 ----RD---- C:\Program Files
2017-12-03 12:06:08 ----D---- C:\Windows\system32\drivers
2017-12-03 12:06:07 ----D---- C:\Windows\system32\catroot
2017-12-03 12:05:39 ----RD---- C:\Program Files (x86)
2017-12-03 12:05:39 ----D---- C:\ProgramData
2017-12-03 11:55:24 ----D---- C:\Windows\system32\config
2017-12-03 11:41:09 ----D---- C:\Windows\System32
2017-12-03 11:41:09 ----D---- C:\Windows\inf
2017-12-03 11:41:09 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-12-03 11:36:19 ----D---- C:\Windows
2017-12-03 11:32:31 ----D---- C:\Windows\Tasks
2017-12-03 11:31:49 ----D---- C:\Windows\SysWOW64
2017-12-03 11:29:15 ----HD---- C:\Windows\system32\GroupPolicy
2017-12-03 10:20:47 ----D---- C:\Windows\SYSWOW64\Macromed
2017-11-30 18:20:01 ----SHD---- C:\Windows\Installer
2017-11-30 18:18:45 ----D---- C:\Config.Msi
2017-11-24 11:19:07 ----D---- C:\Windows\system32\Tasks
2017-11-24 11:19:07 ----D---- C:\Program Files (x86)\Opera
2017-11-14 13:52:06 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-11-14 13:52:05 ----D---- C:\Windows\system32\Macromed
2017-11-13 16:09:52 ----SHD---- C:\System Volume Information
2017-11-10 11:44:42 ----A---- C:\Windows\WORDPAD.INI
2017-11-07 10:48:48 ----D---- C:\Windows\system32\catroot2
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2012-04-22 213888]
R1 360AntiHacker;360Safe Anti Hacker Service; C:\Windows\System32\Drivers\360AntiHacker64.sys [2017-12-03 183416]
R1 360AntiHijack;360Safe Anti Hijack Service; C:\Windows\System32\Drivers\360AntiHijack64.sys [2017-05-04 32704]
R1 360Box64;360Box mini-filter driver; C:\Windows\system32\DRIVERS\360Box64.sys [2016-11-15 330176]
R1 360FsFlt;360FsFlt mini-filter driver; C:\Windows\system32\DRIVERS\360FsFlt.sys [2017-12-03 431736]
R1 360Hvm;360Safe HVM; C:\Windows\System32\Drivers\360Hvm64.sys [2017-12-03 285816]
R1 360netmon;360netmon; C:\Windows\system32\DRIVERS\360netmon.sys [2016-06-12 81344]
R1 360reskit64;360reskit driver; \??\C:\Windows\system32\drivers\360reskit64.sys [2017-10-19 85672]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2014-11-24 131608]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2014-11-24 28600]
R1 BAPIDRV;BAPIDRV; C:\Windows\system32\DRIVERS\BAPIDRV64.sys [2017-12-03 197240]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2012-04-22 60416]
R2 AODDriver4.3;AODDriver4.3; \??\C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [2014-02-11 59616]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2014-11-24 119272]
R2 WinDivert1.2;WinDivert1.2; \??\C:\Windows\system32\drivers\WinDivert64.sys [2017-07-27 37552]
R3 360Sensor;360Sensor; \??\C:\Windows\system32\drivers\360Sensor64.sys [2017-06-14 34960]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2015-07-29 21622784]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2015-07-29 665088]
R3 athur;Wireless Network Adapter Service; C:\Windows\system32\DRIVERS\athurx.sys [2010-01-05 1847296]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2015-07-15 96256]
R3 DeepATS;云查杀驱动程序; \??\C:\Program Files (x86)\360\360Safe\deepscan\AtS64.sys [2017-08-30 834736]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2012-10-03 33240]
R3 Neo_VPN;VPN Client Device Driver - VPN; C:\Windows\system32\DRIVERS\Neo_0121.sys [2016-09-18 38432]
R3 taphss6;Anchorfree HSS VPN Adapter; C:\Windows\system32\DRIVERS\taphss6.sys [2016-06-28 42064]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2012-04-22 18432]
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S3 360Camera;360Safe Camera Filter Service; C:\Windows\System32\Drivers\360Camera64.sys [2016-11-24 49088]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2012-04-22 95232]
S3 dbx;dbx; C:\Windows\system32\DRIVERS\dbx.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 tap0901;TAP-Windows Adapter V9; C:\Windows\system32\DRIVERS\tap0901.sys [2016-04-21 27136]
S3 tap-tb-0901;TunnelBear Adapter V9; C:\Windows\system32\DRIVERS\tap-tb-0901.sys [2015-08-10 38656]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WsAudioDevice_383S(1);WsAudioDevice_383S(1); C:\Windows\system32\drivers\WsAudioDevice_383S(1).sys [2016-10-13 29288]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-09-27 83984]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2015-07-29 246784]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [2015-07-28 344064]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2014-11-24 431920]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2014-11-24 431920]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]
R2 DbxSvc;DbxSvc; C:\Windows\system32\DbxSvc.exe [2016-11-28 42096]
R2 ZhuDongFangYu;主动防御; C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe [2017-09-18 252000]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2015-11-05 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2015-11-05 125112]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-07 153752]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-19 270016]
S3 dsmainsrv;dsmainsrv; C:\Program Files (x86)\360\360Safe\deepscan\dsmain.exe [2017-12-03 265312]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-07 153752]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2016-11-07 194032]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-02-08 569024]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2015-11-05 51376]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
-----------------EOF-----------------
Logfile of random's system information tool 1.10 (written by random/random)
Run by Martin at 2017-12-03 12:10:00
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 21 GB (19%) free of 110 GB
Total RAM: 8154 MB (80% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:10:11, on 3. 12. 2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\360\360Safe\safemon\360Tray.exe
C:\Program Files (x86)\kuwo\kuwomusic\8.7.4.0_W1_2\bin\KwService.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\trend micro\Martin.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://hao.360.cn/?installer
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://hao.360.cn/?installer
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - C:\Program Files (x86)\360\360Safe\safemon\safemon.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [iSkysoft Helper Compact.exe] C:\Program Files (x86)\Common Files\iSkysoft\iSkysoft Helper Compact\ISHelper.exe
O4 - HKLM\..\Run: [kwmusic] "C:\Program Files (x86)\kuwo\kuwomusic\8.7.4.0_W1_2\Kwmusic.exe" /autorun
O4 - HKLM\..\Run: [360Safetray] "C:\Program Files (x86)\360\360Safe\safemon\360tray.exe" /start
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [TIDAL] C:\Users\Martin\AppData\Local\TIDAL\update.exe --processStart TIDAL.exe --process-start-args " -autostart -minimized"
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&oslať do programu OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://*.hola.org
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DbxSvc - Unknown owner - C:\Windows\system32\DbxSvc.exe (file missing)
O23 - Service: dsmainsrv - 360.cn - C:\Program Files (x86)\360\360Safe\deepscan\dsmain.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: ???? (ZhuDongFangYu) - 360.cn - C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe
--
End of file - 6944 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
"C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
C:\Windows\Explorer.EXE
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Windows\system32\DbxSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\360\360Safe\safemon\360Tray.exe" /start
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files (x86)\kuwo\kuwomusic\8.7.4.0_W1_2\bin\KwService.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
rundll32.exe "C:\Users\Martin\AppData\Roaming\kclap5962\kclap5962_core.dll",runDll
"C:\Windows\system32\rundll32.exe" "C:\Users\Martin\AppData\Roaming\kclap5962\task\1010\1010.dll",runDll /taskid:1010 /from:1 /ipcserver:262178
C:\Windows\servicing\TrustedInstaller.exe
"C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min /NOSPLASH /SETUPSTART
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_00000fe0
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
taskeng.exe {77DED90A-70E5-464B-BDCF-280A99071E1B}
"C:\Users\Martin\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-11-07 255088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}]
SafeMon Class - C:\Program Files (x86)\360\360Safe\safemon\safemon64.dll [2017-09-11 1648224]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-11-07 193136]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}]
SafeMon Class - C:\Program Files (x86)\360\360Safe\safemon\safemon.dll [2017-09-18 2187872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-11-07 255088]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-11-07 193136]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TIDAL"=C:\Users\Martin\AppData\Local\TIDAL\update.exe [2017-06-20 1783520]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [2015-07-28 767176]
"iSkysoft Helper Compact.exe"=C:\Program Files (x86)\Common Files\iSkysoft\iSkysoft Helper Compact\ISHelper.exe [2016-10-08 2138272]
"kwmusic"=C:\Program Files (x86)\kuwo\kuwomusic\8.7.4.0_W1_2\Kwmusic.exe [2017-11-16 68592]
"360Safetray"=C:\Program Files (x86)\360\360Safe\safemon\360tray.exe [2017-12-03 398432]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2014-11-24 702768]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=221
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=221
"NoDrives"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
======List of files/folders created in the last 1 month======
2017-12-03 12:10:00 ----D---- C:\rsit
2017-12-03 12:10:00 ----D---- C:\Program Files\trend micro
2017-12-03 12:06:44 ----D---- C:\Users\Martin\AppData\Roaming\Avira
2017-12-03 12:05:40 ----A---- C:\Windows\system32\drivers\avkmgr.sys
2017-12-03 12:05:40 ----A---- C:\Windows\system32\drivers\avipbb.sys
2017-12-03 12:05:40 ----A---- C:\Windows\system32\drivers\avgntflt.sys
2017-12-03 12:05:39 ----D---- C:\ProgramData\Avira
2017-12-03 12:05:39 ----D---- C:\Program Files (x86)\Avira
2017-12-03 11:34:15 ----D---- C:\ProgramData\{plbackup-CFE0-66E8-660553B4C955}
2017-12-03 11:32:51 ----D---- C:\Users\Martin\AppData\Roaming\360Login
2017-12-03 11:32:29 ----A---- C:\Windows\system32\drivers\360Sensor64.sys
2017-12-03 11:32:28 ----A---- C:\Windows\system32\drivers\360reskit64.sys
2017-12-03 11:32:23 ----D---- C:\ProgramData\360safe
2017-12-03 11:32:22 ----D---- C:\Users\Martin\AppData\Roaming\360mobilemgr
2017-12-03 11:32:04 ----A---- C:\Windows\system32\drivers\360LanProtect.sys
2017-12-03 11:32:04 ----A---- C:\Windows\system32\drivers\360fsflt.sys
2017-12-03 11:32:03 ----A---- C:\Windows\system32\drivers\360Hvm64.sys
2017-12-03 11:32:03 ----A---- C:\Windows\system32\drivers\360Hvm64.dat
2017-12-03 11:32:03 ----A---- C:\Windows\system32\drivers\360AntiHijack64.sys
2017-12-03 11:32:03 ----A---- C:\Windows\system32\drivers\360AntiHacker64.sys
2017-12-03 11:32:02 ----RSHD---- C:\360SANDBOX
2017-12-03 11:32:02 ----A---- C:\Windows\system32\drivers\360Camera64.sys
2017-12-03 11:32:02 ----A---- C:\Windows\system32\drivers\360Box64.sys
2017-12-03 11:31:59 ----A---- C:\Windows\system32\drivers\BAPIDRV64.SYS
2017-12-03 11:31:49 ----A---- C:\Windows\system32\drivers\360netmon.sys
2017-12-03 11:31:46 ----D---- C:\Program Files (x86)\360
2017-12-03 11:23:56 ----D---- C:\Users\Martin\AppData\Roaming\360Safe
2017-12-03 11:18:04 ----D---- C:\Users\Martin\AppData\Roaming\kclap5962
2017-12-03 11:17:47 ----D---- C:\ProgramData\kuwodata
2017-12-03 11:17:40 ----D---- C:\Program Files (x86)\kuwo
2017-11-30 17:32:11 ----D---- C:\Program Files (x86)\GUM58B1.tmp
2017-11-16 03:25:32 ----A---- C:\Windows\KwYlx.dat
2017-11-14 18:02:15 ----D---- C:\Program Files (x86)\GUMFF98.tmp
2017-11-06 18:13:15 ----D---- C:\Program Files (x86)\GUMF627.tmp
======List of files/folders modified in the last 1 month======
2017-12-03 12:10:05 ----D---- C:\Windows\temp
2017-12-03 12:10:00 ----RD---- C:\Program Files
2017-12-03 12:06:08 ----D---- C:\Windows\system32\drivers
2017-12-03 12:06:07 ----D---- C:\Windows\system32\catroot
2017-12-03 12:05:39 ----RD---- C:\Program Files (x86)
2017-12-03 12:05:39 ----D---- C:\ProgramData
2017-12-03 11:55:24 ----D---- C:\Windows\system32\config
2017-12-03 11:41:09 ----D---- C:\Windows\System32
2017-12-03 11:41:09 ----D---- C:\Windows\inf
2017-12-03 11:41:09 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-12-03 11:36:19 ----D---- C:\Windows
2017-12-03 11:32:31 ----D---- C:\Windows\Tasks
2017-12-03 11:31:49 ----D---- C:\Windows\SysWOW64
2017-12-03 11:29:15 ----HD---- C:\Windows\system32\GroupPolicy
2017-12-03 10:20:47 ----D---- C:\Windows\SYSWOW64\Macromed
2017-11-30 18:20:01 ----SHD---- C:\Windows\Installer
2017-11-30 18:18:45 ----D---- C:\Config.Msi
2017-11-24 11:19:07 ----D---- C:\Windows\system32\Tasks
2017-11-24 11:19:07 ----D---- C:\Program Files (x86)\Opera
2017-11-14 13:52:06 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2017-11-14 13:52:05 ----D---- C:\Windows\system32\Macromed
2017-11-13 16:09:52 ----SHD---- C:\System Volume Information
2017-11-10 11:44:42 ----A---- C:\Windows\WORDPAD.INI
2017-11-07 10:48:48 ----D---- C:\Windows\system32\catroot2
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2012-04-22 213888]
R1 360AntiHacker;360Safe Anti Hacker Service; C:\Windows\System32\Drivers\360AntiHacker64.sys [2017-12-03 183416]
R1 360AntiHijack;360Safe Anti Hijack Service; C:\Windows\System32\Drivers\360AntiHijack64.sys [2017-05-04 32704]
R1 360Box64;360Box mini-filter driver; C:\Windows\system32\DRIVERS\360Box64.sys [2016-11-15 330176]
R1 360FsFlt;360FsFlt mini-filter driver; C:\Windows\system32\DRIVERS\360FsFlt.sys [2017-12-03 431736]
R1 360Hvm;360Safe HVM; C:\Windows\System32\Drivers\360Hvm64.sys [2017-12-03 285816]
R1 360netmon;360netmon; C:\Windows\system32\DRIVERS\360netmon.sys [2016-06-12 81344]
R1 360reskit64;360reskit driver; \??\C:\Windows\system32\drivers\360reskit64.sys [2017-10-19 85672]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2014-11-24 131608]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2014-11-24 28600]
R1 BAPIDRV;BAPIDRV; C:\Windows\system32\DRIVERS\BAPIDRV64.sys [2017-12-03 197240]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2012-04-22 60416]
R2 AODDriver4.3;AODDriver4.3; \??\C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [2014-02-11 59616]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2014-11-24 119272]
R2 WinDivert1.2;WinDivert1.2; \??\C:\Windows\system32\drivers\WinDivert64.sys [2017-07-27 37552]
R3 360Sensor;360Sensor; \??\C:\Windows\system32\drivers\360Sensor64.sys [2017-06-14 34960]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2015-07-29 21622784]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2015-07-29 665088]
R3 athur;Wireless Network Adapter Service; C:\Windows\system32\DRIVERS\athurx.sys [2010-01-05 1847296]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2015-07-15 96256]
R3 DeepATS;云查杀驱动程序; \??\C:\Program Files (x86)\360\360Safe\deepscan\AtS64.sys [2017-08-30 834736]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2012-10-03 33240]
R3 Neo_VPN;VPN Client Device Driver - VPN; C:\Windows\system32\DRIVERS\Neo_0121.sys [2016-09-18 38432]
R3 taphss6;Anchorfree HSS VPN Adapter; C:\Windows\system32\DRIVERS\taphss6.sys [2016-06-28 42064]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2012-04-22 18432]
S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []
S3 360Camera;360Safe Camera Filter Service; C:\Windows\System32\Drivers\360Camera64.sys [2016-11-24 49088]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2012-04-22 95232]
S3 dbx;dbx; C:\Windows\system32\DRIVERS\dbx.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 tap0901;TAP-Windows Adapter V9; C:\Windows\system32\DRIVERS\tap0901.sys [2016-04-21 27136]
S3 tap-tb-0901;TunnelBear Adapter V9; C:\Windows\system32\DRIVERS\tap-tb-0901.sys [2015-08-10 38656]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WsAudioDevice_383S(1);WsAudioDevice_383S(1); C:\Windows\system32\drivers\WsAudioDevice_383S(1).sys [2016-10-13 29288]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-09-27 83984]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2015-07-29 246784]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [2015-07-28 344064]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2014-11-24 431920]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2014-11-24 431920]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]
R2 DbxSvc;DbxSvc; C:\Windows\system32\DbxSvc.exe [2016-11-28 42096]
R2 ZhuDongFangYu;主动防御; C:\Program Files (x86)\360\360Safe\deepscan\zhudongfangyu.exe [2017-09-18 252000]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2015-11-05 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2015-11-05 125112]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-07 153752]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-19 270016]
S3 dsmainsrv;dsmainsrv; C:\Program Files (x86)\360\360Safe\deepscan\dsmain.exe [2017-12-03 265312]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-11-07 153752]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2016-11-07 194032]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-02-08 569024]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2015-11-05 51376]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
-----------------EOF-----------------
