API tools faq
paste
Advertisement
Guest User

frst.txt

a guest
Apr 25th, 2015
418
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.44 KB | None | 0 0
raw download clone embed print report
  1. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2015
  2. Ran by Paul (administrator) on WIN-6MO941NP7T8 on 25-04-2015 22:33:39
  3. Running from C:\Users\Paul\Downloads
  4. Loaded Profiles: Paul (Available profiles: Paul)
  5. Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
  6. Internet Explorer Version 8 (Default browser path: "C:\Program Files (x86)\2345Soft\2345Explorer\2345Explorer.exe" "%1")
  7. Boot Mode: Normal
  8. Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
  9.  
  10. ==================== Processes (Whitelisted) =================
  11.  
  12. (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
  13.  
  14. (Microsoft Corporation) C:\Windows\System32\dllhost.exe
  15. (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  16. (金华长风信息技术有限公司) C:\Program Files (x86)\Kele55\ServiceClient.exe
  17. (Beijing Rising Information Technology Co., Ltd.) C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
  18. (金华长风信息技术有限公司) C:\Program Files (x86)\Kele55\ResideClient.exe
  19. () C:\Users\Paul\AppData\Local\Temp\gunshum.exe
  20. () C:\Users\Paul\AppData\Roaming\Itribe\ocam.exe
  21. () C:\Users\Paul\Downloads\3\1.exe
  22. () C:\Users\Paul\AppData\Roaming\csrss.exe
  23. () C:\Users\Paul\AppData\Roaming\rundll32.exe
  24. () C:\Users\Paul\AppData\Roaming\svchost.exe
  25. () C:\Users\Paul\Downloads\adwcleaner\6AdwCleaner.exe
  26. (北京云立方科技有限公司) C:\ProgramData\201542521\25218126071137.exe
  27.  
  28.  
  29. ==================== Registry (Whitelisted) ==================
  30.  
  31. (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
  32.  
  33. HKU\S-1-5-21-814135004-2179620524-1494180562-1000\...\Run: [Xvirusstart] => C:\Program Files (x86)\Xvirus Personal Guard\xvirusstart.exe [84480 2015-04-22] (Mysecuritywin)
  34. HKU\S-1-5-21-814135004-2179620524-1494180562-1000\...\Run: [Client Server Runtime Process] => C:\Users\Paul\AppData\Roaming\csrss.exe [107870 2015-04-24] ()
  35. HKU\S-1-5-21-814135004-2179620524-1494180562-1000\...\Run: [Host-process Windows (Rundll32.exe)] => C:\Users\Paul\AppData\Roaming\rundll32.exe [107870 2015-04-24] ()
  36. HKU\S-1-5-21-814135004-2179620524-1494180562-1000\...\Run: [Service Host Process for Windows] => C:\Users\Paul\AppData\Roaming\svchost.exe [107870 2015-04-24] ()
  37. HKU\S-1-5-21-814135004-2179620524-1494180562-1000\...\Run: [{BAD8DA22-4EF8-1B35-773B-9A6767FBB48D}] => C:\Users\Paul\AppData\Roaming\Itribe\ocam.exe [141312 2015-04-21] ()
  38. HKU\S-1-5-21-814135004-2179620524-1494180562-1000\...\Run: [AdwCleaner] => C:\Users\Paul\Downloads\adwcleaner\6AdwCleaner.exe [172648 2015-02-04] ()
  39.  
  40. ==================== Internet (Whitelisted) ====================
  41.  
  42. (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
  43.  
  44. HKU\S-1-5-21-814135004-2179620524-1494180562-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-gb/?ocid=iehp
  45. BHO-x32: CSohuDetector Object -> {452ADB5B-00BE-469D-A65F-3046146B2ED5} -> C:\Program Files (x86)\搜狐影音\SoHuAutoDetector.dll [2015-04-25] (Sohu)
  46. BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-04-25] (Oracle Corporation)
  47. BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-25] (Oracle Corporation)
  48. Tcpip\Parameters: [DhcpNameServer] 192.168.18.2
  49.  
  50. FireFox:
  51. ========
  52. FF ProfilePath: C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\pbu5a7tf.default
  53. FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-04-25] (Oracle Corporation)
  54. FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-25] (Oracle Corporation)
  55. FF Plugin-x32: @rising.com.cn/nprising -> C:\Program Files (x86)\Rising\RAV\nprising.dll No File
  56. FF Plugin-x32: @sohu.com/npifox -> C:\Program Files (x86)\搜狐影音\npifox.dll [2015-04-25] ()
  57. FF Plugin HKU\S-1-5-21-814135004-2179620524-1494180562-1000: @rising.com.cn/nprising -> C:\Program Files (x86)\Rising\RAV\nprising.dll No File
  58. FF SearchPlugin: C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\pbu5a7tf.default\searchplugins\luckysearches.xml [2015-04-25]
  59. FF Extension: Firebug - C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\pbu5a7tf.default\Extensions\firebug@software.joehewitt.com.xpi [2015-04-02]
  60. FF Extension: DealXplorer + Luckysearches - C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\pbu5a7tf.default\Extensions\jid1-yUBA8gaBwnYbRw@jetpack.xpi [2015-04-25]
  61. FF Extension: Google Translator for Firefox - C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\pbu5a7tf.default\Extensions\translator@zoli.bod.xpi [2015-04-21]
  62. FF HKLM-x32\...\Firefox\Extensions: [fiddlerhook@fiddler2.com] - C:\Program Files (x86)\Fiddler2\FiddlerHook
  63. FF Extension: FiddlerHook - C:\Program Files (x86)\Fiddler2\FiddlerHook [2015-04-01]
  64.  
  65. ==================== Services (Whitelisted) =================
  66.  
  67. (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
  68.  
  69. R2 GuaGua-Service; C:\Program Files (x86)\Kele55\ServiceClient.exe [116128 2014-12-08] (金华长风信息技术有限公司) [File not signed]
  70. S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
  71. R2 RsMgrSvc; C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe [179992 2014-09-02] (Beijing Rising Information Technology Co., Ltd.)
  72. S2 RsRavMon; C:\Program Files (x86)\Rising\RAV\ravmond.exe [277552 2014-05-15] (Beijing Rising Information Technology Co., Ltd.)
  73. R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
  74. S3 vmvss; C:\Windows\system32\dllhost.exe /Processid:{B2CFE4D8-751C-4534-8DC1-76678C81F6E6}
  75.  
  76. ==================== Drivers (Whitelisted) ====================
  77.  
  78. (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
  79.  
  80. R1 A2DDA; C:\EEK\bin\a2ddax64.sys [26176 2015-04-14] (Emsisoft GmbH)
  81. S3 CaptureFileMonitor; C:\Windows\SysWOW64\DRIVERS\CaptureFileMonitor.sys [11648 2007-09-03] () [File not signed]
  82. S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-04-14] (Emsisoft GmbH)
  83. S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
  84. S1 rsutils; C:\Windows\System32\DRIVERS\rsutils.sys [69336 2014-08-15] (Beijing Rising Information Technology Co., Ltd.)
  85. S2 sysmon; C:\Windows\System32\DRIVERS\sysmon.sys [119344 2014-09-10] (Beijing Rising Information Technology Co., Ltd.)
  86.  
  87. ==================== NetSvcs (Whitelisted) ===================
  88.  
  89. (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
  90.  
  91.  
  92. ==================== One Month Created Files and Folders ========
  93.  
  94. (If an entry is included in the fixlist, the file\folder will be moved.)
  95.  
  96. 2015-04-25 22:33 - 2015-04-25 22:34 - 00008080 _____ () C:\Users\Paul\Downloads\FRST.txt
  97. 2015-04-25 22:33 - 2015-04-25 22:33 - 00000000 ____D () C:\FRST
  98. 2015-04-25 22:32 - 2015-04-25 22:33 - 02099712 _____ (Farbar) C:\Users\Paul\Downloads\FRST64.exe
  99. 2015-04-25 22:14 - 2015-04-25 22:14 - 00001031 _____ () C:\Users\Public\Desktop\AdwCleaner Full Version.lnk
  100. 2015-04-25 22:14 - 2015-04-25 22:14 - 00000000 ____D () C:\Users\Paul\Downloads\adwcleaner
  101. 2015-04-25 22:14 - 2015-04-25 22:14 - 00000000 ____D () C:\Program Files (x86)\AdwCleaner
  102. 2015-04-25 22:12 - 2015-04-25 22:13 - 02383737 _____ () C:\Users\Paul\Downloads\adwcleaner.7z
  103. 2015-04-25 22:09 - 2015-04-25 22:09 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\UnknownFile
  104. 2015-04-25 22:08 - 2015-04-24 13:04 - 00107870 __RSH () C:\Users\Paul\AppData\Roaming\svchost.exe
  105. 2015-04-25 22:08 - 2015-04-24 13:04 - 00107870 __RSH () C:\Users\Paul\AppData\Roaming\rundll32.exe
  106. 2015-04-25 22:08 - 2015-04-24 13:04 - 00107870 __RSH () C:\Users\Paul\AppData\Roaming\csrss.exe
  107. 2015-04-25 22:07 - 2015-04-25 22:19 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Moca
  108. 2015-04-25 22:07 - 2015-04-25 22:07 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Itribe
  109. 2015-04-25 22:06 - 2015-04-25 22:06 - 00600181 _____ () C:\Users\Paul\Downloads\3(1).zip
  110. 2015-04-25 22:05 - 2015-04-25 22:05 - 01139464 _____ () C:\Users\Paul\Downloads\Files.7z
  111. 2015-04-25 22:03 - 2015-04-25 22:30 - 00000440 _____ () C:\Windows\Tasks\Adobe Flash wifishare Files Update Ver 2015425.job
  112. 2015-04-25 22:03 - 2015-04-25 22:03 - 00003510 _____ () C:\Windows\System32\Tasks\Adobe Flash wifishare Files Update Ver 2015425
  113. 2015-04-25 22:03 - 2015-04-25 22:03 - 00002074 _____ () C:\Users\Paul\Desktop\2345王牌浏览器.lnk
  114. 2015-04-25 22:03 - 2015-04-25 22:03 - 00001621 _____ () C:\Users\Paul\Desktop\WiFi共享秀.lnk
  115. 2015-04-25 22:03 - 2015-04-25 22:03 - 00000000 ___HD () C:\sohucache
  116. 2015-04-25 22:03 - 2015-04-25 22:03 - 00000000 ____D () C:\Users\Paul\Documents\搜狐影音
  117. 2015-04-25 22:03 - 2015-04-25 22:03 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WiFi共享秀
  118. 2015-04-25 22:03 - 2015-04-25 22:03 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\2345王牌软件
  119. 2015-04-25 22:03 - 2015-04-25 22:03 - 00000000 ____D () C:\SHDownload
  120. 2015-04-25 22:03 - 2015-04-25 22:03 - 00000000 ____D () C:\ProgramData\WiFiShare_Data
  121. 2015-04-25 22:03 - 2015-04-25 22:03 - 00000000 ____D () C:\ProgramData\Sun
  122. 2015-04-25 22:03 - 2015-04-25 22:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\2345王牌软件
  123. 2015-04-25 22:03 - 2015-04-25 22:03 - 00000000 ____D () C:\ProgramData\201542521
  124. 2015-04-25 22:03 - 2015-04-25 22:00 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
  125. 2015-04-25 22:02 - 2015-04-25 22:03 - 00000000 ____D () C:\Program Files (x86)\搜狐影音
  126. 2015-04-25 22:02 - 2015-04-25 22:02 - 00002098 _____ () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\2345王牌浏览器.lnk
  127. 2015-04-25 22:02 - 2015-04-25 22:02 - 00001904 _____ () C:\Users\Paul\Desktop\搜狐影音.lnk
  128. 2015-04-25 22:02 - 2015-04-25 22:02 - 00001829 _____ () C:\Users\Paul\Desktop\¶à²Ê±ãÇ©.lnk
  129. 2015-04-25 22:02 - 2015-04-25 22:02 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\¶à²Ê±ãÇ©
  130. 2015-04-25 22:02 - 2015-04-25 22:02 - 00000000 ____D () C:\Users\Paul\AppData\Local\Temp尰
  131. 2015-04-25 22:02 - 2015-04-25 22:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\搜狐影音
  132. 2015-04-25 22:02 - 2015-04-25 22:02 - 00000000 ____D () C:\Program Files (x86)\anote
  133. 2015-04-25 22:02 - 2014-09-10 07:11 - 00119344 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\sysmon.sys
  134. 2015-04-25 22:02 - 2014-08-15 02:22 - 00069336 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\rsutils.sys
  135. 2015-04-25 22:02 - 2012-02-29 08:49 - 00011888 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\rsndisp.sys
  136. 2015-04-25 22:01 - 2015-04-25 22:16 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\2345Explorer
  137. 2015-04-25 22:01 - 2015-04-25 22:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
  138. 2015-04-25 22:01 - 2015-04-25 22:01 - 00000000 ____D () C:\Program Files (x86)\2345Soft
  139. 2015-04-25 22:00 - 2015-04-25 22:03 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Baidu
  140. 2015-04-25 22:00 - 2015-04-25 22:03 - 00000000 ____D () C:\ProgramData\Baidu
  141. 2015-04-25 22:00 - 2015-04-25 22:01 - 00000000 ____D () C:\ProgramData\Rising
  142. 2015-04-25 22:00 - 2015-04-25 22:00 - 00001001 _____ () C:\Users\Paul\Desktop\¿ÉÀÖÊÓƵÉçÇø.lnk
  143. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000991 _____ () C:\Users\Paul\Desktop\»ìãçÕ½Óò.lnk
  144. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000963 _____ () C:\Users\Paul\Desktop\ÍøÒ³ÓÎÏ·.lnk
  145. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000048 _____ () C:\Windows\msgpi.log
  146. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000048 _____ () C:\Windows\gsyspd.log
  147. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000000 ___HD () C:\MSOCache
  148. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000000 ___HD () C:\ghos
  149. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\游戏
  150. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ÍøÂçÓÎÏ·ÖÐÐÄ
  151. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\¿ÉÀÖÊÓƵÉçÇø
  152. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ÍøÂçÓÎÏ·ÖÐÐÄ
  153. 2015-04-25 22:00 - 2015-04-25 22:00 - 00000000 ____D () C:\ProgramData\GuaGua
  154. 2015-04-25 21:59 - 2015-04-25 22:00 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\ÓÎÏ·
  155. 2015-04-25 21:59 - 2015-04-25 21:59 - 00002049 _____ () C:\Users\Public\Desktop\9377-Ê¢ÊÀÈý¹ú2.lnk
  156. 2015-04-25 21:59 - 2015-04-25 21:59 - 00000000 ___HD () C:\Users\Paul\AppData\Roaming\Kele55
  157. 2015-04-25 21:59 - 2015-04-25 21:59 - 00000000 ____D () C:\ProgramData\Oracle
  158. 2015-04-25 21:59 - 2015-04-25 21:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\9377-Ê¢ÊÀÈý¹ú2
  159. 2015-04-25 21:59 - 2015-04-25 21:59 - 00000000 ____D () C:\Program Files (x86)\9377-Ê¢ÊÀÈý¹ú2
  160. 2015-04-25 21:58 - 2015-04-25 22:00 - 00000000 ____D () C:\Program Files (x86)\Kele55
  161. 2015-04-25 21:58 - 2015-04-25 21:58 - 00185362 _____ (EZB Systems(Nonenever打包制作)) C:\Users\Paul\Downloads\Setup_863_1401.exe
  162. 2015-04-25 21:58 - 2015-04-25 21:58 - 00001194 _____ () C:\Users\Paul\Desktop\上网导航.lnk
  163. 2015-04-25 21:58 - 2015-04-25 21:58 - 00001194 _____ () C:\Users\Paul\Desktop\Internet Explrer.lnk
  164. 2015-04-25 21:58 - 2015-04-25 21:58 - 00001194 _____ () C:\Users\Paul\Desktop\Internet Explorer.lnk
  165. 2015-04-25 21:58 - 2015-04-25 21:58 - 00001194 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Internet Explorer.lnk
  166. 2015-04-25 21:58 - 2015-04-25 21:58 - 00001118 _____ () C:\Users\Paul\Desktop\360安全导航.lnk
  167. 2015-04-25 21:58 - 2015-04-25 21:58 - 00001084 _____ () C:\Users\Paul\Desktop\私密图片.lnk
  168. 2015-04-25 21:58 - 2015-04-25 21:58 - 00001080 _____ () C:\Users\Paul\Desktop\两性夜话.lnk
  169. 2015-04-25 21:58 - 2015-04-25 21:58 - 00000892 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\我的搜索.lnk
  170. 2015-04-25 21:58 - 2015-04-25 21:58 - 00000868 _____ () C:\Users\Public\Desktop\我的搜索.lnk
  171. 2015-04-25 21:58 - 2015-04-25 21:58 - 00000840 _____ () C:\Users\Paul\AppData\Local\我的搜索.lnk
  172. 2015-04-25 21:58 - 2015-04-25 21:58 - 00000047 _____ () C:\Users\Paul\AppData\Local\desksvr.ini
  173. 2015-04-25 21:58 - 2015-04-25 21:58 - 00000000 ____D () C:\Users\Paul\AppData\Local\myss
  174. 2015-04-25 21:58 - 2015-04-25 21:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\我的搜索
  175. 2015-04-25 21:58 - 2015-04-25 21:58 - 00000000 ____D () C:\Program Files (x86)\Java
  176. 2015-04-25 21:57 - 2015-04-25 21:57 - 00001646 _____ () C:\Users\Paul\Desktop\Continue Adobe Flash Player.lnk
  177. 2015-04-25 21:57 - 2015-04-25 21:57 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Zona
  178. 2015-04-25 21:57 - 2015-04-25 21:57 - 00000000 ____D () C:\Users\Paul\AppData\Local\Adobe
  179. 2015-04-25 21:57 - 2015-04-25 21:57 - 00000000 ____D () C:\Program Files (x86)\Zona
  180. 2015-04-25 21:56 - 2015-04-25 21:56 - 02583504 _____ (CLICK YES BELOW LP) C:\Users\Paul\Downloads\Setup.exe
  181. 2015-04-25 21:56 - 2015-04-25 21:56 - 00545504 _____ ( ) C:\Users\Paul\Downloads\Camtasia%20Studio.exe
  182. 2015-04-25 21:56 - 2015-04-25 21:56 - 00545504 _____ ( ) C:\Users\Paul\Downloads\Adobe+Flash+Player.exe
  183. 2015-04-25 21:55 - 2015-04-25 21:55 - 00545504 _____ ( ) C:\Users\Paul\Downloads\microsoft%20office2011.exe
  184. 2015-04-25 21:53 - 2015-04-25 21:53 - 01187840 _____ () C:\Users\Paul\Downloads\tsex_xbox_1-6713.exe
  185. 2015-04-25 21:53 - 2015-04-25 21:53 - 00545504 _____ ( ) C:\Users\Paul\Downloads\Saint+Seiya+The+Lost+Canvas+Chronicle+09.exe
  186. 2015-04-25 21:53 - 2015-04-25 21:53 - 00545504 _____ ( ) C:\Users\Paul\Downloads\avg%20anti-virusfree.exe
  187. 2015-04-25 21:52 - 2015-04-25 21:53 - 00232504 _____ (Destiny Media) C:\Users\Paul\Downloads\ZonaSetup_latest.exe
  188. 2015-04-22 21:05 - 2015-04-22 21:05 - 00001097 _____ () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Xvirus.lnk
  189. 2015-04-22 21:05 - 2015-04-22 21:05 - 00001073 _____ () C:\Users\Paul\Desktop\Xvirus.lnk
  190. 2015-04-22 21:05 - 2015-04-22 21:05 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\xvirus
  191. 2015-04-22 21:05 - 2015-04-22 21:05 - 00000000 ____D () C:\Users\Paul\AppData\Local\Mysecuritywin
  192. 2015-04-22 21:04 - 2015-04-22 21:07 - 00000000 ____D () C:\Program Files (x86)\Xvirus Personal Guard
  193. 2015-04-22 21:04 - 2015-04-22 21:04 - 08325632 _____ (Mysecuritywin) C:\Users\Paul\Downloads\Xvirus Setup.exe
  194. 2015-04-21 21:06 - 2015-04-22 20:53 - 31876279 _____ (Arcabit Ltd.) C:\Users\Paul\Downloads\ArcabitSetup_av_trial.exe.part
  195. 2015-04-21 21:04 - 2015-04-21 21:04 - 00000000 ____D () C:\ProgramData\Package Cache
  196. 2015-04-21 20:57 - 2015-04-21 21:00 - 73926280 _____ (Arcabit Ltd.) C:\Users\Paul\Downloads\ArcabitSetup.exe
  197. 2015-04-14 17:15 - 2015-04-14 17:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
  198. 2015-04-02 18:45 - 2015-04-02 18:45 - 00057560 _____ () C:\Users\Paul\AppData\Local\GDIPFONTCACHEV1.DAT
  199. 2015-04-02 18:43 - 2014-04-22 08:33 - 00368640 _____ (Örebro) C:\Windows\hexed.ocx
  200. 2015-04-02 18:43 - 2014-02-07 04:16 - 00253952 _____ (SandSprite.com) C:\Windows\vbDevKit.dll
  201. 2015-04-02 18:43 - 2012-05-19 21:56 - 00061440 _____ (SandSprite.com) C:\Windows\spSubclass2.dll
  202. 2015-04-02 18:43 - 2012-05-10 08:39 - 00188487 _____ () C:\Windows\loadlib.exe
  203. 2015-04-02 18:43 - 2012-03-07 19:01 - 00050688 _____ () C:\Windows\FindDll.exe
  204. 2015-04-02 18:43 - 2011-06-16 11:29 - 00176188 _____ () C:\Windows\gdiprocs.exe
  205. 2015-04-02 18:43 - 2006-04-27 11:20 - 01066176 _____ (Microsoft Corporation) C:\Windows\mscomctl.ocx
  206. 2015-04-02 18:43 - 2006-04-27 11:20 - 00212240 _____ (Microsoft Corporation) C:\Windows\RICHTX32.OCX
  207. 2015-04-02 18:43 - 2006-04-27 11:20 - 00109248 _____ (Microsoft Corporation) C:\Windows\MSWINSCK.OCX
  208. 2015-04-02 18:43 - 2006-04-27 11:14 - 00153600 _____ (Microsoft Corporation) C:\Windows\TLBINF32.DLL
  209. 2015-04-02 04:06 - 2015-04-02 04:06 - 00008192 __RSH () C:\BOOTSECT.BAK
  210. 2015-04-02 04:06 - 2015-04-01 10:15 - 00000000 ____D () C:\Windows\Panther
  211. 2015-04-02 04:06 - 2010-11-21 04:23 - 00383786 __RSH () C:\bootmgr
  212. 2015-04-02 03:11 - 2015-04-02 03:11 - 00001355 _____ () C:\Windows\TSSysprep.log
  213. 2015-04-02 03:11 - 2015-04-02 03:11 - 00001345 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
  214. 2015-04-02 03:11 - 2015-04-02 03:11 - 00001326 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
  215. 2015-04-02 03:10 - 2015-04-25 21:57 - 00055809 _____ () C:\Windows\WindowsUpdate.log
  216. 2015-04-01 22:54 - 2015-04-01 22:54 - 00771962 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
  217. 2015-04-01 22:38 - 2015-04-01 22:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safer Networking
  218. 2015-04-01 22:38 - 2015-04-01 22:38 - 00000000 ____D () C:\Program Files (x86)\Safer Networking
  219. 2015-04-01 22:38 - 2015-04-01 22:38 - 00000000 ____D () C:\Program Files (x86)\Cerbero
  220. 2015-04-01 22:35 - 2015-04-01 22:35 - 00001541 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
  221. 2015-04-01 22:35 - 2015-04-01 22:35 - 00001529 _____ () C:\Users\Public\Desktop\Wireshark.lnk
  222. 2015-04-01 22:35 - 2015-04-01 22:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
  223. 2015-04-01 22:35 - 2015-04-01 22:35 - 00000000 ____D () C:\Program Files (x86)\WinPcap
  224. 2015-04-01 22:34 - 2015-04-01 22:35 - 00000000 ____D () C:\Program Files\Wireshark
  225. 2015-04-01 22:33 - 2015-04-01 22:33 - 00001888 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fiddler4.lnk
  226. 2015-04-01 22:32 - 2015-04-01 22:32 - 00000000 ____D () C:\Program Files\BreakPoint Software
  227. 2015-04-01 22:30 - 2015-04-01 22:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
  228. 2015-04-01 22:30 - 2015-04-01 22:30 - 00000000 ____D () C:\Program Files\7-Zip
  229. 2015-04-01 19:35 - 2015-04-25 21:58 - 00001223 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
  230. 2015-04-01 19:35 - 2015-04-25 20:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
  231. 2015-04-01 19:35 - 2015-04-01 19:35 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
  232. 2015-04-01 19:35 - 2015-04-01 19:35 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Mozilla
  233. 2015-04-01 19:35 - 2015-04-01 19:35 - 00000000 ____D () C:\Users\Paul\AppData\Local\Mozilla
  234. 2015-04-01 19:35 - 2015-04-01 19:35 - 00000000 ____D () C:\ProgramData\Mozilla
  235. 2015-04-01 10:17 - 2015-04-01 10:17 - 00001409 _____ () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
  236. 2015-04-01 10:16 - 2015-04-02 17:55 - 00000000 ____D () C:\Users\Paul\AppData\Local\VirtualStore
  237. 2015-04-01 10:15 - 2015-04-01 10:16 - 00000000 ____D () C:\Users\Paul
  238. 2015-04-01 10:15 - 2015-04-01 10:15 - 00000020 ___SH () C:\Users\Paul\ntuser.ini
  239. 2015-04-01 10:15 - 2009-07-14 05:54 - 00000000 ___RD () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
  240. 2015-04-01 10:15 - 2009-07-14 05:49 - 00000000 ___RD () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
  241. 2015-04-01 10:14 - 2015-04-01 10:14 - 00000000 __SHD () C:\Recovery
  242.  
  243. ==================== One Month Modified Files and Folders =======
  244.  
  245. (If an entry is included in the fixlist, the file\folder will be moved.)
  246.  
  247. 2015-04-25 22:24 - 2009-07-14 05:45 - 00016848 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  248. 2015-04-25 22:24 - 2009-07-14 05:45 - 00016848 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  249. 2015-04-25 20:14 - 2009-07-14 06:13 - 00778150 _____ () C:\Windows\system32\PerfStringBackup.INI
  250. 2015-04-25 20:07 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
  251. 2015-04-25 20:07 - 2009-07-14 05:51 - 00022241 _____ () C:\Windows\setupact.log
  252. 2015-04-25 20:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Registration
  253. 2015-04-02 04:06 - 2009-07-14 06:38 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG
  254. 2015-04-02 04:06 - 2009-07-14 06:32 - 00028672 _____ () C:\Windows\system32\config\BCD-Template
  255. 2015-04-02 03:11 - 2009-07-14 05:46 - 00002790 _____ () C:\Windows\DtcInstall.log
  256. 2015-04-02 03:11 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
  257. 2015-04-02 03:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sysprep
  258. 2015-04-02 03:08 - 2010-11-21 08:17 - 00000000 ____D () C:\Windows\CSC
  259. 2015-04-01 18:13 - 2009-07-14 05:45 - 00274320 _____ () C:\Windows\system32\FNTCACHE.DAT
  260. 2015-04-01 10:17 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\restore
  261. 2015-04-01 10:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
  262. 2015-04-01 10:16 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
  263.  
  264. ==================== Files in the root of some directories =======
  265.  
  266. 2015-04-25 22:08 - 2015-04-24 13:04 - 0107870 __RSH () C:\Users\Paul\AppData\Roaming\csrss.exe
  267. 2015-04-25 22:08 - 2015-04-24 13:04 - 0107870 __RSH () C:\Users\Paul\AppData\Roaming\rundll32.exe
  268. 2015-04-25 22:08 - 2015-04-24 13:04 - 0107870 __RSH () C:\Users\Paul\AppData\Roaming\svchost.exe
  269. 2015-04-25 21:58 - 2015-04-25 21:58 - 0000047 _____ () C:\Users\Paul\AppData\Local\desksvr.ini
  270. 2015-04-25 21:58 - 2015-04-25 21:58 - 0000840 _____ () C:\Users\Paul\AppData\Local\我的搜索.lnk
  271.  
  272. Some content of TEMP:
  273. ====================
  274. C:\Users\Paul\AppData\Local\Temp\-2404_1_xcfx.exe
  275. C:\Users\Paul\AppData\Local\Temp\360Inst_sohuyy.exe
  276. C:\Users\Paul\AppData\Local\Temp\gunshum.exe
  277. C:\Users\Paul\AppData\Local\Temp\myss_jmm_114lm_27828.exe
  278. C:\Users\Paul\AppData\Local\Temp\procexp64.exe
  279. C:\Users\Paul\AppData\Local\Temp\Quarantine.exe
  280. C:\Users\Paul\AppData\Local\Temp\Setup_DB30_870.exe
  281. C:\Users\Paul\AppData\Local\Temp\sqlite3.dll
  282. C:\Users\Paul\AppData\Local\Temp\storePwd.exe
  283.  
  284.  
  285. ==================== Bamital & volsnap Check =================
  286.  
  287. (There is no automatic fix for files that do not pass verification.)
  288.  
  289. C:\Windows\System32\winlogon.exe => File is digitally signed
  290. C:\Windows\System32\wininit.exe => File is digitally signed
  291. C:\Windows\SysWOW64\wininit.exe => File is digitally signed
  292. C:\Windows\explorer.exe => File is digitally signed
  293. C:\Windows\SysWOW64\explorer.exe => File is digitally signed
  294. C:\Windows\System32\svchost.exe => File is digitally signed
  295. C:\Windows\SysWOW64\svchost.exe => File is digitally signed
  296. C:\Windows\System32\services.exe => File is digitally signed
  297. C:\Windows\System32\User32.dll => File is digitally signed
  298. C:\Windows\SysWOW64\User32.dll => File is digitally signed
  299. C:\Windows\System32\userinit.exe => File is digitally signed
  300. C:\Windows\SysWOW64\userinit.exe => File is digitally signed
  301. C:\Windows\System32\rpcss.dll => File is digitally signed
  302. C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
  303.  
  304.  
  305. LastRegBack: 2015-04-25 20:45
  306.  
  307. ==================== End Of Log ============================
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!