# Solved: Can not delete a program



## rfeichel (Jun 11, 2007)

I am unable to delete a program. It requires administrator rights to delete. I am the the administrator. Any ideas about how to delete this program?


----------



## Maria88 (Mar 9, 2012)

If you're trying to delete a personal folder, chances are that it's security settings are denying you access. Windows creates personal folders which don't allow administrative access by default (this is a good, security-conscious thing). 

If this is the case, you need to right-click on the folder, go into the security settings for it, and do two things: 

1) Take ownership of the folder and it's contents 
2) Change the access settings for the folder and it's contents to allow "full control" by Administrators 

Once you've done this you should be able to delete the folder.


----------



## jmwills (Sep 28, 2005)

Log on with the Admin Account to see if this makes a difference,


----------



## TheShooter93 (Jul 10, 2008)

Try the following:

*How To Use Revo Uninstaller*

1) First we download it from here: Revo Uninstaller Free Version. You can skip this Step if you already have it installed. However, you may need to update it. If you have it installed already, and you need to update it go ahead and open it up and click the AutoUpdate Icon next to Help.

2) Select the Program to remove from the list of programs: 







3) After selecting the program you want to remove, and confirming you want to uninstall the program, then you will want to select the Advanced Option: 







4) Select the Advanced mode, and this will start the Uninstaller Window for the application you picked.

5) Follow the Prompts during the Uninstallation of the application. Once it closes you will be at this window: 







6) Once the window is done scanning for files and other things that did not get removed is presented, you will be presented with this window: 





.

You will only want to select the bolded items and click on delete. Once done click next.

If it asks you to delete other things and files then do so. *But pay attention to the warnings.*


----------



## valis (Sep 24, 2004)

also, may want to post what OS you are using.


----------



## rfeichel (Jun 11, 2007)

To answer everyone -
1) I am using Windows 7 Professional
2) I tried to take control or owner ship of the folders but it makes no difference.
3)I am the Admin account (There are no other users on this machine).
4)I have Revo installed and tried it using #4 (advanced) with no success.


----------



## valis (Sep 24, 2004)

what's the name of the app? Does it have an uninstall feature in all programs?


----------



## rfeichel (Jun 11, 2007)

The name of the application is 360Safe. Yes, it has an uninstall feature. To run it you must have administrator privileges. (And as I said above I am the administrator and the only use/account on the machine).


----------



## Elvandil (Aug 1, 2003)

Open an administrative command window. Type:

appwiz.cpl

You should never delete programs. You will never be able to find all the parts. Always uninstall them.


----------



## dvk01 (Dec 14, 2002)

This can happen when you have turned off UAC
make sure UAC is set on highest level & then try to uninstall it, you will then get an admin prompt. Some badly written programs won't ask for a UAC prompt when UAC is set on a low level and won't then work properly


----------



## rfeichel (Jun 11, 2007)

UAC has been set to the highest level. That is where I keep it. I have also found that some of the files in this "program" are classed as Trojans. Malwarebytes can not remove them nor can some other similar programs I have tried. 

Once again, I am the administrator on this computer. There are no other users. Oh, the properties can not be changed either.


----------



## rfeichel (Jun 11, 2007)

Oh, for those of you who differentiate between delete and uninstall. I did run the uninstall program that was provided and it removed some of the files. It is now gone. It left behind all the files I am now trying to delete since some of them are programs/applications.


----------



## rfeichel (Jun 11, 2007)

dvk01 - is this something that TheSpyKiller could help with?


----------



## dvk01 (Dec 14, 2002)

rfeichel said:


> dvk01 - is this something that TheSpyKiller could help with?


I can't do any more for you or any different for you at spykiller to what I can do here

did you try revo uninstaller 
what happened when you ran it


----------



## dvk01 (Dec 14, 2002)

I suspect that there are other uninstallers that need to be run

Download to Desktop: DDS by sUBs from one of these locations:

http://download.bleepingcomputer.com/sUBs/dds.com
http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.infospyware.net/sUBs/dds/

double click DDS.scr to run

When complete, DDS.txt will open.

Save both reports to your desktop.
DDS.txt
Attach.txt

post the contents of both logs back here.


----------



## rfeichel (Jun 11, 2007)

I did run Revo using advanced. It ran the program unistall and then found all the left behind files. It tried to delete them but it apparently could not because they are still here. Of course now there is nothing in the Programs listing so it does not know all those files are still remain. I tried Hunter Mode on several files but it was unable to delete them as welll.
Now for my really dumb question, I have the Attach.txt and DDS.txt saved to the desktop. How do I post them here?


----------



## rfeichel (Jun 11, 2007)

.
DDS (Ver_2011-08-26.01) - NTFSAMD64 
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.2.0
Run by Bob at 14:35:22 on 2012-03-25
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.6132.3679 [GMT -4:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Roxio\Roxio Streamer\srvstart\srvstart.exe
C:\Program Files\Roxio\Roxio Streamer\usb_detection.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe
C:\Program Files\Roxio\Roxio Streamer\vboxheadless.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\mfevtps.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\iolo\System Mechanic\SystemGuardAlerter.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Uniblue\SpeedUpMyPC\spmonitor.exe
C:\Program Files (x86)\Uniblue\RegistryBooster\rbmonitor.exe
C:\Program Files (x86)\Uniblue\DriverScanner\dsmonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayAlert.exe
C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoDashboard.exe
C:\Program Files (x86)\Memeo\AutoBackup\InstantBackup.exe
C:\Windows\SysWOW64\rpcnet.exe
C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files (x86)\Seagate\Seagate Dashboard\HipServAgent\HipServAgent.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Roxio\Roxio Streamer\VBoxSVC.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe
C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\CPSHelpRunner13.exe
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe
C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
c:\PROGRA~2\mcafee\SITEAD~1\saui.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\ProgramData\Rpcnet\Bin\rpcld.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://my.earthlink.net/
uSearch Bar = Preserve
mStart Page = hxxp://search.foxtab.com/?s=0&chnl=dcom&cd=2XzutBtN2Y1L1QzutD0C0E0E0EyC0B0BtBtB0DzyyDyBtCyCzztN0D0TzutBtDtCtCtCtDtBtC&cr=1888191386
mWinlogon: Userinit=userinit.exe,
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
BHO: IE2EMBHO Class: {0a0ddbd3-6641-40b9-873f-bbdd26d6c14e} - C:\Program Files (x86)\easyMule\modules\IE2EM.dll
BHO: Ñ¸À×FLVÊÓÆµÐáÌ½¼°ÏÂÔØÖ§³Ö: {0ea37b17-6b8b-4085-8257-f3a4aa69c27a} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.6.69.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120102165401.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: FAIESSOHelper Class: {a2f122da-055f-4df7-8f24-7354dbdba85b} - C:\Program Files (x86)\Sensible Vision\Fast Access\FAIESSO.dll
BHO: WinZip Courier BHO: {a8fb70fa-0fdf-4601-9dc4-bfa1b357204f} - C:\PROGRA~2\WINZIP~1\wzwmcie.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
TB: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No File
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
{555d4d79-4bd2-4094-a395-cfc534424a05}
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
mRun: [FAStartup] 
mRun: [<NO NAME>] 
mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe"
mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [Seagate Dashboard] C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe --silent --no_ui
mRun: [Memeo AutoSync] C:\Program Files (x86)\Memeo\AutoSync\MemeoLauncher2.exe --silent
mRun: [Memeo Instant Backup] C:\Program Files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe --silent --no_ui
mRun: [iolo Startup] "C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe"
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [Absolute Notifier] "C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe"
mRun: [FATrayAlert] C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe
mRun: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
mRun: [360Safetray] "C:\Program Files (x86)\360\360Safe\safemon\360Tray.exe" /start
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Ê¹ÓÃ&Ñ¸À×ÀëÏßÏÂÔØ - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
IE: &Ê¹ÓÃ&Ñ¸À×ÏÂÔØ - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
IE: &Ê¹ÓÃ&Ñ¸À×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
IE: Download by easyMule - C:\Program Files (x86)\easyMule\IE2EM.htm
IE: {09BA8F6D-CB54-424B-839C-C2A6C8E6B436}
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
DPF: {74F4F118-91E6-4AFC-B8D2-04066781F239} - hxxps://online8.penfed.org/PenFedOnline/Forms/WebCapture/CheckDepositEnabler.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab
TCP: DhcpNameServer = 10.0.0.1
TCP: Interfaces\{E14ECB96-3368-4018-A687-82AA3F8284E7} : DhcpNameServer = 10.0.0.1
TCP: Interfaces\{E14ECB96-3368-4018-A687-82AA3F8284E7}\25645494348454C4D223E24374 : DhcpNameServer = 10.0.0.1
TCP: Interfaces\{E14ECB96-3368-4018-A687-82AA3F8284E7}\7457563747F575962756C6563737 : DhcpNameServer = 24.247.15.53 24.247.24.53
TCP: Interfaces\{E14ECB96-3368-4018-A687-82AA3F8284E7}\844534025465F402358696664702437402447383149333 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E14ECB96-3368-4018-A687-82AA3F8284E7}\84F64756C634F6E6E6563647 : DhcpNameServer = 172.20.1.1
TCP: Interfaces\{E14ECB96-3368-4018-A687-82AA3F8284E7}\C4964747C656259667562737964656 : DhcpNameServer = 24.247.15.53 66.189.0.100 24.178.162.3
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
Notify: FastAccess - C:\Program Files (x86)\Sensible Vision\Fast Access\FALogNot.dll
LSA: Notification Packages = scecli FAPassSync
BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
BHO-X64: 0x1 - No File
BHO-X64: IE2EMBHO Class: {0A0DDBD3-6641-40B9-873F-BBDD26D6C14E} - C:\Program Files (x86)\easyMule\modules\IE2EM.dll
BHO-X64: ¥,AxFLVEOæD*I«¬øIAOO3: {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.6.69.dll
BHO-X64: XlBrowserAddinBho.XlBrowserAddinBhoObject - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No File
BHO-X64: MediaBar - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120102165401.dll
BHO-X64: scriptproxy - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO-X64: FAIESSOHelper Class: {A2F122DA-055F-4df7-8F24-7354DBDBA85B} - C:\Program Files (x86)\Sensible Vision\Fast Access\FAIESSO.dll
BHO-X64: FAIESSO Helper Object - No File
BHO-X64: WinZip Courier BHO: {A8FB70FA-0FDF-4601-9DC4-BFA1B357204F} - C:\PROGRA~2\WINZIP~1\wzwmcie.dll
BHO-X64: WinZip Courier BHO - No File
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
TB-X64: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
TB-X64: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No File
TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [FAStartup] 
mRun-x64: [(Default)] 
mRun-x64: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe"
mRun-x64: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [Seagate Dashboard] C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe --silent --no_ui
mRun-x64: [Memeo AutoSync] C:\Program Files (x86)\Memeo\AutoSync\MemeoLauncher2.exe --silent
mRun-x64: [Memeo Instant Backup] C:\Program Files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe --silent --no_ui
mRun-x64: [iolo Startup] "C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe"
mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [Absolute Notifier] "C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe"
mRun-x64: [FATrayAlert] C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe
mRun-x64: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
mRun-x64: [360Safetray] "C:\Program Files (x86)\360\360Safe\safemon\360Tray.exe" /start
IE-X64: {09BA8F6D-CB54-424B-839C-C2A6C8E6B436}
.
============= SERVICES / DRIVERS ===============
.
R0 McPvDrv;McPvDrv Driver;C:\Windows\system32\drivers\McPvDrv.sys --> C:\Windows\system32\drivers\McPvDrv.sys [?]
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\system32\DRIVERS\stdcfltn.sys --> C:\Windows\system32\DRIVERS\stdcfltn.sys [?]
R1 360Box64;360Box mini-filter driver;C:\Windows\system32\DRIVERS\360Box64.sys --> C:\Windows\system32\DRIVERS\360Box64.sys [?]
R1 360FsFlt;360FsFlt mini-filter driver;C:\Windows\system32\DRIVERS\360FsFlt.sys --> C:\Windows\system32\DRIVERS\360FsFlt.sys [?]
R1 360netmon;360netmon;C:\Windows\system32\DRIVERS\360netmon.sys --> C:\Windows\system32\DRIVERS\360netmon.sys [?]
R1 BAPIDRV;BAPIDRV;C:\Windows\system32\Drivers\BAPIDRV64.SYS --> C:\Windows\system32\Drivers\BAPIDRV64.SYS [?]
R1 ElRawDisk;ElRawDisk;\??\C:\Windows\system32\drivers\ElRawDsk.sys --> C:\Windows\system32\drivers\ElRawDsk.sys [?]
R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
R1 MOBKFilter;MOBKFilter;C:\Windows\system32\DRIVERS\MOBK.sys --> C:\Windows\system32\DRIVERS\MOBK.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AbsoluteNotifier;Absolute Notifier;C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2011-5-10 10920]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-1-26 89600]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2010-1-11 155648]
R2 FAService;FAService;C:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe [2009-6-25 2368776]
R2 HipServ;HipServ for Windows;C:\Program Files\Roxio\Roxio Streamer\srvstart\srvstart.exe [2010-5-25 268288]
R2 HipServUsbDetection;USB detection service for HipServ;C:\Program Files\Roxio\Roxio Streamer\usb_detection.exe [2010-6-22 19968]
R2 ioloSystemService;iolo System Service;C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe [2012-1-12 722616]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-10-3 249936]
R2 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-10-3 249936]
R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-10-3 249936]
R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-10-3 249936]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2011-11-8 199272]
R2 MemeoBackgroundService;MemeoBackgroundService;C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2011-5-4 25824]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [2011-11-8 208536]
R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
R2 MOBKbackup;McAfee Online Backup;C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe [2010-4-13 231224]
R2 PassThru Service;Internet Pass-Through Service;C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-9-15 88576]
R2 rimspci;rimspci;C:\Windows\system32\DRIVERS\rimspe64.sys --> C:\Windows\system32\DRIVERS\rimspe64.sys [?]
R2 risdpcie;risdpcie;C:\Windows\system32\DRIVERS\risdpe64.sys --> C:\Windows\system32\DRIVERS\risdpe64.sys [?]
R2 rixdpcie;rixdpcie;C:\Windows\system32\DRIVERS\rixdpe64.sys --> C:\Windows\system32\DRIVERS\rixdpe64.sys [?]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe [2010-7-16 354288]
R2 rpcld;Remote Procedure Call (RPC) LD;C:\ProgramData\Rpcnet\Bin\rpcld.exe --> C:\ProgramData\Rpcnet\Bin\rpcld.exe [?]
R2 SeagateDashboardService;Seagate Dashboard Service;C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe [2011-6-1 14088]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2009-12-1 658656]
R3 Acceler;Accelerometer Service;C:\Windows\system32\DRIVERS\Accelern.sys --> C:\Windows\system32\DRIVERS\Accelern.sys [?]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys --> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
R3 RoxMediaDB13;RoxMediaDB13;C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe [2010-7-16 1099248]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 136176]
S2 Roxio Upnp Server 11;Roxio Upnp Server 11;C:\Program Files (x86)\Roxio Creator 2009\Digital Home 11\RoxioUpnpService11.exe [2008-8-14 367088]
S2 RoxWatch11;Roxio Hard Drive Watcher 11;C:\Program Files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe [2008-8-14 170480]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-1-31 158856]
S3 DrvAgent64;DrvAgent64;C:\Windows\SysWOW64\drivers\DrvAgent64.SYS [2011-1-26 21712]
S3 FACAP;facap, FastAccess Video Capture;C:\Windows\system32\DRIVERS\facap.sys --> C:\Windows\system32\DRIVERS\facap.sys [?]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 136176]
S3 HTCAND64;HTC Device Driver;C:\Windows\system32\Drivers\ANDROIDUSB.sys --> C:\Windows\system32\Drivers\ANDROIDUSB.sys [?]
S3 htcnprot;HTC NDIS Protocol Driver;C:\Windows\system32\DRIVERS\htcnprot.sys --> C:\Windows\system32\DRIVERS\htcnprot.sys [?]
S3 ivusb;Initio Driver for USB Default Controller;C:\Windows\system32\DRIVERS\ivusb.sys --> C:\Windows\system32\DRIVERS\ivusb.sys [?]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\system32\DRIVERS\LEqdUsb.Sys --> C:\Windows\system32\DRIVERS\LEqdUsb.Sys [?]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\system32\DRIVERS\LHidEqd.Sys --> C:\Windows\system32\DRIVERS\LHidEqd.Sys [?]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
S3 motccgp;Motorola USB Composite Device Driver;C:\Windows\system32\DRIVERS\motccgp.sys --> C:\Windows\system32\DRIVERS\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;C:\Windows\system32\DRIVERS\motccgpfl.sys --> C:\Windows\system32\DRIVERS\motccgpfl.sys [?]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2012-2-1 25072]
S3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;C:\Program Files (x86)\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [2008-8-14 313840]
S3 RoxMediaDB11;RoxMediaDB11;C:\Program Files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe [2008-8-14 1124848]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-12 13336]
S4 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-8-25 13672]
S4 RoxLiveShare11;LiveShare P2P Server 11;C:\Program Files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe [2008-8-14 309744]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
S4 XLServicePlatform;XLServicePlatform;C:\Windows\system32\svchost -k XLServicePlatform --> C:\Windows\system32\svchost -k XLServicePlatform [?]
.
=============== File Associations ===============
.
JSEFile=NOTEPAD.EXE %1
txtfile=C:\Windows\notepad.exe %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.
=============== Created Last 30 ================
.
2012-03-23 19:40:14	0	----a-w-	C:\ProgramData\xml5ACE.tmp
2012-03-23 19:40:12	0	----a-w-	C:\ProgramData\xml53BC.tmp
2012-03-23 17:56:24	0	----a-w-	C:\ProgramData\xml99D5.tmp
2012-03-23 17:56:23	0	----a-w-	C:\ProgramData\xml9571.tmp
2012-03-23 12:50:37	0	----a-w-	C:\ProgramData\xmlA583.tmp
2012-03-23 12:50:34	0	----a-w-	C:\ProgramData\xml9A5B.tmp
2012-03-22 22:33:35	592824	----a-w-	C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-22 22:33:35	44472	----a-w-	C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
2012-03-22 20:39:41	--------	d-sh--w-	C:\$RECYCLE.BIN
2012-03-22 19:26:39	--------	d-sh--r-	C:\360SANDBOX
2012-03-22 19:03:14	0	----a-w-	C:\ProgramData\xml4F87.tmp
2012-03-22 19:03:09	0	----a-w-	C:\ProgramData\xml3DAB.tmp
2012-03-22 00:24:46	0	----a-w-	C:\ProgramData\xml2B68.tmp
2012-03-22 00:24:45	0	----a-w-	C:\ProgramData\xml27BF.tmp
2012-03-21 22:15:55	0	----a-w-	C:\ProgramData\xml343D.tmp
2012-03-21 22:15:54	0	----a-w-	C:\ProgramData\xml319E.tmp
2012-03-21 22:15:53	13306	----a-w-	C:\ProgramData\xml2EEE.tmp
2012-03-21 22:15:48	6204	----a-w-	C:\ProgramData\xml190D.tmp
2012-03-21 22:03:41	--------	d--h--w-	C:\Windows\msdownld.tmp
2012-03-21 22:03:29	--------	d-----w-	C:\Windows\SysWow64\directx
2012-03-21 22:03:15	--------	d-----w-	C:\Program Files\SiSoftware
2012-03-19 20:41:10	--------	d-----w-	C:\Users\Bob\AppData\Roaming\SpeedMaxPc
2012-03-19 20:38:10	--------	d-----w-	C:\ProgramData\SpeedMaxPc
2012-03-14 00:20:13	5559152	----a-w-	C:\Windows\System32\ntoskrnl.exe
2012-03-14 00:20:12	3968368	----a-w-	C:\Windows\SysWow64\ntkrnlpa.exe
2012-03-14 00:20:12	3913584	----a-w-	C:\Windows\SysWow64\ntoskrnl.exe
2012-03-13 23:55:11	3145728	----a-w-	C:\Windows\System32\win32k.sys
2012-03-13 23:55:06	1544192	----a-w-	C:\Windows\System32\DWrite.dll
2012-03-13 23:55:06	1077248	----a-w-	C:\Windows\SysWow64\DWrite.dll
2012-03-13 18:06:50	9216	----a-w-	C:\Windows\System32\rdrmemptylst.exe
2012-03-13 18:06:50	149504	----a-w-	C:\Windows\System32\rdpcorekmts.dll
2012-03-13 18:06:49	77312	----a-w-	C:\Windows\System32\rdpwsx.dll
2012-03-13 18:06:46	1031680	----a-w-	C:\Windows\System32\rdpcore.dll
2012-03-13 18:06:45	826880	----a-w-	C:\Windows\SysWow64\rdpcore.dll
2012-03-13 18:06:45	23552	----a-w-	C:\Windows\System32\drivers\tdtcp.sys
2012-03-13 18:06:45	210944	----a-w-	C:\Windows\System32\drivers\rdpwd.sys
2012-03-13 01:33:53	274008	----a-w-	C:\Windows\System32\drivers\360Box64.sys
2012-03-12 14:22:06	--------	d-----w-	C:\Users\Bob\AppData\Roaming\360chrome
2012-03-12 13:34:32	159320	----a-w-	C:\Windows\SysWow64\drivers\360Box.sys
2012-03-12 13:32:12	--------	d-----w-	C:\Users\Bob\AppData\Roaming\360se
2012-03-12 13:31:06	--------	d-----w-	C:\Users\Bob\AppData\Roaming\360safe
2012-03-12 13:31:04	354904	----a-w-	C:\Windows\System32\drivers\360FsFlt.sys
2012-03-12 13:31:04	19712	----a-w-	C:\Windows\System32\drivers\efimon.sys
2012-03-12 13:31:04	168536	----a-w-	C:\Windows\System32\drivers\BAPIDRV64.SYS
2012-03-12 13:30:51	146776	----a-w-	C:\Windows\SysWow64\360SoftMgr.cpl
2012-03-12 13:30:50	56920	----a-w-	C:\Windows\System32\drivers\360netmon.sys
2012-03-12 13:30:46	32280	----a-w-	C:\Windows\SysWow64\drivers\360AntiARP.sys
2012-03-12 13:30:46	14080	----a-w-	C:\Windows\SysWow64\drivers\ProtoDrv.sys
2012-03-12 13:30:46	--------	d-----w-	C:\ProgramData\360safe
2012-03-12 13:30:05 --------	d-----w-	C:\Program Files (x86)\360[/COLOR]
2012-03-12 13:22:28	--------	d-----w-	C:\Users\Bob\AppData\Roaming\Kuu7
2012-03-12 00:56:33	--------	d-----w-	C:\Users\Bob\AppData\Local\Microsoft Games
.
==================== Find3M ====================
.
2012-03-25 18:12:59	17920	----a-w-	C:\Windows\System32\rpcnetp.exe
2012-03-25 18:12:57	52224	----a-w-	C:\Windows\SysWow64\rpcnet.dll
2012-03-08 02:04:18	414368	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-08 14:12:06	18760	----a-w-	C:\Windows\SysWow64\QQVistaHelper.dll
2012-01-06 23:18:26	5279504	----a-w-	C:\Windows\uninst.exe
2012-01-06 16:51:30	45568	----a-w-	C:\Windows\System32\iolobtdfg.exe
2012-01-06 16:51:20	14848	----a-w-	C:\Windows\System32\smrgdf.exe
2012-01-06 16:29:08	2141832	----a-w-	C:\Windows\System32\Incinerator64.dll
2012-01-06 16:29:06	2083464	----a-w-	C:\Windows\SysWow64\Incinerator32.dll
2012-01-04 10:44:20	509952	----a-w-	C:\Windows\System32\ntshrui.dll
2012-01-04 08:58:41	442880	----a-w-	C:\Windows\SysWow64\ntshrui.dll
2011-12-30 06:26:08	515584	----a-w-	C:\Windows\System32\timedate.cpl
2011-12-30 05:27:56	478720	----a-w-	C:\Windows\SysWow64\timedate.cpl
2011-12-29 07:38:04	79568	----a-w-	C:\Windows\xinstaller.dll
2011-12-29 07:38:04	34512	----a-w-	C:\Windows\xinstaller.exe
2011-12-28 03:59:24	498688	----a-w-	C:\Windows\System32\drivers\afd.sys
.
============= FINISH: 14:48:31.19 ===============

.---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Professional 
Boot Device: \Device\HarddiskVolume2
Install Date: 11/22/2010 7:16:49 PM
System Uptime: 3/25/2012 2:09:44 PM (0 hours ago)
.
Motherboard: Dell Inc. | | 0KM426
Processor: Intel(R) Core(TM) i7 CPU Q 720 @ 1.60GHz | U2E1 | 1600/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 451 GiB total, 316.51 GiB free.
D: is CDROM ()
F: is FIXED (NTFS) - 466 GiB total, 396.928 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0004
Manufacturer: Microsoft
Name: Microsoft ISATAP Adapter #5
PNP Device ID: ROOT\*ISATAP\0004
Service: tunnel
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Teredo Tunneling Adapter
Device ID: ROOT\*TEREDO\0000
Manufacturer: Microsoft
Name: Teredo Tunneling Pseudo-Interface
PNP Device ID: ROOT\*TEREDO\0000
Service: tunnel
.
Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Description: facap, FastAccess Video Capture
Device ID: ROOT\IMAGE\0000
Manufacturer: Sensible Vision
Name: facap, FastAccess Video Capture
PNP Device ID: ROOT\IMAGE\0000
Service: FACAP
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0000
Manufacturer: Microsoft
Name: Microsoft ISATAP Adapter
PNP Device ID: ROOT\*ISATAP\0000
Service: tunnel
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0001
Manufacturer: Microsoft
Name: Microsoft ISATAP Adapter #2
PNP Device ID: ROOT\*ISATAP\0001
Service: tunnel
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0002
Manufacturer: Microsoft
Name: Microsoft ISATAP Adapter #4
PNP Device ID: ROOT\*ISATAP\0002
Service: tunnel
.
==== System Restore Points ===================
.
RP271: 2/24/2012 8:06:40 PM - Windows Update
RP272: 3/4/2012 11:19:51 AM - Scheduled Checkpoint
RP273: 3/12/2012 1:30:36 PM - Scheduled Checkpoint
RP276: 3/13/2012 8:11:37 PM - Windows Update
RP279: 3/21/2012 6:00:50 PM - SiSoftware Sandra Lite
RP280: 3/21/2012 6:05:14 PM - Installed DirectX
RP281: 3/22/2012 6:42:20 PM - Removed Debugging Tools for Windows (x64)
RP282: 3/22/2012 6:43:11 PM - Removed Application Verifier (x64)
RP283: 3/25/2012 2:19:54 PM - SiSoftware Sandra Lite
.
==== Installed Programs ======================
.
.
Update for Microsoft Office 2007 (KB2508958)
ÀËÂþ×¯Ô°
ÃÎÖ®ÂÃ2 1.0
6400_Help
Absolute Notifier
AccelerometerP11
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Reader X (10.1.2)
Adobe Shockwave Player 11.6
Advanced Audio FX Engine
AnswerWorks 5.0 English Runtime
BlackBerry Desktop Software 6.1
bpd_scan
BPDSoftware
BPDSoftware_Ini
BufferChm
CA Yahoo! Anti-Spy (remove only)
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CCScore
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
CNET TechTracker
Core FTP LE
Coupon Printer for Windows
D3DX10
Dell Dock
Dell Driver Download Manager
Dell Resource CD
Dell Webcam Central
Destinations
DeviceDiscovery
DirectX 9 Runtime
DocProc
Driver Manager
easyMule
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSTOOLS
essvatgt
Fax
ffdshow
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
GoToAssist Corporate
GPBaseService2
HP Product Detection
HP Update
HPDiagnosticAlert
HPProductAssistant
HTC BMP USB Driver
HTC Driver Installer
HTC Sync
IDT Audio
Imagic 5
Imagic 5.0
Intel(R) Control Center
Intel(R) Rapid Storage Technology
Internet TV for Windows Media Center
iolo technologies' System Mechanic
J6400
Java Auto Updater
Java(TM) 7 Update 2
Junk Mail filter update
Kodak EasyShare software
Live! Cam Avatar Creator
lovebeautyhope_3130187 Screen Saver
Malwarebytes Anti-Malware version 1.60.1.1000
MarketResearch
McAfee Online Backup
McAfee Security Scan Plus
McAfee Total Protection
Memeo AutoSync
Memeo Instant Backup
Mesh Runtime
Messenger Companion
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access database engine 2007 (English)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Project Professional 2010
Microsoft Office Proof (English) 2007
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2007
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing (English) 2010
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Streets & Trips 2009
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox 11.0 (x86 en-US)
Mozilla Thunderbird 10.0.2 (x86 en-US)
MpcStar 5.4
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB973685)
netbrdg
OfotoXMI
OpenOffice.org 3.3
PowerDVD DX
ProductContext
Quicken 2011
Quicken WillMaker Plus 2011
Readiris Pro 12
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek Ethernet Controller Driver
RealUpgrade 1.1
Revo Uninstaller 1.93
RICOH Media Driver ver.2.11.01.02
RICOH R5U230 Media Driver ver.2.03.02.02
RootsMagic 5.0.2.1
Roxio Burn
Roxio CinePlayer
Roxio CinePlayer Decoder Pack
Roxio Creator 2009
Roxio Creator 2011 Content
Roxio Creator 2011 Plus
Roxio PhotoShow
Roxio Streamer Desktop Applications
Roxio Video Capture USB
Samsung Master
Scan
Seagate Dashboard
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
SFR
SHASTA
skin0001
SKINXSDK
Skype Click to Call
Skype 5.8
SmartSound Common Data
SmartSound Quicktracks 5
SmartSound Quicktracks Plugin
SolutionCenter
staticcr
Status
swMSM
System Requirements Lab for Intel
Tencent QQ
Toolbox
TrayApp
TrueCrypt
TurboTax 2010
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wmiiper
TurboTax 2010 wrapper
TurboTax 2011
TurboTax 2011 WinPerFedFormset
TurboTax 2011 WinPerReleaseEngine
TurboTax 2011 WinPerTaxSupport
TurboTax 2011 wmiiper
TurboTax 2011 wrapper
Uniblue DriverScanner
Uniblue RegistryBooster
Uniblue SpeedUpMyPC
Uniblue SystemTweaker
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VPRINTOL
WebReg
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Center Add-in for Flash
WinZip 15.5
WinZip Courier
WIRELESS
Yahoo! BrowserPlus 2.9.8
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar
.
==== Event Viewer Messages From Past Week ========
.
3/25/2012 2:14:24 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: RxFilter
3/25/2012 2:12:56 PM, Error: Service Control Manager [7009] - A timeout was reached (120000 milliseconds) while waiting for the Roxio Hard Drive Watcher 12 service to connect.
3/23/2012 3:00:29 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
.
==== End Of File ===========================


----------



## rfeichel (Jun 11, 2007)

I used copy/paste, I hope that is okay. Any filename which includes "360" are the problem files.


----------



## dvk01 (Dec 14, 2002)

OK I can see what needs doing so we can use combofix to deal with them 
Delete any existing version of ComboFix you have sitting on your desktop
*Please read and follow all these instructions very carefully*​* Do not edit or remove any information or user names etc, otherwise we cannot fix the problem. If you insist on editing out anything then I will close the topic & refuse to offer any help.  *

Download ComboFix from *Here* or * Here*to your Desktop.
*As you download it rename it to username123.exe*

***Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer***
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.


*Very Important!* *Temporarily disable* your *anti-virus* and *anti-malware* real-time protection and any *script blocking components of them or your firewall*_* before* _performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause _"unpredictable results" or stop combofix running at all_
Click on *THIS LINK * to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
*Remember to re enable the protection again after combofix has finished*
--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running 
Double click on *renamed combofix.exe* & follow the prompts.​If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
When finished, it will produce a report for you. 
Please post the *"C:\ComboFix.txt" * for further review

*****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze *****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read  HERE  why we disable autoruns

*Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version. *

Please tell us if it has cured the problems or if there are any outstanding issues


----------



## rfeichel (Jun 11, 2007)

I performed the above actions as you outlined. The files are still here. If you need/want the combofix log I have it saved


----------



## rfeichel (Jun 11, 2007)

ComboFix did delete 360 named files in a different folder. I was unaware of those files. However, the files I am referring to are in the Program Files (x86) folder.


----------



## dvk01 (Dec 14, 2002)

I know the files will still be there
post the combofix log 
If you don't do exactly what I ask you to, it gets very difficult to help you


----------



## rfeichel (Jun 11, 2007)

ComboFix 12-03-22.01 - Bob 03/25/2012 17:34:39.1.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.6132.3781 [GMT -4:00]
Running from: c:\users\Bob\Desktop\rfeichel123.exe.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\boost_interprocess\20120313080009.595198
c:\programdata\xml190D.tmp
c:\programdata\xml27BF.tmp
c:\programdata\xml2B68.tmp
c:\programdata\xml2EEE.tmp
c:\programdata\xml319E.tmp
c:\programdata\xml343D.tmp
c:\programdata\xml3DAB.tmp
c:\programdata\xml4F87.tmp
c:\programdata\xml53BC.tmp
c:\programdata\xml5ACE.tmp
c:\programdata\xml9571.tmp
c:\programdata\xml99D5.tmp
c:\programdata\xml9A5B.tmp
c:\programdata\xmlA583.tmp
c:\users\Bob\AppData\Roaming\360SE
c:\users\Bob\AppData\Roaming\360SE\360SE.ini
c:\users\Bob\AppData\Roaming\360SE\data\360sefav.db
c:\users\Bob\AppData\Roaming\360SE\data\history.dat
c:\users\Bob\AppData\Roaming\360SE\data\ico\avc.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\cn.bing.com.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\cz.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\ddt.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\dgcs.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\dh.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\farm.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\hao.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\hero.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\mcsd.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\me.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\plsm.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\poker.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\se.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\search8.taobao.com.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\www.baidu.com.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\www.bing.com.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\www.google.com.hk.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\www.qihoo.com.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\www.sogou.com.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\www.youdao.com.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\wxfy.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\yahoo.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\ico\zqjl.wan.360.cn.ico
c:\users\Bob\AppData\Roaming\360SE\data\switch.ini
c:\users\Bob\AppData\Roaming\360SE\extensions\ExtDoctor\ExtDoctor.ini
c:\users\Bob\AppData\Roaming\360SE\extensions\Favorites\titleopt.dll
c:\users\Bob\AppData\Roaming\360SE\extensions\SafeCentral\esimple.ini
c:\users\Bob\AppData\Roaming\360SE\extensions\SafeCentral\SafeCentral.ini
c:\users\Bob\AppData\Roaming\360SE\extensions\SafeCentral\SafeProtect.dat
c:\users\Bob\AppData\Roaming\360SE\extensions\SafeCentral\urllib.dat
c:\users\Bob\AppData\Roaming\360SE\seup.ini
c:\users\Bob\GoToAssistDownloadHelper.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-02-25 to 2012-03-25 )))))))))))))))))))))))))))))))
.
.
2012-03-22 22:33 . 2012-03-22 22:33	592824	----a-w-	c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-22 22:33 . 2012-03-22 22:33	44472	----a-w-	c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-22 19:26 . 2012-03-22 19:26	--------	d-----r-	C:\360SANDBOX
2012-03-22 16:22 . 2012-03-22 16:26	--------	d-----w-	c:\users\Administrator
2012-03-21 22:03 . 2012-03-21 22:03	--------	d-----w-	c:\program files\SiSoftware
2012-03-19 20:41 . 2012-03-19 20:41	--------	d-----w-	c:\users\Bob\AppData\Roaming\SpeedMaxPc
2012-03-19 20:38 . 2012-03-19 20:44	--------	d-----w-	c:\programdata\SpeedMaxPc
2012-03-14 00:20 . 2011-11-19 15:20	5559152	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-03-14 00:20 . 2011-11-19 14:50	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 00:20 . 2011-11-19 14:50	3913584	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-03-13 23:55 . 2012-02-03 04:34	3145728	----a-w-	c:\windows\system32\win32k.sys
2012-03-13 23:55 . 2012-02-10 06:36	1544192	----a-w-	c:\windows\system32\DWrite.dll
2012-03-13 23:55 . 2012-02-10 05:38	1077248	----a-w-	c:\windows\SysWow64\DWrite.dll
2012-03-13 18:06 . 2012-01-25 06:38	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-03-13 18:06 . 2012-01-25 06:33	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-03-13 18:06 . 2012-01-25 06:38	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-03-13 18:06 . 2012-02-17 06:38	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-03-13 18:06 . 2012-02-17 05:34	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-03-13 18:06 . 2012-02-17 04:58	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-03-13 18:06 . 2012-02-17 04:57	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-03-13 01:33 . 2011-12-23 08:35	274008	----a-w-	c:\windows\system32\drivers\360Box64.sys
2012-03-12 14:22 . 2012-03-12 14:22	--------	d-----w-	c:\users\Bob\AppData\Roaming\360chrome
2012-03-12 13:34 . 2011-07-26 09:41	159320	----a-w-	c:\windows\SysWow64\drivers\360Box.sys
2012-03-12 13:31 . 2012-03-22 19:02	--------	d-----w-	c:\users\Bob\AppData\Roaming\360safe
2012-03-12 13:31 . 2012-02-21 02:45	354904	----a-w-	c:\windows\system32\drivers\360FsFlt.sys
2012-03-12 13:31 . 2011-04-22 09:51	168536	----a-w-	c:\windows\system32\drivers\BAPIDRV64.SYS
2012-03-12 13:31 . 2010-08-13 10:54	19712	----a-w-	c:\windows\system32\drivers\efimon.sys
2012-03-12 13:30 . 2011-11-11 11:31	146776	----a-w-	c:\windows\SysWow64\360SoftMgr.cpl
2012-03-12 13:30 . 2011-04-02 05:48	56920	----a-w-	c:\windows\system32\drivers\360netmon.sys
2012-03-12 13:30 . 2012-03-22 18:50	--------	d-----w-	c:\programdata\360safe
2012-03-12 13:30 . 2011-10-26 11:35	32280	----a-w-	c:\windows\SysWow64\drivers\360AntiARP.sys
2012-03-12 13:30 . 2009-07-21 12:24	14080	----a-w-	c:\windows\SysWow64\drivers\ProtoDrv.sys
2012-03-12 13:30 . 2012-03-13 11:32	--------	d-----w-	c:\program files (x86)\360
2012-03-12 13:22 . 2012-03-22 15:45	--------	d-----w-	c:\users\Bob\AppData\Roaming\KuGou7
2012-03-12 00:56 . 2012-03-12 01:00	--------	d-----w-	c:\users\Bob\AppData\Local\Microsoft Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-25 21:48 . 2011-11-05 19:51	17920	----a-w-	c:\windows\system32\rpcnetp.exe
2012-03-25 21:48 . 2010-11-30 12:56	52224	----a-w-	c:\windows\SysWow64\rpcnet.dll
2012-03-08 02:04 . 2011-06-07 22:09	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-08 14:13 . 2012-02-08 14:13	61440	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe
2012-02-08 14:13 . 2012-02-08 14:13	61440	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\ARPPRODUCTICON.exe
2012-02-08 14:13 . 2012-02-08 14:13	106496	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut31_2F252077BA3F4362913955273A708467.exe
2012-02-08 14:13 . 2012-02-08 14:13	106496	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe
2012-02-08 14:13 . 2010-12-15 14:28	106496	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe
2012-02-08 14:12 . 2010-12-15 14:27	18760	----a-w-	c:\windows\SysWow64\QQVistaHelper.dll
2012-01-06 23:18 . 2011-11-11 22:58	5279504	----a-w-	c:\windows\uninst.exe
2012-01-06 16:51 . 2011-10-24 16:30	45568	----a-w-	c:\windows\system32\iolobtdfg.exe
2012-01-06 16:51 . 2011-10-24 16:30	14848	----a-w-	c:\windows\system32\smrgdf.exe
2012-01-06 16:29 . 2011-10-24 16:30	2141832	----a-w-	c:\windows\system32\Incinerator64.dll
2012-01-06 16:29 . 2011-10-24 16:30	2083464	----a-w-	c:\windows\SysWow64\Incinerator32.dll
2012-01-04 10:44 . 2012-02-15 12:24	509952	----a-w-	c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-15 12:24	442880	----a-w-	c:\windows\SysWow64\ntshrui.dll
2011-12-30 06:26 . 2012-02-15 12:24	515584	----a-w-	c:\windows\system32\timedate.cpl
2011-12-30 05:27 . 2012-02-15 12:24	478720	----a-w-	c:\windows\SysWow64\timedate.cpl
2011-12-29 07:38 . 2011-12-29 07:38	79568	----a-w-	c:\windows\xinstaller.dll
2011-12-29 07:38 . 2011-12-29 07:38	34512	----a-w-	c:\windows\xinstaller.exe
2011-12-28 03:59 . 2012-02-15 12:23	498688	----a-w-	c:\windows\system32\drivers\afd.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{0A0DDBD3-6641-40B9-873F-BBDD26D6C14E}]
2011-11-10 06:47	176128	----a-w-	c:\program files (x86)\easyMule\modules\IE2EM.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{0EA37B17-6B8B-4085-8257-F3A4AA69C27A}]
2012-01-04 09:29	87728	----a-w-	c:\program files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.6.69.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-10-10 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe" [2010-07-16 307184]
"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"Seagate Dashboard"="c:\program files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe" [2011-06-01 79112]
"Memeo AutoSync"="c:\program files (x86)\Memeo\AutoSync\MemeoLauncher2.exe" [2011-05-04 144608]
"Memeo Instant Backup"="c:\program files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe" [2011-05-04 136416]
"iolo Startup"="c:\program files (x86)\iolo\Common\Lib\ioloLManager.exe" [2012-01-06 606904]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-11-22 1675160]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
"Absolute Notifier"="c:\program files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe" [2011-05-10 85672]
"FATrayAlert"="c:\program files (x86)\Sensible Vision\Fast Access\FATrayMon.exe" [2009-06-25 95496]
"HTC Sync Loader"="c:\program files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2011-12-20 634880]
"360Safetray"="c:\program files (x86)\360\360Safe\safemon\360Tray.exe" [2012-01-15 859736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\FastAccess]
2009-06-25 19:09	140552	----a-w-	c:\program files (x86)\Sensible Vision\Fast Access\FALogNot.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ autocheck autochk /p \??\c:\0autocheck autochk /r \??\E:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ scecli FAPassSync
Security Packages	REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rpcnet]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 136176]
R2 Roxio Upnp Server 11;Roxio Upnp Server 11;c:\program files (x86)\Roxio Creator 2009\Digital Home 11\RoxioUpnpService11.exe [2008-08-14 367088]
R2 RoxWatch11;Roxio Hard Drive Watcher 11;c:\program files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe [2008-08-14 170480]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe [2010-07-16 354288]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R3 ALSysIO;ALSysIO; [x]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-01-26 21712]
R3 FACAP;facap, FastAccess Video Capture;c:\windows\system32\DRIVERS\facap.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 136176]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [x]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [x]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-02-01 25072]
R3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;c:\program files (x86)\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [2008-08-14 313840]
R3 RoxMediaDB11;RoxMediaDB11;c:\program files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe [2008-08-14 1124848]
R3 RoxMediaDB13;RoxMediaDB13;c:\program files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe [2010-07-16 1099248]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
R4 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-08-25 13672]
R4 RoxLiveShare11;LiveShare P2P Server 11;c:\program files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe [2008-08-14 309744]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
R4 XLServicePlatform;XLServicePlatform;c:\windows\system32\svchost [x]
R4 ZhuDongFangYu;????;c:\program files (x86)\360\360Safe\deepscan\ZhuDongFangYu.exe [2012-02-17 276960]
S0 McPvDrv;McPvDrv Driver;c:\windows\system32\drivers\McPvDrv.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [x]
S1 360Box64;360Box mini-filter driver;c:\windows\system32\DRIVERS\360Box64.sys [x]
S1 360FsFlt;360FsFlt mini-filter driver;c:\windows\system32\DRIVERS\360FsFlt.sys [x]
S1 360netmon;360netmon;c:\windows\system32\DRIVERS\360netmon.sys [x]
S1 BAPIDRV;BAPIDRV;c:\windows\System32\Drivers\BAPIDRV64.SYS [x]
S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S1 MOBKFilter;MOBKFilter;c:\windows\system32\DRIVERS\MOBK.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AbsoluteNotifier;Absolute Notifier;c:\program files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2011-05-10 10920]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2010-12-02 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2010-01-11 155648]
S2 FAService;FAService;c:\program files (x86)\Sensible Vision\Fast Access\FAService.exe [2009-06-25 2368776]
S2 HipServ;HipServ for Windows;c:\program files\Roxio\Roxio Streamer\srvstart\srvstart.exe [2010-05-25 268288]
S2 HipServUsbDetection;USB detection service for HipServ;c:\program files\Roxio\Roxio Streamer\usb_detection.exe [2010-06-22 19968]
S2 ioloSystemService;iolo System Service;c:\program files (x86)\iolo\Common\Lib\ioloServiceManager.exe [2012-01-06 722616]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2011-05-04 25824]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-10-18 208536]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 MOBKbackup;McAfee Online Backup;c:\program files (x86)\McAfee Online Backup\MOBKbackup.exe [2010-04-14 231224]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-09-15 88576]
S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys [x]
S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [x]
S2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys [x]
S2 rpcld;Remote Procedure Call (RPC) LD;c:\programdata\Rpcnet\Bin\rpcld.exe [x]
S2 SeagateDashboardService;Seagate Dashboard Service;c:\program files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe [2011-06-01 14088]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-03-04 658656]
S2 VBoxDrv;VBox Support Driver;c:\program files\Roxio\Roxio Streamer\VBoxDrv.sys [2010-06-17 193928]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - ioloSGuardDriver
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ hpqcxs08 hpqddsvc
iissvcs	REG_MULTI_SZ w3svc was
apphost	REG_MULTI_SZ apphostsvc
DoctorService	REG_MULTI_SZ XLDoctor Service
XLServicePlatform	REG_MULTI_SZ XLServicePlatform
.
Contents of the 'Scheduled Tasks' folder
.
2012-03-25 c:\windows\Tasks\DriverScanner.job
- c:\program files (x86)\Uniblue\DriverScanner\dsmonitor.exe [2012-01-01 18:43]
.
2012-03-23 c:\windows\Tasks\EasyShare Registration Task.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2012-03-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 23:38]
.
2012-03-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 23:38]
.
2012-03-06 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32]
.
2012-03-25 c:\windows\Tasks\RegistryBooster.job
- c:\program files (x86)\Uniblue\RegistryBooster\rbmonitor.exe [2012-01-08 08:26]
.
2012-03-25 c:\windows\Tasks\SpeedUpMyPC.job
- c:\program files (x86)\Uniblue\SpeedUpMyPC\spmonitor.exe [2012-01-08 20:28]
.
2012-03-25 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{004B0726-A010-4ABF-8556-FCDB7F1FCA1E}]
2012-01-04 09:29	627888	----a-w-	c:\program files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.2.5.3364.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\360UDiskGuard Icon Overlay]
@="{CC00F81D-5262-450A-B1FA-D6BEE3406263}"
[HKEY_CLASSES_ROOT\CLSID\{CC00F81D-5262-450A-B1FA-D6BEE3406263}]
2012-01-16 07:29	194152	----a-w-	c:\program files (x86)\360\360Safe\safemon\360UDiskGuard64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK]
@="{3c3f3c1a-9153-7c05-f938-622e7003894d}"
[HKEY_CLASSES_ROOT\CLSID\{3c3f3c1a-9153-7c05-f938-622e7003894d}]
2010-04-14 00:11	3816248	----a-w-	c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK2]
@="{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}"
[HKEY_CLASSES_ROOT\CLSID\{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}]
2010-04-14 00:11	3816248	----a-w-	c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK3]
@="{b4caf489-1eec-c617-49ad-8d7088598c06}"
[HKEY_CLASSES_ROOT\CLSID\{b4caf489-1eec-c617-49ad-8d7088598c06}]
2010-04-14 00:11	3816248	----a-w-	c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.earthlink.net/
mStart Page = hxxp://search.foxtab.com/?s=0&chnl=dcom&cd=2XzutBtN2Y1L1QzutD0C0E0E0EyC0B0BtBtB0DzyyDyBtCyCzztN0D0TzutBtDtCtCtCtDtBtC&cr=1888191386
IE: &Ê¹ÓÃ&Ñ¸À×ÀëÏßÏÂÔØ - c:\program files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
IE: &Ê¹ÓÃ&Ñ¸À×ÏÂÔØ - c:\program files (x86)\Thunder Network\Thunder\BHO\geturl.htm
IE: &Ê¹ÓÃ&Ñ¸À×ÏÂÔØÈ«²¿Á´½Ó - c:\program files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
IE: Download by easyMule - c:\program files (x86)\easyMule\IE2EM.htm
IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436}
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 10.0.0.1
DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
txtfile=c:\windows\notepad.exe %1
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{28387537-e3f9-4ed7-860c-11e69af4a8a0} - (no file)
Toolbar-{28387537-e3f9-4ed7-860c-11e69af4a8a0} - (no file)
ShellIconOverlayIdentifiers-{4562B511-62E9-4533-B7B2-56A8BB10B482} - (no file)
Wow6432Node-HKLM-Run-FAStartup - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2804872291-2678155072-1612828925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (S-1-5-21-2804872291-2678155072-1612828925-1000)
@Denied: (2) (LocalSystem)
"Progid"="ThunderbirdEML"
.
[HKEY_USERS\S-1-5-21-2804872291-2678155072-1612828925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\iolo\System Mechanic\SystemGuardAlerter.exe
c:\windows\SysWOW64\rpcnet.exe
.
**************************************************************************
.
Completion time: 2012-03-25 17:56:21 - machine was rebooted
ComboFix-quarantined-files.txt 2012-03-25 21:56
.
Pre-Run: 339,705,171,968 bytes free
Post-Run: 340,930,793,472 bytes free
.
- - End Of File - - B72BA3B6D3DA30ECA0C0CEE39FAF07F6


----------



## dvk01 (Dec 14, 2002)

Download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press *SAVE * and choose desktop in the list of selections in that window & press save)

*Disable any antivirus/antimalware/firewall realtime protection or script blocking in the same way you did previously before running combofix & remember to re-enable it when it has finished *

Close any open browsers 
Then drag the CFScript.txt into the ComboFix.exe or renamed combofix icon as shown in the screenshot below.










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply .

*Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum *


----------



## rfeichel (Jun 11, 2007)

ComboFix 12-03-22.01 - Bob 03/26/2012 17:22:26.2.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.6132.3655 [GMT -4:00]
Running from: c:\users\Bob\Desktop\rfeichel123.exe.exe
Command switches used :: c:\users\Bob\Desktop\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\drivers\360Box64.sys"
"c:\windows\system32\drivers\360FsFlt.sys"
"c:\windows\system32\drivers\360netmon.sys"
"c:\windows\system32\drivers\BAPIDRV64.SYS"
"c:\windows\system32\drivers\efimon.sys"
"c:\windows\SysWow64\360SoftMgr.cpl"
"c:\windows\SysWow64\drivers\360AntiARP.sys"
"c:\windows\SysWow64\drivers\360Box.sys"
"c:\windows\SysWow64\drivers\ProtoDrv.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\360SANDBOX
c:\360sandbox\360SandBox.sav
c:\360sandbox\360SandBox.sav.LOG1
c:\360sandbox\360SandBox.sav.LOG2
c:\360sandbox\360SandBox.sav{e66159a6-7454-11e1-9ae4-806e6f6e6963}.TM.blf
c:\360sandbox\360SandBox.sav{e66159a6-7454-11e1-9ae4-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
c:\360sandbox\360SandBox.sav{e66159a6-7454-11e1-9ae4-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
c:\program files (x86)\360
c:\program files (x86)\360\360Safe\360AppLoader.exe
c:\program files (x86)\360\360Safe\360Base.dll
c:\program files (x86)\360\360Safe\360Common.dll
c:\program files (x86)\360\360Safe\360Conf.dll
c:\program files (x86)\360\360Safe\360DeskAna.exe
c:\program files (x86)\360\360Safe\360DeskAna64.exe
c:\program files (x86)\360\360Safe\360DiagnoseScan.exe
c:\program files (x86)\360\360Safe\360Examin.dll
c:\program files (x86)\360\360Safe\360ExaminUI.dll
c:\program files (x86)\360\360Safe\360Integration.dll
c:\program files (x86)\360\360Safe\360leakfixer.exe
c:\program files (x86)\360\360Safe\360leakfixer.leakrepair.som.log
c:\program files (x86)\360\360Safe\360LeakFixPlugin.dll
c:\program files (x86)\360\360Safe\360MicroExamin.exe
c:\program files (x86)\360\360Safe\360MicroExamin.leakrepair.som.log
c:\program files (x86)\360\360Safe\360net.dll
c:\program files (x86)\360\360Safe\360NetUL.dll
c:\program files (x86)\360\360Safe\360P2SP.dll
c:\program files (x86)\360\360Safe\360Restore.exe
c:\program files (x86)\360\360Safe\360Safe.exe
c:\program files (x86)\360\360Safe\360Safe.leakrepair.som.log
c:\program files (x86)\360\360Safe\360Safe.log
c:\program files (x86)\360\360Safe\360safe.setup.log
c:\program files (x86)\360\360Safe\360ShellPro.exe
c:\program files (x86)\360\360Safe\360ver.dll
c:\program files (x86)\360\360Safe\360Verify.dll
c:\program files (x86)\360\360Safe\AntiAdwa.dll
c:\program files (x86)\360\360Safe\antiarp\360AntiARP.sys
c:\program files (x86)\360\360Safe\antiarp\360FE80.tmp
c:\program files (x86)\360\360Safe\antiarp\dpath.ini
c:\program files (x86)\360\360Safe\antiarp\fixedwl.dat
c:\program files (x86)\360\360Safe\antiarp\packet.inf
c:\program files (x86)\360\360Safe\antiarp\ProtoDrv.sys
c:\program files (x86)\360\360Safe\antiarp\snetcfg.exe
c:\program files (x86)\360\360Safe\antiarp\x64\360AntiARP_x64.inf
c:\program files (x86)\360\360Safe\antiarp\x64\360AntiARP_x64.sys
c:\program files (x86)\360\360Safe\antiarp\x64\packet_x64.inf
c:\program files (x86)\360\360Safe\antiarp\x64\ProtoDrv_x64.sys
c:\program files (x86)\360\360Safe\antiarp\x64\SetupArpX64.exe
c:\program files (x86)\360\360Safe\AntiEng.dll
c:\program files (x86)\360\360Safe\AntiRK.dll
c:\program files (x86)\360\360Safe\BaseExamine.dll
c:\program files (x86)\360\360Safe\BrowserConfigFileInfo.dat
c:\program files (x86)\360\360Safe\CheckAutorun.dll
c:\program files (x86)\360\360Safe\CombineExt.dll
c:\program files (x86)\360\360Safe\Config\2012NewYear\2012NewYear.ui
c:\program files (x86)\360\360Safe\Config\2012NewYear\MiniUI.xml
c:\program files (x86)\360\360Safe\Config\2012NewYear\skin.jpg
c:\program files (x86)\360\360Safe\Config\360MicroExamin.xml
c:\program files (x86)\360\360Safe\Config\360Safe.xml
c:\program files (x86)\360\360Safe\Config\360startup.ini
c:\program files (x86)\360\360Safe\Config\360Unlock.xml
c:\program files (x86)\360\360Safe\Config\AdvTools.xml
c:\program files (x86)\360\360Safe\Config\advtools\AdvTools.ui
c:\program files (x86)\360\360Safe\Config\AdvTools1.xml
c:\program files (x86)\360\360Safe\Config\antiadwa.ini
c:\program files (x86)\360\360Safe\Config\antiadwa_leak.ini
c:\program files (x86)\360\360Safe\Config\BaseExamineConfig.xml
c:\program files (x86)\360\360Safe\Config\BaseExamineConfig_bg.xml
c:\program files (x86)\360\360Safe\Config\BaseExamineConfig1.xml
c:\program files (x86)\360\360Safe\Config\Classic\Classic.ui
c:\program files (x86)\360\360Safe\Config\Classic\MiniUI.xml
c:\program files (x86)\360\360Safe\Config\Classic\skin.jpg
c:\program files (x86)\360\360Safe\Config\config.xml
c:\program files (x86)\360\360Safe\Config\defaultskin\defaultskin.ui
c:\program files (x86)\360\360Safe\Config\defaultskin\MiniUI.xml
c:\program files (x86)\360\360Safe\Config\defaultskin\Skin.jpg
c:\program files (x86)\360\360Safe\Config\ElegantJazz\ElegantJazz.ui
c:\program files (x86)\360\360Safe\Config\ElegantJazz\MiniUI.xml
c:\program files (x86)\360\360Safe\Config\ElegantJazz\skin.jpg
c:\program files (x86)\360\360Safe\Config\ExaminCloudScan.ini
c:\program files (x86)\360\360Safe\Config\ExaminePlugin.xml
c:\program files (x86)\360\360Safe\Config\ExaminePlugin_bg.xml
c:\program files (x86)\360\360Safe\Config\ExaminePlugin_leak.xml
c:\program files (x86)\360\360Safe\Config\ExaminePlugin_leakcloud.xml
c:\program files (x86)\360\360Safe\Config\examinui.db
c:\program files (x86)\360\360Safe\Config\ExaminUI.xml
c:\program files (x86)\360\360Safe\Config\FileSmash.xml
c:\program files (x86)\360\360Safe\Config\GreenWorld\GreenWorld.ui
c:\program files (x86)\360\360Safe\Config\GreenWorld\MiniUI.xml
c:\program files (x86)\360\360Safe\Config\GreenWorld\skin.jpg
c:\program files (x86)\360\360Safe\Config\IntegrationExamConfig.xml
c:\program files (x86)\360\360Safe\Config\LSPFix.xml
c:\program files (x86)\360\360Safe\Config\MysteriousSky\MiniUI.xml
c:\program files (x86)\360\360Safe\Config\MysteriousSky\MysteriousSky.ui
c:\program files (x86)\360\360Safe\Config\MysteriousSky\skin.jpg
c:\program files (x86)\360\360Safe\Config\OldWood\MiniUI.xml
c:\program files (x86)\360\360Safe\Config\OldWood\OldWood.ui
c:\program files (x86)\360\360Safe\Config\OldWood\skin.jpg
c:\program files (x86)\360\360Safe\Config\PinkLove\MiniUI.xml
c:\program files (x86)\360\360Safe\Config\PinkLove\PinkLove.ui
c:\program files (x86)\360\360Safe\Config\PinkLove\skin.jpg
c:\program files (x86)\360\360Safe\Config\PluginCleaner.xml
c:\program files (x86)\360\360Safe\Config\RestoreConfig.xml
c:\program files (x86)\360\360Safe\Config\spack\MiniUI.xml
c:\program files (x86)\360\360Safe\Config\spack\skin.jpg
c:\program files (x86)\360\360Safe\Config\spack\spack.ui
c:\program files (x86)\360\360Safe\CrashReport.dll
c:\program files (x86)\360\360Safe\deepscan\360FsFlt.sys
c:\program files (x86)\360\360Safe\deepscan\360MalwareSection.dll
c:\program files (x86)\360\360Safe\deepscan\360netcfg.exe
c:\program files (x86)\360\360Safe\deepscan\360UC.dll
c:\program files (x86)\360\360Safe\deepscan\360upk.dll
c:\program files (x86)\360\360Safe\deepscan\APKCheck.dll
c:\program files (x86)\360\360Safe\deepscan\art.dat
c:\program files (x86)\360\360Safe\deepscan\ave\360ave.def
c:\program files (x86)\360\360Safe\deepscan\ave\AVEI.dll
c:\program files (x86)\360\360Safe\deepscan\ave\AVEngine.dll
c:\program files (x86)\360\360Safe\deepscan\BAPI.dll
c:\program files (x86)\360\360Safe\deepscan\BAPIDRV.sys
c:\program files (x86)\360\360Safe\deepscan\BAPIDRV64.sys
c:\program files (x86)\360\360Safe\deepscan\cloudcom2.dll
c:\program files (x86)\360\360Safe\deepscan\CloudEngine.dll
c:\program files (x86)\360\360Safe\deepscan\cloudsec2.dll
c:\program files (x86)\360\360Safe\deepscan\cpr.dat
c:\program files (x86)\360\360Safe\deepscan\CQhCltHttpW.dll
c:\program files (x86)\360\360Safe\deepscan\deepscan.dll
c:\program files (x86)\360\360Safe\deepscan\dsbs.dat
c:\program files (x86)\360\360Safe\deepscan\dscon.dat
c:\program files (x86)\360\360Safe\deepscan\DsExtend.dll
c:\program files (x86)\360\360Safe\deepscan\DSFScan.dll
c:\program files (x86)\360\360Safe\deepscan\DSMain.exe
c:\program files (x86)\360\360Safe\deepscan\DSMainUI.dll
c:\program files (x86)\360\360Safe\deepscan\dsplus.dll
c:\program files (x86)\360\360Safe\deepscan\dsr.dat
c:\program files (x86)\360\360Safe\deepscan\DsSysRepair.dll
c:\program files (x86)\360\360Safe\deepscan\dswc.dat
c:\program files (x86)\360\360Safe\deepscan\dsws.dat
c:\program files (x86)\360\360Safe\deepscan\dswtb.dat
c:\program files (x86)\360\360Safe\deepscan\heavygate.dll
c:\program files (x86)\360\360Safe\deepscan\Identify\Identify.dll
c:\program files (x86)\360\360Safe\deepscan\netconf.dat
c:\program files (x86)\360\360Safe\deepscan\pttlnkgkillers.dll
c:\program files (x86)\360\360Safe\deepscan\Qshield.dat
c:\program files (x86)\360\360Safe\deepscan\qutmdrv.sys
c:\program files (x86)\360\360Safe\deepscan\qutmload.dll
c:\program files (x86)\360\360Safe\deepscan\QVM\360QVM.dll
c:\program files (x86)\360\360Safe\deepscan\sc.con
c:\program files (x86)\360\360Safe\deepscan\SDEng\Call360SD.dll
c:\program files (x86)\360\360Safe\deepscan\Section\list_v01.db
c:\program files (x86)\360\360Safe\deepscan\softcheck.dll
c:\program files (x86)\360\360Safe\deepscan\speedmem2.hg
c:\program files (x86)\360\360Safe\deepscan\ssr.dat
c:\program files (x86)\360\360Safe\deepscan\sysfilerepS.dll
c:\program files (x86)\360\360Safe\deepscan\uiitem.dat
c:\program files (x86)\360\360Safe\deepscan\ZhuDongFangYu.exe
c:\program files (x86)\360\360Safe\DumpReport.exe
c:\program files (x86)\360\360Safe\DumpUper.exe
c:\program files (x86)\360\360Safe\DumpUper.ini
c:\program files (x86)\360\360Safe\dynlbase.dll
c:\program files (x86)\360\360Safe\dynlenv.dll
c:\program files (x86)\360\360Safe\EfiMon.sys
c:\program files (x86)\360\360Safe\EfiProc.dll
c:\program files (x86)\360\360Safe\endata\aw_1001.dat
c:\program files (x86)\360\360Safe\endata\aw_1002.dat
c:\program files (x86)\360\360Safe\endata\aw_1003.dat
c:\program files (x86)\360\360Safe\endata\aw_1004.dat
c:\program files (x86)\360\360Safe\endata\aw_1006.dat
c:\program files (x86)\360\360Safe\endata\aw_1007.dat
c:\program files (x86)\360\360Safe\endata\aw_1008.dat
c:\program files (x86)\360\360Safe\endata\aw_1010.dat
c:\program files (x86)\360\360Safe\endata\aw_1012.dat
c:\program files (x86)\360\360Safe\endata\aw_1014.dat
c:\program files (x86)\360\360Safe\endata\aw_1015.dat
c:\program files (x86)\360\360Safe\endata\aw_1016.dat
c:\program files (x86)\360\360Safe\endata\aw_1017.dat
c:\program files (x86)\360\360Safe\endata\aw_1019.dat
c:\program files (x86)\360\360Safe\endata\aw_1020.dat
c:\program files (x86)\360\360Safe\endata\dg_1.dat
c:\program files (x86)\360\360Safe\endata\dg_10.dat
c:\program files (x86)\360\360Safe\endata\dg_11.dat
c:\program files (x86)\360\360Safe\endata\dg_12.dat
c:\program files (x86)\360\360Safe\endata\dg_13.dat
c:\program files (x86)\360\360Safe\endata\dg_14.dat
c:\program files (x86)\360\360Safe\endata\dg_15.dat
c:\program files (x86)\360\360Safe\endata\dg_16.dat
c:\program files (x86)\360\360Safe\endata\dg_17.dat
c:\program files (x86)\360\360Safe\endata\dg_18.dat
c:\program files (x86)\360\360Safe\endata\dg_19.dat
c:\program files (x86)\360\360Safe\endata\dg_2.dat
c:\program files (x86)\360\360Safe\endata\dg_21.dat
c:\program files (x86)\360\360Safe\endata\dg_22.dat
c:\program files (x86)\360\360Safe\endata\dg_23.dat
c:\program files (x86)\360\360Safe\endata\dg_24.dat
c:\program files (x86)\360\360Safe\endata\dg_25.dat
c:\program files (x86)\360\360Safe\endata\dg_26.dat
c:\program files (x86)\360\360Safe\endata\dg_27.dat
c:\program files (x86)\360\360Safe\endata\dg_28.dat
c:\program files (x86)\360\360Safe\endata\dg_29.dat
c:\program files (x86)\360\360Safe\endata\dg_3.dat
c:\program files (x86)\360\360Safe\endata\dg_30.dat
c:\program files (x86)\360\360Safe\endata\dg_31.dat
c:\program files (x86)\360\360Safe\endata\dg_32.dat
c:\program files (x86)\360\360Safe\endata\dg_33.dat
c:\program files (x86)\360\360Safe\endata\dg_4.dat
c:\program files (x86)\360\360Safe\endata\dg_5.dat
c:\program files (x86)\360\360Safe\endata\dg_6.dat
c:\program files (x86)\360\360Safe\endata\dg_7.dat
c:\program files (x86)\360\360Safe\endata\dg_8.dat
c:\program files (x86)\360\360Safe\endata\dg_9.dat
c:\program files (x86)\360\360Safe\endata\dgcategory.dat
c:\program files (x86)\360\360Safe\endata\dt_1.dat
c:\program files (x86)\360\360Safe\endata\dt_2.dat
c:\program files (x86)\360\360Safe\endata\dt_3.dat
c:\program files (x86)\360\360Safe\endata\h_1.dat
c:\program files (x86)\360\360Safe\endata\h_2.dat
c:\program files (x86)\360\360Safe\ExplorerExt.dll
c:\program files (x86)\360\360Safe\ExplorerExt64.dll
c:\program files (x86)\360\360Safe\ipc\360appd.dat
c:\program files (x86)\360\360Safe\ipc\360Box.dll
c:\program files (x86)\360\360Safe\ipc\360Box.sys
c:\program files (x86)\360\360Safe\ipc\360Box64.sys
c:\program files (x86)\360\360Safe\ipc\360BoxLd.exe
c:\program files (x86)\360\360Safe\ipc\360BoxLd64.exe
c:\program files (x86)\360\360Safe\ipc\360boxmain.exe
c:\program files (x86)\360\360Safe\ipc\360fmr.dat
c:\program files (x86)\360\360Safe\ipc\360hips.ini
c:\program files (x86)\360\360Safe\ipc\appd.dll
c:\program files (x86)\360\360Safe\ipc\appmon.dat
c:\program files (x86)\360\360Safe\ipc\ChkDrvErr.dll
c:\program files (x86)\360\360Safe\ipc\clsid.dat
c:\program files (x86)\360\360Safe\ipc\FileMgr.dll
c:\program files (x86)\360\360Safe\ipc\filemon.dat
c:\program files (x86)\360\360Safe\ipc\Filter.dat
c:\program files (x86)\360\360Safe\ipc\Filter64.dat
c:\program files (x86)\360\360Safe\ipc\galaxy.dat
c:\program files (x86)\360\360Safe\ipc\ipcService.dll
c:\program files (x86)\360\360Safe\ipc\lzreg.dat
c:\program files (x86)\360\360Safe\ipc\patchcheck.dll
c:\program files (x86)\360\360Safe\ipc\qutmipc.dll
c:\program files (x86)\360\360Safe\ipc\qutmipc.sys
c:\program files (x86)\360\360Safe\ipc\regmon.dat
c:\program files (x86)\360\360Safe\ipc\safevideo.exe
c:\program files (x86)\360\360Safe\ipc\sbmon.dll
c:\program files (x86)\360\360Safe\ipc\signbwl.dat
c:\program files (x86)\360\360Safe\ipc\skin\360sandbox\360sandbox.ui
c:\program files (x86)\360\360Safe\ipc\SXIn.dll
c:\program files (x86)\360\360Safe\ipc\SXIn64.dll
c:\program files (x86)\360\360Safe\ipc\SxWrapper.dll
c:\program files (x86)\360\360Safe\ipc\TS.dat
c:\program files (x86)\360\360Safe\ipc\udisklog.dat
c:\program files (x86)\360\360Safe\ipc\X64For32Lib.dll
c:\program files (x86)\360\360Safe\ipc\yhregd.dll
c:\program files (x86)\360\360Safe\leakrepair.dat
c:\program files (x86)\360\360Safe\leakrepair.dll
c:\program files (x86)\360\360Safe\libaw.dat
c:\program files (x86)\360\360Safe\Libclsid.dat
c:\program files (x86)\360\360Safe\libdefa.dat
c:\program files (x86)\360\360Safe\libdll.dat
c:\program files (x86)\360\360Safe\libdrv.dat
c:\program files (x86)\360\360Safe\libleak-64.dat
c:\program files (x86)\360\360Safe\libleak-64_dif.dat
c:\program files (x86)\360\360Safe\libleak.dat
c:\program files (x86)\360\360Safe\libredlist.dat
c:\program files (x86)\360\360Safe\LibRun.dat
c:\program files (x86)\360\360Safe\libsdi.dat
c:\program files (x86)\360\360Safe\libspyerp.dat
c:\program files (x86)\360\360Safe\LibSrv.dat
c:\program files (x86)\360\360Safe\LibTask.dat
c:\program files (x86)\360\360Safe\libvi.dat
c:\program files (x86)\360\360Safe\libwhite.dat
c:\program files (x86)\360\360Safe\links.ini
c:\program files (x86)\360\360Safe\links\links.dll
c:\program files (x86)\360\360Safe\links\popmgrcfg.dat
c:\program files (x86)\360\360Safe\links\safenotify.exe
c:\program files (x86)\360\360Safe\links\sver.dll
c:\program files (x86)\360\360Safe\livehis.dat
c:\program files (x86)\360\360Safe\livep.dat
c:\program files (x86)\360\360Safe\LiveUpd360.dll
c:\program files (x86)\360\360Safe\LiveUpdate360.exe
c:\program files (x86)\360\360Safe\LiveUpdate360skin\Default.uiz
c:\program files (x86)\360\360Safe\LiveUpdateLog\360leakfixer.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\360MicroExamin.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\360MobileMgr.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\360netman.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\360Safe.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\360tray.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\LiveUpdate360.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\P2SP.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\P2SP_360leakfixer.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\P2SP_360netman.log
c:\program files (x86)\360\360Safe\LiveUpdateLog\P2SP_360tray.log
c:\program files (x86)\360\360Safe\MiniUI.dll
c:\program files (x86)\360\360Safe\mipan\AlgorithmLib.dll
c:\program files (x86)\360\360Safe\mipan\SafeDriverCtrl.dll
c:\program files (x86)\360\360Safe\mobilemgr\360ApkInstaller.exe
c:\program files (x86)\360\360Safe\mobilemgr\360MMFeedback.exe
c:\program files (x86)\360\360Safe\mobilemgr\360MMSetupDrv.exe
c:\program files (x86)\360\360Safe\mobilemgr\360MMSetupDrv64.exe
c:\program files (x86)\360\360Safe\mobilemgr\360MobileCheck.exe
c:\program files (x86)\360\360Safe\mobilemgr\360MobileLoader.exe
c:\program files (x86)\360\360Safe\mobilemgr\360MobileMgr.exe
c:\program files (x86)\360\360Safe\mobilemgr\360MobileSrv.exe
c:\program files (x86)\360\360Safe\mobilemgr\adb_usb.ini
c:\program files (x86)\360\360Safe\mobilemgr\ApkHelper.dll
c:\program files (x86)\360\360Safe\mobilemgr\config.ini
c:\program files (x86)\360\360Safe\mobilemgr\deviceid.ini
c:\program files (x86)\360\360Safe\mobilemgr\mobileadapt.ini
c:\program files (x86)\360\360Safe\mobilemgr\mobileguide.exe
c:\program files (x86)\360\360Safe\mobilemgr\MobileInfo2.dat
c:\program files (x86)\360\360Safe\mobilemgr\mobileloader.ini
c:\program files (x86)\360\360Safe\mobilemgr\mobiletpicfg.ini
c:\program files (x86)\360\360Safe\mobilemgr\np360MMPlugIn.dll
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv.uim
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\360MobileIcon.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\360PhoneIcon.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\ArrowIcon.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\background.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\bj.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\BottomBg.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\button.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\buttonNomal.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\buttonNomal4.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\buttonPage1.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\charge_full.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\charging.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\charging_apple.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\checkbox.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\FirstPagePhone.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\FirstPagetxt1.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\FirstPageusb.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\Mainframe.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\mgr_my_phone.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\notifyInfo.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\notifyInfo1.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\notifyWarning.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\Point1.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\Point2.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\SecondPagetxt2.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\SelIcon.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\sysmenu_close2.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\sysmenu_min2.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\ThirdPagetxt3.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\tip_close.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\tip_setting.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\MobileSrv\title_icon.png
c:\program files (x86)\360\360Safe\mobilemgr\skin\softmanagerM.uiz
c:\program files (x86)\360\360Safe\mobilemgr\softmgrcfg.ini
c:\program files (x86)\360\360Safe\mobilemgr\SoftMgrCfgM.db
c:\program files (x86)\360\360Safe\mobilemgr\SoftMgrM.db
c:\program files (x86)\360\360Safe\mobilemgr\SoftUpdateM.dll
c:\program files (x86)\360\360Safe\mobilemgr\somkernlM.dll
c:\program files (x86)\360\360Safe\mobilemgr\tool\aapt.zip.P2P
c:\program files (x86)\360\360Safe\mobilemgr\TreeCtrl.xml
c:\program files (x86)\360\360Safe\mobilemgr\WhatsNewM.ini
c:\program files (x86)\360\360Safe\modules\360Inst.exe
c:\program files (x86)\360\360Safe\modules\360se_ph.exe
c:\program files (x86)\360\360Safe\modules\360se_wssj.exe
c:\program files (x86)\360\360Safe\modules\360uppb.exe
c:\program files (x86)\360\360Safe\modules\360vulsetup.exe
c:\program files (x86)\360\360Safe\modules\AVCfg.ini
c:\program files (x86)\360\360Safe\modules\AVCheck.dll
c:\program files (x86)\360\360Safe\modules\avlib.dat
c:\program files (x86)\360\360Safe\modules\control.ini
c:\program files (x86)\360\360Safe\modules\match.ini
c:\program files (x86)\360\360Safe\modules\SDPublicity.dll
c:\program files (x86)\360\360Safe\modules\setup_8.5.0.2001x.exe
c:\program files (x86)\360\360Safe\modules\setup_8.5.0.2001z.exe
c:\program files (x86)\360\360Safe\modules\TrayCust.dll
c:\program files (x86)\360\360Safe\NetDiagDll.dll
c:\program files (x86)\360\360Safe\netmon\360ArpPopWnd.dll
c:\program files (x86)\360\360Safe\netmon\360arpui.dll
c:\program files (x86)\360\360Safe\netmon\360defps.dat
c:\program files (x86)\360\360Safe\netmon\360gmoptm.dat
c:\program files (x86)\360\360Safe\netmon\360gmoptm.exe
c:\program files (x86)\360\360Safe\netmon\360gmps.dat
c:\program files (x86)\360\360Safe\netmon\360lanmgr.dll
c:\program files (x86)\360\360Safe\netmon\360msv.ini
c:\program files (x86)\360\360Safe\netmon\360netctrl.dll
c:\program files (x86)\360\360Safe\netmon\360netdiag.dll
c:\program files (x86)\360\360Safe\netmon\360Netdr.dll
c:\program files (x86)\360\360Safe\netmon\360NetFos.dll
c:\program files (x86)\360\360Safe\netmon\360netman.exe
c:\program files (x86)\360\360Safe\netmon\360netmon.ini
c:\program files (x86)\360\360Safe\netmon\360netmonep.dat
c:\program files (x86)\360\360Safe\netmon\360NetRepair.exe
c:\program files (x86)\360\360Safe\netmon\360NetSpd.dat
c:\program files (x86)\360\360Safe\netmon\360netview.dll
c:\program files (x86)\360\360Safe\netmon\360ps.dll
c:\program files (x86)\360\360Safe\netmon\360TcpView.dll
c:\program files (x86)\360\360Safe\netmon\3GIdentify.dll
c:\program files (x86)\360\360Safe\netmon\3GMon.dll
c:\program files (x86)\360\360Safe\netmon\Config\3GMon\3GMon.ui
c:\program files (x86)\360\360Safe\netmon\Config\netman\netman.ui
c:\program files (x86)\360\360Safe\netmon\Config\pedata\pedata.ui
c:\program files (x86)\360\360Safe\netmon\Identify\lib\listpredef.dat
c:\program files (x86)\360\360Safe\netmon\Jishi_tranfficmon.dll
c:\program files (x86)\360\360Safe\netmon\lmtps.dat
c:\program files (x86)\360\360Safe\netmon\mobileflux.dll
c:\program files (x86)\360\360Safe\netmon\netdrv\50\360netmon_50.sys
c:\program files (x86)\360\360Safe\netmon\netdrv\60\360netmon_60.sys
c:\program files (x86)\360\360Safe\netmon\netdrv\x64\360netmon_x64.sys
c:\program files (x86)\360\360Safe\netmon\Netgm.dll
c:\program files (x86)\360\360Safe\netmon\NetmonEP.dll
c:\program files (x86)\360\360Safe\netmon\netmonwifi.npk
c:\program files (x86)\360\360Safe\netmon\netmstart.dll
c:\program files (x86)\360\360Safe\netmon\NetSpeed.dll
c:\program files (x86)\360\360Safe\netmon\netspeed.npl
c:\program files (x86)\360\360Safe\netmon\newf.dat
c:\program files (x86)\360\360Safe\netmon\nmver.dll
c:\program files (x86)\360\360Safe\netmon\skin\default.uil
c:\program files (x86)\360\360Safe\netmon\sysmon.dll
c:\program files (x86)\360\360Safe\netmon\sysoptm.dll
c:\program files (x86)\360\360Safe\netmon\WiFiProtect.dll
c:\program files (x86)\360\360Safe\PDown.dll
c:\program files (x86)\360\360Safe\performance.log
c:\program files (x86)\360\360Safe\PromptConfig.ini
c:\program files (x86)\360\360Safe\repsafe.ini
c:\program files (x86)\360\360Safe\safelive.dll
c:\program files (x86)\360\360Safe\safemon\360.dat
c:\program files (x86)\360\360Safe\safemon\360Baobiao.exe
c:\program files (x86)\360\360Safe\safemon\360compro.dll
c:\program files (x86)\360\360Safe\safemon\360DownloadGuard.exe
c:\program files (x86)\360\360Safe\safemon\360drvd.dat
c:\program files (x86)\360\360Safe\safemon\360drwht.dat
c:\program files (x86)\360\360Safe\safemon\360GuardBase.dll
c:\program files (x86)\360\360Safe\safemon\360hipsPopWnd.dll
c:\program files (x86)\360\360Safe\safemon\360MobileBase.tpi
c:\program files (x86)\360\360Safe\safemon\360PayGuard.exe
c:\program files (x86)\360\360Safe\safemon\360procmon.dll
c:\program files (x86)\360\360Safe\safemon\360realpro.exe
c:\program files (x86)\360\360Safe\safemon\360SafeCamera.tpi
c:\program files (x86)\360\360Safe\safemon\360safemonpro.tpi
c:\program files (x86)\360\360Safe\safemon\360SelfProtection.sys
c:\program files (x86)\360\360Safe\safemon\360TaskBar.tpi
c:\program files (x86)\360\360Safe\safemon\360Tray.exe
c:\program files (x86)\360\360Safe\safemon\360trayexit.dll
c:\program files (x86)\360\360Safe\safemon\360TrayLive.dll
c:\program files (x86)\360\360Safe\safemon\360TrayLogin.tpi
c:\program files (x86)\360\360Safe\safemon\360TrayMenu.dll
c:\program files (x86)\360\360Safe\safemon\360U.dat
c:\program files (x86)\360\360Safe\safemon\360UDiskGuard.dll
c:\program files (x86)\360\360Safe\safemon\360UDiskGuard.exe
c:\program files (x86)\360\360Safe\safemon\360UDiskGuard64.dll
c:\program files (x86)\360\360Safe\safemon\360UDiskGuard64.exe
c:\program files (x86)\360\360Safe\safemon\360WDMain.exe
c:\program files (x86)\360\360Safe\safemon\360webpro.dll
c:\program files (x86)\360\360Safe\safemon\360zipc.dll
c:\program files (x86)\360\360Safe\safemon\7z.dll
c:\program files (x86)\360\360Safe\safemon\Adfilter.dll
c:\program files (x86)\360\360Safe\safemon\Adfilter\Adfilter.dat
c:\program files (x86)\360\360Safe\safemon\AppFltr.dll
c:\program files (x86)\360\360Safe\safemon\arpw.dat
c:\program files (x86)\360\360Safe\safemon\AutoCleanTrash.tpi
c:\program files (x86)\360\360Safe\safemon\box.dat
c:\program files (x86)\360\360Safe\safemon\BrowserClearer.dll
c:\program files (x86)\360\360Safe\safemon\BrowserFix.dll
c:\program files (x86)\360\360Safe\safemon\config.ini
c:\program files (x86)\360\360Safe\safemon\drvmk.dat
c:\program files (x86)\360\360Safe\safemon\drvms.dat
c:\program files (x86)\360\360Safe\safemon\DsTpi.tpi
c:\program files (x86)\360\360Safe\safemon\execrule.dat
c:\program files (x86)\360\360Safe\safemon\filelog.db
c:\program files (x86)\360\360Safe\safemon\hookport.sys
c:\program files (x86)\360\360Safe\safemon\images\360guardui.ui
c:\program files (x86)\360\360Safe\safemon\images\360logo.gif
c:\program files (x86)\360\360Safe\safemon\images\bkglb.gif
c:\program files (x86)\360\360Safe\safemon\images\bkglt.gif
c:\program files (x86)\360\360Safe\safemon\images\bkgrb.gif
c:\program files (x86)\360\360Safe\safemon\images\bkgrt.gif
c:\program files (x86)\360\360Safe\safemon\images\cornl.gif
c:\program files (x86)\360\360Safe\safemon\images\cornt.gif
c:\program files (x86)\360\360Safe\safemon\images\dgico.gif
c:\program files (x86)\360\360Safe\safemon\images\dgico2.gif
c:\program files (x86)\360\360Safe\safemon\images\leftbottom.gif
c:\program files (x86)\360\360Safe\safemon\images\pdbig.gif
c:\program files (x86)\360\360Safe\safemon\images\pdclose.gif
c:\program files (x86)\360\360Safe\safemon\images\pdsmall.gif
c:\program files (x86)\360\360Safe\safemon\images\rightbottom.gif
c:\program files (x86)\360\360Safe\safemon\images\righttop.gif
c:\program files (x86)\360\360Safe\safemon\images\safeleftbottom.gif
c:\program files (x86)\360\360Safe\safemon\images\safemonuiclose.gif
c:\program files (x86)\360\360Safe\safemon\images\safemonuiE.gif
c:\program files (x86)\360\360Safe\safemon\images\safemonuilogo.gif
c:\program files (x86)\360\360Safe\safemon\images\safemonuisafe.gif
c:\program files (x86)\360\360Safe\safemon\images\saferightbottom.gif
c:\program files (x86)\360\360Safe\safemon\images\saferighttop.gif
c:\program files (x86)\360\360Safe\safemon\images\safesanjiao.gif
c:\program files (x86)\360\360Safe\safemon\images\sanjiao.gif
c:\program files (x86)\360\360Safe\safemon\images\sfico.gif
c:\program files (x86)\360\360Safe\safemon\images\tips\1.gif
c:\program files (x86)\360\360Safe\safemon\images\tips\2.gif
c:\program files (x86)\360\360Safe\safemon\images\tips\3.gif
c:\program files (x86)\360\360Safe\safemon\images\tips\left.gif
c:\program files (x86)\360\360Safe\safemon\images\warnbanner.gif
c:\program files (x86)\360\360Safe\safemon\images\warnclose.gif
c:\program files (x86)\360\360Safe\safemon\images\warndel.gif
c:\program files (x86)\360\360Safe\safemon\images\warnico.gif
c:\program files (x86)\360\360Safe\safemon\iNetSafe.dll
c:\program files (x86)\360\360Safe\safemon\jsfeature.dat
c:\program files (x86)\360\360Safe\safemon\listpredef.dat
c:\program files (x86)\360\360Safe\safemon\Menu.dll
c:\program files (x86)\360\360Safe\safemon\MicroExamin.tpi
c:\program files (x86)\360\360Safe\safemon\Netm.tpi
c:\program files (x86)\360\360Safe\safemon\netmon.tpi
c:\program files (x86)\360\360Safe\safemon\obtracer.tpi
c:\program files (x86)\360\360Safe\safemon\OLCheckMail.dll
c:\program files (x86)\360\360Safe\safemon\param.ini
c:\program files (x86)\360\360Safe\safemon\png_reader.dll
c:\program files (x86)\360\360Safe\safemon\safegmod.exe
c:\program files (x86)\360\360Safe\safemon\safemon.dll
c:\program files (x86)\360\360Safe\safemon\ScanPlugin.dll
c:\program files (x86)\360\360Safe\safemon\se_wdtc.exe
c:\program files (x86)\360\360Safe\safemon\SelfProtectAPI2.dll
c:\program files (x86)\360\360Safe\safemon\sepro.dll
c:\program files (x86)\360\360Safe\safemon\skin\browserfix\browserfixskin.ui
c:\program files (x86)\360\360Safe\safemon\skin\BrowserFix2\browserfixskin2.ui
c:\program files (x86)\360\360Safe\safemon\skin\hipspopwnd.ui
c:\program files (x86)\360\360Safe\safemon\skin\wdmain.uic
c:\program files (x86)\360\360Safe\safemon\SomProxy.dll
c:\program files (x86)\360\360Safe\safemon\speedmem2.hg
c:\program files (x86)\360\360Safe\safemon\spffeature.dat
c:\program files (x86)\360\360Safe\safemon\traycustcfg.dat
c:\program files (x86)\360\360Safe\safemon\TrayMenu\TrayMenu.ui
c:\program files (x86)\360\360Safe\safemon\TrayMenu\TrayMenu.xml
c:\program files (x86)\360\360Safe\safemon\urllib.dat
c:\program files (x86)\360\360Safe\safemon\urllibauth.dat
c:\program files (x86)\360\360Safe\safemon\urllibw.dat
c:\program files (x86)\360\360Safe\safemon\urlproc.dll
c:\program files (x86)\360\360Safe\safemon\urlprocnet.dll
c:\program files (x86)\360\360Safe\safemon\wd.ini
c:\program files (x86)\360\360Safe\safemon\wdcnf.dat
c:\program files (x86)\360\360Safe\safemon\wddown.log
c:\program files (x86)\360\360Safe\safemon\wdhotfix.dll
c:\program files (x86)\360\360Safe\safemon\WDPayPro.exe
c:\program files (x86)\360\360Safe\safemon\WDRecord.dll
c:\program files (x86)\360\360Safe\safemon\WDRule.dll
c:\program files (x86)\360\360Safe\safemon\WDSafeDown.exe
c:\program files (x86)\360\360Safe\safemon\WDService.dll
c:\program files (x86)\360\360Safe\safemon\wdui2.dll
c:\program files (x86)\360\360Safe\slist.dat
c:\program files (x86)\360\360Safe\SoftMgr\360ACenterInset.dll
c:\program files (x86)\360\360Safe\SoftMgr\360AppCore.exe
c:\program files (x86)\360\360Safe\SoftMgr\360Opt.dll
c:\program files (x86)\360\360Safe\SoftMgr\360SoftMgrLiteCore.dll
c:\program files (x86)\360\360Safe\SoftMgr\360SoftMgrS.dll
c:\program files (x86)\360\360Safe\SoftMgr\360speedld.exe
c:\program files (x86)\360\360Safe\SoftMgr\360speedld.log
c:\program files (x86)\360\360Safe\SoftMgr\360SpeedTime.dll
c:\program files (x86)\360\360Safe\SoftMgr\360wapp.exe
c:\program files (x86)\360\360Safe\SoftMgr\advcatch1.dat
c:\program files (x86)\360\360Safe\SoftMgr\advcatch2.dat
c:\program files (x86)\360\360Safe\SoftMgr\advcatch3.dat
c:\program files (x86)\360\360Safe\SoftMgr\advcatch4.dat
c:\program files (x86)\360\360Safe\SoftMgr\advcatch5.dat
c:\program files (x86)\360\360Safe\SoftMgr\AdvUtils.exe
c:\program files (x86)\360\360Safe\SoftMgr\AdvUtils.ini
c:\program files (x86)\360\360Safe\SoftMgr\AppcenterData.dll
c:\program files (x86)\360\360Safe\SoftMgr\apppages\errorpage.html
c:\program files (x86)\360\360Safe\SoftMgr\apppages\installflash.html
c:\program files (x86)\360\360Safe\SoftMgr\Autorunhistory.dll
c:\program files (x86)\360\360Safe\SoftMgr\ComputerZS1.dll
c:\program files (x86)\360\360Safe\SoftMgr\Config.ini
c:\program files (x86)\360\360Safe\SoftMgr\fileassoc.dat
c:\program files (x86)\360\360Safe\SoftMgr\HeadView.dat
c:\program files (x86)\360\360Safe\SoftMgr\HelptonPage.dll
c:\program files (x86)\360\360Safe\SoftMgr\html\error.html
c:\program files (x86)\360\360Safe\SoftMgr\html\errorbg.png
c:\program files (x86)\360\360Safe\SoftMgr\ignorelist.ini
c:\program files (x86)\360\360Safe\SoftMgr\img_reader.dll
c:\program files (x86)\360\360Safe\SoftMgr\MiniAppdata.xdb
c:\program files (x86)\360\360Safe\SoftMgr\mobileSoft.dat
c:\program files (x86)\360\360Safe\SoftMgr\NotifyDown.dll
c:\program files (x86)\360\360Safe\SoftMgr\onekeyinstall.dat
c:\program files (x86)\360\360Safe\SoftMgr\optconfig.ini
c:\program files (x86)\360\360Safe\SoftMgr\performance.log
c:\program files (x86)\360\360Safe\SoftMgr\QuickInst.exe
c:\program files (x86)\360\360Safe\SoftMgr\QuickInstProxy.exe
c:\program files (x86)\360\360Safe\SoftMgr\RecId.dat
c:\program files (x86)\360\360Safe\SoftMgr\roconfig.ini
c:\program files (x86)\360\360Safe\SoftMgr\RUConfig.dat
c:\program files (x86)\360\360Safe\SoftMgr\SetupUtility.ico
c:\program files (x86)\360\360Safe\SoftMgr\skin\DefaultSkin.uiz
c:\program files (x86)\360\360Safe\SoftMgr\skin\ptmobile_old.uiz
c:\program files (x86)\360\360Safe\SoftMgr\skin\SML_DefaultSkin.uiz
c:\program files (x86)\360\360Safe\SoftMgr\skin\softmanager.uiz
c:\program files (x86)\360\360Safe\SoftMgr\skin\speedldnew.uiz
c:\program files (x86)\360\360Safe\SoftMgr\skin\speedldskin.uiz
c:\program files (x86)\360\360Safe\SoftMgr\skin\ThemeList.xml
c:\program files (x86)\360\360Safe\SoftMgr\skin\weather.png
c:\program files (x86)\360\360Safe\SoftMgr\skin\weather_b.png
c:\program files (x86)\360\360Safe\SoftMgr\SMCrashReport.exe
c:\program files (x86)\360\360Safe\SoftMgr\SMWebProxy.dll
c:\program files (x86)\360\360Safe\SoftMgr\SoftDate.dat
c:\program files (x86)\360\360Safe\SoftMgr\SoftManager.exe
c:\program files (x86)\360\360Safe\SoftMgr\SoftManagerLite.exe
c:\program files (x86)\360\360Safe\SoftMgr\SoftManagerProxy.exe
c:\program files (x86)\360\360Safe\SoftMgr\SoftMgr.db
c:\program files (x86)\360\360Safe\SoftMgr\SoftMgr64.exe
c:\program files (x86)\360\360Safe\SoftMgr\SoftMgrCfg.db
c:\program files (x86)\360\360Safe\SoftMgr\softmgrcfg.ini
c:\program files (x86)\360\360Safe\SoftMgr\SoftMgrExt.dll
c:\program files (x86)\360\360Safe\SoftMgr\SoftMgrListCache.dat
c:\program files (x86)\360\360Safe\SoftMgr\SoftMgrLiteLauncher.dll
c:\program files (x86)\360\360Safe\SoftMgr\SoftMgrLiteLauncher64.dll
c:\program files (x86)\360\360Safe\SoftMgr\SoftMgrProxy64.exe
c:\program files (x86)\360\360Safe\SoftMgr\SoftReCmd.dat
c:\program files (x86)\360\360Safe\SoftMgr\SoftReCmdEx.dat
c:\program files (x86)\360\360Safe\SoftMgr\SoftSmartNotify.ini
c:\program files (x86)\360\360Safe\SoftMgr\softup.dat
c:\program files (x86)\360\360Safe\SoftMgr\SoftUpdate.dll
c:\program files (x86)\360\360Safe\SoftMgr\SoftupNotify.exe
c:\program files (x86)\360\360Safe\SoftMgr\SoftupNotify.log
c:\program files (x86)\360\360Safe\SoftMgr\SoftUptMsg.ini
c:\program files (x86)\360\360Safe\SoftMgr\SoftUseCount.dat
c:\program files (x86)\360\360Safe\SoftMgr\SomAdvUtils.dll
c:\program files (x86)\360\360Safe\SoftMgr\somcore.dll
c:\program files (x86)\360\360Safe\SoftMgr\somextrainfo.ini
c:\program files (x86)\360\360Safe\SoftMgr\somkernl.dll
c:\program files (x86)\360\360Safe\SoftMgr\somQuickInst.dll
c:\program files (x86)\360\360Safe\SoftMgr\somsetup.dll
c:\program files (x86)\360\360Safe\SoftMgr\SomSoftMgr.dll
c:\program files (x86)\360\360Safe\SoftMgr\SomUninst.dll
c:\program files (x86)\360\360Safe\SoftMgr\sorelate.dat
c:\program files (x86)\360\360Safe\SoftMgr\SpeedupOpt.dll
c:\program files (x86)\360\360Safe\SoftMgr\strecover.dat
c:\program files (x86)\360\360Safe\SoftMgr\stsuglist.dat
c:\program files (x86)\360\360Safe\SoftMgr\stsugspeed.dat
c:\program files (x86)\360\360Safe\SoftMgr\stupdisable.dat
c:\program files (x86)\360\360Safe\SoftMgr\svcdef.dat
c:\program files (x86)\360\360Safe\SoftMgr\timerefer.dat
c:\program files (x86)\360\360Safe\SoftMgr\WhatsNew.ini
c:\program files (x86)\360\360Safe\SoftMgr\WndListDef.db
c:\program files (x86)\360\360Safe\sweeper\360AutoClean.exe
c:\program files (x86)\360\360Safe\sweeper\360clean.dll
c:\program files (x86)\360\360Safe\sweeper\360OKClean.dll
c:\program files (x86)\360\360Safe\sweeper\CleanHelper64.exe
c:\program files (x86)\360\360Safe\sweeper\okctree.xml
c:\program files (x86)\360\360Safe\sweeper\staticshelper.dll
c:\program files (x86)\360\360Safe\sweeper\statslib.dll
c:\program files (x86)\360\360Safe\sweeper\SysSweeper.dll
c:\program files (x86)\360\360Safe\sweeper\SysSweeper.xml
c:\program files (x86)\360\360Safe\sweeper\TEngine.dll
c:\program files (x86)\360\360Safe\sweeper\TraceClean.dll
c:\program files (x86)\360\360Safe\sweeper\Tracehelper.exe
c:\program files (x86)\360\360Safe\sweeper\tracesweeper.dat
c:\program files (x86)\360\360Safe\sweeper\tracetree.ini
c:\program files (x86)\360\360Safe\sweeper\TrashClean.dll
c:\program files (x86)\360\360Safe\sweeper\tree.xml
c:\program files (x86)\360\360Safe\sweeper\WhiteList.dat
c:\program files (x86)\360\360Safe\uninst.exe
c:\program files (x86)\360\360Safe\update\~50A5.tmp
c:\program files (x86)\360\360Safe\update\~B4C6.tmp
c:\program files (x86)\360\360Safe\update\~C145.tmp
c:\program files (x86)\360\360Safe\update\~F267.tmp
c:\program files (x86)\360\360Safe\updatecache.dat
c:\program files (x86)\360\360Safe\updatecfg.ini
c:\program files (x86)\360\360Safe\Utils\360Feedback.exe
c:\program files (x86)\360\360Safe\Utils\360FeedBack.xml
c:\program files (x86)\360\360Safe\Utils\360FileUnlock.exe
c:\program files (x86)\360\360Safe\Utils\360Preview.exe
c:\program files (x86)\360\360Safe\Utils\360Preview.ui
c:\program files (x86)\360\360Safe\Utils\360Preview.xml
c:\program files (x86)\360\360Safe\Utils\360ScreenCapture.exe
c:\program files (x86)\360\360Safe\Utils\AdvTools.dll
c:\program files (x86)\360\360Safe\Utils\BuyIWebbrowser.dll
c:\program files (x86)\360\360Safe\Utils\feedback.ui
c:\program files (x86)\360\360Safe\Utils\FileSmasher.exe
c:\program files (x86)\360\360Safe\Utils\LSPFix.exe
c:\program files (x86)\360\360Safe\Utils\plugincleaner.dll
c:\program files (x86)\360\360Safe\Utils\shell360ext.dll
c:\program files (x86)\360\360Safe\Utils\shell360ext64.dll
c:\programdata\360safe
c:\programdata\360safe\ScanCache\CIndex_2012_03_22.dat
c:\programdata\360safe\ScanCache\Data_2012_03_22.dat
c:\programdata\360safe\ScanCache\MIndex.dat
c:\programdata\360safe\softmgr\somextrainfo.ini
c:\programdata\360safe\softmgr\somextrainfo2.ini
c:\programdata\360safe\softmgr\somweather.ini
c:\programdata\360safe\softmgr\svdl.ini
c:\users\Bob\AppData\Roaming\360chrome
c:\users\Bob\AppData\Roaming\360safe
c:\program files (x86)\360\360Safe\SoftMgr\??????????.lnk . . . . Failed to delete
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_360BOX64
-------\Legacy_360FSFLT
-------\Legacy_360NETMON
-------\Legacy_BAPIDRV
-------\Service_360Box64
-------\Service_360FsFlt
-------\Service_360netmon
-------\Service_BAPIDRV
-------\Service_ZhuDongFangYu
-------\Service_ZhuDongFangYu
.
.
((((((((((((((((((((((((( Files Created from 2012-02-26 to 2012-03-26 )))))))))))))))))))))))))))))))
.
.
2012-03-22 22:33 . 2012-03-22 22:33	592824	----a-w-	c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-22 22:33 . 2012-03-22 22:33	44472	----a-w-	c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-22 16:22 . 2012-03-22 16:26	--------	d-----w-	c:\users\Administrator
2012-03-21 22:03 . 2012-03-21 22:03	--------	d-----w-	c:\program files\SiSoftware
2012-03-19 20:41 . 2012-03-19 20:41	--------	d-----w-	c:\users\Bob\AppData\Roaming\SpeedMaxPc
2012-03-19 20:38 . 2012-03-19 20:44	--------	d-----w-	c:\programdata\SpeedMaxPc
2012-03-14 00:20 . 2011-11-19 15:20	5559152	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-03-14 00:20 . 2011-11-19 14:50	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 00:20 . 2011-11-19 14:50	3913584	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-03-13 23:55 . 2012-02-03 04:34	3145728	----a-w-	c:\windows\system32\win32k.sys
2012-03-13 23:55 . 2012-02-10 06:36	1544192	----a-w-	c:\windows\system32\DWrite.dll
2012-03-13 23:55 . 2012-02-10 05:38	1077248	----a-w-	c:\windows\SysWow64\DWrite.dll
2012-03-13 18:06 . 2012-01-25 06:38	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-03-13 18:06 . 2012-01-25 06:33	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-03-13 18:06 . 2012-01-25 06:38	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-03-13 18:06 . 2012-02-17 06:38	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-03-13 18:06 . 2012-02-17 05:34	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-03-13 18:06 . 2012-02-17 04:58	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-03-13 18:06 . 2012-02-17 04:57	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-03-13 01:33 . 2011-12-23 08:35	274008	----a-w-	c:\windows\system32\drivers\360Box64.sys
2012-03-12 13:34 . 2011-07-26 09:41	159320	----a-w-	c:\windows\SysWow64\drivers\360Box.sys
2012-03-12 13:31 . 2012-02-21 02:45	354904	----a-w-	c:\windows\system32\drivers\360FsFlt.sys
2012-03-12 13:31 . 2011-04-22 09:51	168536	----a-w-	c:\windows\system32\drivers\BAPIDRV64.SYS
2012-03-12 13:31 . 2010-08-13 10:54	19712	----a-w-	c:\windows\system32\drivers\efimon.sys
2012-03-12 13:30 . 2011-11-11 11:31	146776	----a-w-	c:\windows\SysWow64\360SoftMgr.cpl
2012-03-12 13:30 . 2011-04-02 05:48	56920	----a-w-	c:\windows\system32\drivers\360netmon.sys
2012-03-12 13:30 . 2011-10-26 11:35	32280	----a-w-	c:\windows\SysWow64\drivers\360AntiARP.sys
2012-03-12 13:30 . 2009-07-21 12:24	14080	----a-w-	c:\windows\SysWow64\drivers\ProtoDrv.sys
2012-03-12 13:22 . 2012-03-22 15:45	--------	d-----w-	c:\users\Bob\AppData\Roaming\KuGou7
2012-03-12 00:56 . 2012-03-12 01:00	--------	d-----w-	c:\users\Bob\AppData\Local\Microsoft Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-26 21:38 . 2011-11-05 19:51	17920	----a-w-	c:\windows\system32\rpcnetp.exe
2012-03-26 21:38 . 2010-11-30 12:56	52224	----a-w-	c:\windows\SysWow64\rpcnet.dll
2012-03-08 02:04 . 2011-06-07 22:09	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-08 14:13 . 2012-02-08 14:13	61440	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe
2012-02-08 14:13 . 2012-02-08 14:13	61440	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\ARPPRODUCTICON.exe
2012-02-08 14:13 . 2012-02-08 14:13	106496	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut31_2F252077BA3F4362913955273A708467.exe
2012-02-08 14:13 . 2012-02-08 14:13	106496	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe
2012-02-08 14:13 . 2010-12-15 14:28	106496	----a-r-	c:\users\Bob\AppData\Roaming\Microsoft\Installer\{3CA54984-A14B-42FE-9FF1-7EA90151D725}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe
2012-02-08 14:12 . 2010-12-15 14:27	18760	----a-w-	c:\windows\SysWow64\QQVistaHelper.dll
2012-01-06 23:18 . 2011-11-11 22:58	5279504	----a-w-	c:\windows\uninst.exe
2012-01-06 16:51 . 2011-10-24 16:30	45568	----a-w-	c:\windows\system32\iolobtdfg.exe
2012-01-06 16:51 . 2011-10-24 16:30	14848	----a-w-	c:\windows\system32\smrgdf.exe
2012-01-06 16:29 . 2011-10-24 16:30	2141832	----a-w-	c:\windows\system32\Incinerator64.dll
2012-01-06 16:29 . 2011-10-24 16:30	2083464	----a-w-	c:\windows\SysWow64\Incinerator32.dll
2012-01-04 10:44 . 2012-02-15 12:24	509952	----a-w-	c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-15 12:24	442880	----a-w-	c:\windows\SysWow64\ntshrui.dll
2011-12-30 06:26 . 2012-02-15 12:24	515584	----a-w-	c:\windows\system32\timedate.cpl
2011-12-30 05:27 . 2012-02-15 12:24	478720	----a-w-	c:\windows\SysWow64\timedate.cpl
2011-12-29 07:38 . 2011-12-29 07:38	79568	----a-w-	c:\windows\xinstaller.dll
2011-12-29 07:38 . 2011-12-29 07:38	34512	----a-w-	c:\windows\xinstaller.exe
2011-12-28 03:59 . 2012-02-15 12:23	498688	----a-w-	c:\windows\system32\drivers\afd.sys
.
.
((((((((((((((((((((((((((((( [email protected]_21.49.34 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 05:10 . 2012-03-26 21:41	52512 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-11-23 00:50 . 2012-03-26 21:41	25896 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2804872291-2678155072-1612828925-1000_UserData.bin
- 2010-11-23 03:14 . 2012-03-25 21:38	32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-11-23 03:14 . 2012-03-26 21:12	32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-11-23 03:14 . 2012-03-26 21:12	32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-11-23 03:14 . 2012-03-25 21:38	32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-03-25 21:38	16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-03-26 21:12	16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2012-03-25 21:46 . 2012-03-25 21:46	2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-26 21:36 . 2012-03-26 21:36	2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-03-26 21:36 . 2012-03-26 21:36	2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-03-25 21:46 . 2012-03-25 21:46	2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-11-28 01:09 . 2012-03-25 23:57	412562 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2010-11-23 01:15 . 2012-03-26 21:13	104322 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:01 . 2012-03-25 21:45	375780 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-03-26 21:35	375780 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-04-07 15:57 . 2012-03-25 21:45	4077280 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2804872291-2678155072-1612828925-1000-12288.dat
+ 2011-04-07 15:57 . 2012-03-26 15:45	4077280 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2804872291-2678155072-1612828925-1000-12288.dat
+ 2010-12-21 01:17 . 2012-03-26 21:35	39109328 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2804872291-2678155072-1612828925-1000-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{0A0DDBD3-6641-40B9-873F-BBDD26D6C14E}]
2011-11-10 06:47	176128	----a-w-	c:\program files (x86)\easyMule\modules\IE2EM.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{0EA37B17-6B8B-4085-8257-F3A4AA69C27A}]
2012-01-04 09:29	87728	----a-w-	c:\program files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.6.69.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-10-10 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe" [2010-07-16 307184]
"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"Seagate Dashboard"="c:\program files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe" [2011-06-01 79112]
"Memeo AutoSync"="c:\program files (x86)\Memeo\AutoSync\MemeoLauncher2.exe" [2011-05-04 144608]
"Memeo Instant Backup"="c:\program files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe" [2011-05-04 136416]
"iolo Startup"="c:\program files (x86)\iolo\Common\Lib\ioloLManager.exe" [2012-01-06 606904]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-11-22 1675160]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
"Absolute Notifier"="c:\program files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe" [2011-05-10 85672]
"FATrayAlert"="c:\program files (x86)\Sensible Vision\Fast Access\FATrayMon.exe" [2009-06-25 95496]
"HTC Sync Loader"="c:\program files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2011-12-20 634880]
"FAStartup"="" [BU]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\FastAccess]
2009-06-25 19:09	140552	----a-w-	c:\program files (x86)\Sensible Vision\Fast Access\FALogNot.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ autocheck autochk /p \??\c:\0autocheck autochk /r \??\E:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ scecli FAPassSync
Security Packages	REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rpcnet]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 136176]
R2 Roxio Upnp Server 11;Roxio Upnp Server 11;c:\program files (x86)\Roxio Creator 2009\Digital Home 11\RoxioUpnpService11.exe [2008-08-14 367088]
R2 RoxWatch11;Roxio Hard Drive Watcher 11;c:\program files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe [2008-08-14 170480]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe [2010-07-16 354288]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R3 ALSysIO;ALSysIO; [x]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-01-26 21712]
R3 FACAP;facap, FastAccess Video Capture;c:\windows\system32\DRIVERS\facap.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 136176]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [x]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys [x]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-02-01 25072]
R3 Roxio UPnP Renderer 11;Roxio UPnP Renderer 11;c:\program files (x86)\Roxio Creator 2009\Digital Home 11\RoxioUPnPRenderer11.exe [2008-08-14 313840]
R3 RoxMediaDB11;RoxMediaDB11;c:\program files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe [2008-08-14 1124848]
R3 RoxMediaDB13;RoxMediaDB13;c:\program files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe [2010-07-16 1099248]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
R4 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-08-25 13672]
R4 RoxLiveShare11;LiveShare P2P Server 11;c:\program files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe [2008-08-14 309744]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
R4 XLServicePlatform;XLServicePlatform;c:\windows\system32\svchost [x]
S0 McPvDrv;McPvDrv Driver;c:\windows\system32\drivers\McPvDrv.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [x]
S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S1 MOBKFilter;MOBKFilter;c:\windows\system32\DRIVERS\MOBK.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AbsoluteNotifier;Absolute Notifier;c:\program files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2011-05-10 10920]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2010-12-02 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2010-01-11 155648]
S2 FAService;FAService;c:\program files (x86)\Sensible Vision\Fast Access\FAService.exe [2009-06-25 2368776]
S2 HipServ;HipServ for Windows;c:\program files\Roxio\Roxio Streamer\srvstart\srvstart.exe [2010-05-25 268288]
S2 HipServUsbDetection;USB detection service for HipServ;c:\program files\Roxio\Roxio Streamer\usb_detection.exe [2010-06-22 19968]
S2 ioloSystemService;iolo System Service;c:\program files (x86)\iolo\Common\Lib\ioloServiceManager.exe [2012-01-06 722616]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2011-05-04 25824]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-10-18 208536]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 MOBKbackup;McAfee Online Backup;c:\program files (x86)\McAfee Online Backup\MOBKbackup.exe [2010-04-14 231224]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-09-15 88576]
S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys [x]
S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [x]
S2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys [x]
S2 rpcld;Remote Procedure Call (RPC) LD;c:\programdata\Rpcnet\Bin\rpcld.exe [x]
S2 SeagateDashboardService;Seagate Dashboard Service;c:\program files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe [2011-06-01 14088]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-03-04 658656]
S2 VBoxDrv;VBox Support Driver;c:\program files\Roxio\Roxio Streamer\VBoxDrv.sys [2010-06-17 193928]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ hpqcxs08 hpqddsvc
iissvcs	REG_MULTI_SZ w3svc was
apphost	REG_MULTI_SZ apphostsvc
DoctorService	REG_MULTI_SZ XLDoctor Service
XLServicePlatform	REG_MULTI_SZ XLServicePlatform
.
Contents of the 'Scheduled Tasks' folder
.
2012-03-26 c:\windows\Tasks\DriverScanner.job
- c:\program files (x86)\Uniblue\DriverScanner\dsmonitor.exe [2012-01-01 18:43]
.
2012-03-23 c:\windows\Tasks\EasyShare Registration Task.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2012-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 23:38]
.
2012-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-28 23:38]
.
2012-03-06 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32]
.
2012-03-26 c:\windows\Tasks\RegistryBooster.job
- c:\program files (x86)\Uniblue\RegistryBooster\rbmonitor.exe [2012-01-08 08:26]
.
2012-03-26 c:\windows\Tasks\SpeedUpMyPC.job
- c:\program files (x86)\Uniblue\SpeedUpMyPC\spmonitor.exe [2012-01-08 20:28]
.
2012-03-26 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{004B0726-A010-4ABF-8556-FCDB7F1FCA1E}]
2012-01-04 09:29	627888	----a-w-	c:\program files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.2.5.3364.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK]
@="{3c3f3c1a-9153-7c05-f938-622e7003894d}"
[HKEY_CLASSES_ROOT\CLSID\{3c3f3c1a-9153-7c05-f938-622e7003894d}]
2010-04-14 00:11	3816248	----a-w-	c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK2]
@="{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}"
[HKEY_CLASSES_ROOT\CLSID\{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}]
2010-04-14 00:11	3816248	----a-w-	c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK3]
@="{b4caf489-1eec-c617-49ad-8d7088598c06}"
[HKEY_CLASSES_ROOT\CLSID\{b4caf489-1eec-c617-49ad-8d7088598c06}]
2010-04-14 00:11	3816248	----a-w-	c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"combofix"="c:\rfeichel123.exe\CF9540.3XE" [2010-11-20 345088]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.earthlink.net/
mStart Page = hxxp://search.foxtab.com/?s=0&chnl=dcom&cd=2XzutBtN2Y1L1QzutD0C0E0E0EyC0B0BtBtB0DzyyDyBtCyCzztN0D0TzutBtDtCtCtCtDtBtC&cr=1888191386
IE: &Ê¹ÓÃ&Ñ¸À×ÀëÏßÏÂÔØ - c:\program files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
IE: &Ê¹ÓÃ&Ñ¸À×ÏÂÔØ - c:\program files (x86)\Thunder Network\Thunder\BHO\geturl.htm
IE: &Ê¹ÓÃ&Ñ¸À×ÏÂÔØÈ«²¿Á´½Ó - c:\program files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
IE: Download by easyMule - c:\program files (x86)\easyMule\IE2EM.htm
IE: {{09BA8F6D-CB54-424B-839C-C2A6C8E6B436}
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 10.0.0.1
DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{28387537-e3f9-4ed7-860c-11e69af4a8a0} - (no file)
Toolbar-{28387537-e3f9-4ed7-860c-11e69af4a8a0} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
ShellIconOverlayIdentifiers-{CC00F81D-5262-450A-B1FA-D6BEE3406263} - c:\program files (x86)\360\360Safe\safemon\360UDiskGuard64.dll
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2804872291-2678155072-1612828925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (S-1-5-21-2804872291-2678155072-1612828925-1000)
@Denied: (2) (LocalSystem)
"Progid"="ThunderbirdEML"
.
[HKEY_USERS\S-1-5-21-2804872291-2678155072-1612828925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SysWOW64\rundll32.exe
c:\windows\SysWOW64\rpcnet.exe
.
**************************************************************************
.
Completion time: 2012-03-26 17:46:40 - machine was rebooted
ComboFix-quarantined-files.txt 2012-03-26 21:46
ComboFix2.txt 2012-03-25 21:56
.
Pre-Run: 340,984,770,560 bytes free
Post-Run: 340,426,149,888 bytes free
.
- - End Of File - - B5B9052E00FDDAE45E6F6390BB8C414C


----------



## dvk01 (Dec 14, 2002)

that looks like it got rid of most of it
there seems to, be one file left over that we can't delete becasue we can't see the filre name. I assume it must be written in chinese & CF couldn't delete it 
reboot first to make sure that nothinmg from the deleted lot was holfding it in place then go to c:\program files (x86)\360 & manually delete anything in the folder 

let us know how you get on


----------



## rfeichel (Jun 11, 2007)

I looked through the entire Program Files folder and could find no evidence of any thing left behind. The 360 folder was itself gone so the file you are referring to may have been deleted on a reboot. I will keep the files and logs you had me download for another 5 days just in case something from this problem pops up. However, I believe we can close this thread if you are satisfied with the results. If indeed something does pop up I would think it would do it today or very soon and if it does I will post the item/problem here.

Thanks for you help. No one else seemed to have a clue about how to do this. I suppose you sometimes shake your head at the dumb things people do. Again, many thanks.


----------



## dvk01 (Dec 14, 2002)

*Follow these steps to uninstall Combofix and the other tools it downloaded to remove the malware*
* Click *START* then * RUN*
* Now type *Combofix /Uninstall * in the runbox and click *OK*. Note the *space *between the *X* and the */U*, it needs to be there.









This will also purge the restore folder and clear any malware that has been put in there. Now Empty Recycle bin on desktop Then reboot.

go here* http://www.thespykiller.co.uk/index.php?page=3 *for info on how to tighten your security settings and how to help prevent future attacks.

and scan here* http://secunia.com/vulnerability_scanning/online/* for out of date & vulnerable common applications on your computer and update whatever it suggests

Then pay an urgent visit to windows update & make sure you are fully updated, that will help to plug the security holes that let these pests on in the first place. * If windows update doesn't work, please come back & tell us*


----------



## rfeichel (Jun 11, 2007)

I guess I spoke too soon. There are two remaining items. 360Tray.exe and 360Diskguard. The Taskbar and Start menu Properties has the 360diskguard and the 360Tray.exe is in the Notification Area Icons. And there is one item in the All Files and Programs listing that I suspect is responsible for all of it. It is in Chinese so I can't give you a name.


----------



## dvk01 (Dec 14, 2002)

I don't think we can ever remove the icon from sys tray, that will probably remain as a left over, but I will look for a way

lets see what this shows me & if I can remove anything else using it 
Download *OTS.exe *to your Desktop 

Close any open browsers.
Double-click on *OTS.exe* to start the program.
If your Real protection or Antivirus intervenes with OTS, allow it to run.
In the *Processes * group click *ALL*
In the *modules * group click *ALL* 
In the * Services * group click *Safe List* 
In the *Drivers* group click *Safe List* 
In the *Registry * group click *ALL*
In the *Files Age* drop down box click *90 days* 
Make sure use company name white list and skip Microsoft files boxes are checked
 In the Files created and Files modified groups select *whitelist/file age *
in the *Additional scans sections* please select * Everything *and make sure safe list box is checked
Now on the toolbar at the top select "Scan all users" then click the *Run Scan* button
The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file 
Use the * Reply* button and *attach the notepad file here*. I will review it when it comes in. 

It will be much too big so you will need to zip the file before it will be able to be uploaded


----------



## rfeichel (Jun 11, 2007)

zip files is attached


----------



## dvk01 (Dec 14, 2002)

Start *OTS*. Copy/Paste the information in the Code box below into the pane where it says *"Paste fix here"* and then click the Run Fix button.


```
[Unregister Dlls]
[Registry - All]
< 64bit-BHO's [HKEY_LOCAL_MACHINE] > -> 64bit-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {004B0726-A010-4ABF-8556-FCDB7F1FCA1E} [HKLM] -> [Ñ¸À×ÏÂÔØÖ§³Ö]
YN -> {DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> Reg Error: Value error. [Java(tm) Plug-In 2 SSV Helper]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} [HKLM] -> [Ñ¸À×FLVÊÓÆµÐáÌ½¼°ÏÂÔØÖ§³Ö]
YN -> {28387537-e3f9-4ed7-860c-11e69af4a8a0} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "" -> []
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\
YN -> &Ê¹ÓÃ&Ñ¸À×ÀëÏßÏÂÔØ -> [C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm]
YN -> &Ê¹ÓÃ&Ñ¸À×ÏÂÔØ -> [C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm]
YN -> &Ê¹ÓÃ&Ñ¸À×ÏÂÔØÈ«²¿Á´½Ó -> [C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm]
< Vista Active Application Exception Rules > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules
YN -> {0BA68DD1-DD9E-4E4A-9231-A265662DF1C9} -> profile=private | protocol=17 | dir=in | action=allow | name=liveupdate360 | app=c:\program files (x86)\360\360safe\liveupdate360.exe | 
YN -> {318A1C22-00A7-4314-8A18-5141982DA656} -> profile=private | protocol=6 | dir=in | action=allow | name=360&#23433;&#20840;&#21355;&#22763;&#23454;&#26102;&#20445;&#25252; | app=c:\program files (x86)\360\360safe\safemon\360tray.exe | 
YN -> {7D7E3257-4076-4845-8ACC-603284B792B1} -> profile=public | protocol=6 | dir=in | action=allow | name=360&#23433;&#20840;&#21355;&#22763;&#23454;&#26102;&#20445;&#25252; | app=c:\program files (x86)\360\360safe\safemon\360tray.exe | 
YN -> {A0475B91-2652-49D0-9D74-5824E87AD87C} -> profile=private | protocol=6 | dir=in | action=allow | name=liveupdate360 | app=c:\program files (x86)\360\360safe\liveupdate360.exe | 
YN -> {DB357A2E-71C8-4BA9-9C4A-1B2714726AC7} -> profile=private | protocol=17 | dir=in | action=allow | name=360&#23433;&#20840;&#21355;&#22763;&#23454;&#26102;&#20445;&#25252; | app=c:\program files (x86)\360\360safe\safemon\360tray.exe | 
YN -> {DB525456-8645-4FD7-8DE7-E1A7AB084368} -> profile=public | protocol=17 | dir=in | action=allow | name=360&#23433;&#20840;&#21355;&#22763;&#23454;&#26102;&#20445;&#25252; | app=c:\program files (x86)\360\360safe\safemon\360tray.exe | 
[Files/Folders - Created Within 90 Days]
NY ->  360Box64.sys -> C:\Windows\SysNative\drivers\360Box64.sys
NY ->  360Disabled -> C:\Windows\tasks\360Disabled
NY ->  360Box.sys -> C:\Windows\SysWow64\drivers\360Box.sys
NY ->  360FsFlt.sys -> C:\Windows\SysNative\drivers\360FsFlt.sys
NY ->  BAPIDRV64.SYS -> C:\Windows\SysNative\drivers\BAPIDRV64.SYS
NY ->  efimon.sys -> C:\Windows\SysNative\drivers\efimon.sys
NY ->  360SoftMgr.cpl -> C:\Windows\SysWow64\360SoftMgr.cpl
NY ->  360netmon.sys -> C:\Windows\SysNative\drivers\360netmon.sys
NY ->  360AntiARP.sys -> C:\Windows\SysWow64\drivers\360AntiARP.sys
NY ->  ProtoDrv.sys -> C:\Windows\SysWow64\drivers\ProtoDrv.sys
[Files/Folders - Modified Within 90 Days]
NY ->  Ñ¸À×7.lnk -> C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Ñ¸À×7.lnk
[Files - No Company Name]
NY ->  Ñ¸À×7.lnk -> C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Ñ¸À×7.lnk
[Files/Folders - Unicode - All]
NY -> C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\360????.lnk -> C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\360&#36719;&#20214;&#31649;&#23478;.lnk
NY -> C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\360????.lnk -> C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\360&#36719;&#20214;&#31649;&#23478;.lnk
[Alternate Data Streams]
NY -> @Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:CB0AACC9
```
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. *Post that information back here *.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

If this doesn't work, then there is nothing else we can do & you will need to either put up with it or format the computer & reinstall windows
Unfortunaterly there is only so much we can do on the forum and we have reached our limit now with this one and anything else is likely to be so deeply embedded into the OS that removing it would likely leave the OS unstable

I think anything left over will just be cosmetic & not doing anything


----------



## rfeichel (Jun 11, 2007)

[Registry - All]
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{004B0726-A010-4ABF-8556-FCDB7F1FCA1E}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{004B0726-A010-4ABF-8556-FCDB7F1FCA1E}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0EA37B17-6B8B-4085-8257-F3A4AA69C27A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EA37B17-6B8B-4085-8257-F3A4AA69C27A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Ê¹ÓÃ&Ñ¸À×ÀëÏßÏÂÔØ\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Ê¹ÓÃ&Ñ¸À×ÏÂÔØ\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Ê¹ÓÃ&Ñ¸À×ÏÂÔØÈ«²¿Á´½Ó\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{0BA68DD1-DD9E-4E4A-9231-A265662DF1C9} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BA68DD1-DD9E-4E4A-9231-A265662DF1C9}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{318A1C22-00A7-4314-8A18-5141982DA656} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{318A1C22-00A7-4314-8A18-5141982DA656}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7D7E3257-4076-4845-8ACC-603284B792B1} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7D7E3257-4076-4845-8ACC-603284B792B1}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A0475B91-2652-49D0-9D74-5824E87AD87C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0475B91-2652-49D0-9D74-5824E87AD87C}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DB357A2E-71C8-4BA9-9C4A-1B2714726AC7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB357A2E-71C8-4BA9-9C4A-1B2714726AC7}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DB525456-8645-4FD7-8DE7-E1A7AB084368} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DB525456-8645-4FD7-8DE7-E1A7AB084368}\ not found.
[Files/Folders - Created Within 90 Days]
C:\Windows\SysNative\drivers\360Box64.sys moved successfully.
C:\Windows\tasks\360Disabled folder moved successfully.
C:\Windows\SysWow64\drivers\360Box.sys moved successfully.
C:\Windows\SysNative\drivers\360FsFlt.sys moved successfully.
C:\Windows\SysNative\drivers\BAPIDRV64.SYS moved successfully.
C:\Windows\SysNative\drivers\efimon.sys moved successfully.
C:\Windows\SysWow64\360SoftMgr.cpl moved successfully.
C:\Windows\SysNative\drivers\360netmon.sys moved successfully.
C:\Windows\SysWow64\drivers\360AntiARP.sys moved successfully.
C:\Windows\SysWow64\drivers\ProtoDrv.sys moved successfully.
[Files/Folders - Modified Within 90 Days]
C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Ñ¸À×7.lnk moved successfully.
[Files - No Company Name]
File C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Ñ¸À×7.lnk not found!
[Files/Folders - Unicode - All]
C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\360软件管家.lnk moved successfully.
File C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\360软件管家.lnk not found!
[Alternate Data Streams]
ADS C:\ProgramData\TEMP:CB0AACC9 deleted successfully.
< End of fix log >
OTS by OldTimer - Version 3.1.47.2 fix logfile created on 03292012_115001


----------



## rfeichel (Jun 11, 2007)

If there are any remaining items and they will cause no problem then I will ignore them. Thanks again for your help it is greatly appreciated.


----------



## dvk01 (Dec 14, 2002)

Please double-click *OTScanIt.exe* to run it.
press cleanup & it will will delete/uninstall all the tools we have used to fix your problems and all their backup folders and then delete itself when you next reboot


----------



## rfeichel (Jun 11, 2007)

Ok. thanks again.


----------

