Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Question

A lot of outgoing connections to random IPs

by Apr 27, 2015 8:35AM PDT

So I've been getting this SUPER unstable internet connections for about 3 months, and lately I literally can't access internet. I always thought is the ISP, but after I phoned them, they said there's a huge traffic sourcing from my computer (the one that can't access internet) which used up 95% of the bandwidth. So I got my self ZoneAlarm firewall, and found out there are about 2 outgoing connections to same 7 or 8 IPs every second. My Anti-virus(Bitdefender) can't find anything, Malwarebytes found something but it didn't solve the issue. Any other devices are able to use the internet but not really fast. The regular downloading speed is suppose to be 25-30 Mbps but the highest now is only 1. So please help, thanks!

Discussion is locked

28 Posts
- Collapse + Expand Details
- Collapse -
Answer
Try the usual
by Former Forum moderator Apr 27, 2015 8:42AM PDT
- Collapse -
This didn't help
by renyizhang Apr 27, 2015 12:12PM PDT

I just spent about 4 hours completing everything it said. Still the usual, you can go on program like MSN, QQ or teamspeak, but every time I open something on google chrome, it says ERR_TIMED_OUT or sometimes DSN_PROBE_FINISHED or something like that

This is the rkill log file if you are interested

Rkill 2.7.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2015 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 04/27/2015 09:09:46 PM in x64 mode.
Windows Version: Windows 8.1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

* Windows Firewall Disabled

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 04/27/2015 09:12:20 PM
Execution time: 0 hours(s), 2 minute(s), and 34 seconds(s)

- Collapse -
I've run into some newer nasties.
by r. proffitt Former Forum moderator Apr 27, 2015 12:35PM PDT

But these are so far related to torrent users.

Tell the forum about the firewall. What do you use?

And share a HIJACKTHIS log when these connections are up. Remember that sometimes it's just Windows Update doing this. There is no planned fix but you can turn off WU for a while to see if that's it.
Bob

- Collapse -
Zonealarm
by renyizhang Apr 27, 2015 1:03PM PDT
- Collapse -
In the past ZA would list what app is doing that.
by r. proffitt Former Forum moderator Apr 27, 2015 1:15PM PDT

The log does tell me something but not enough.

Let's see that hijackthis log.

- Collapse -
I don't see hijack log
by renyizhang Apr 27, 2015 1:34PM PDT
- Collapse -
Try google.
by r. proffitt Former Forum moderator Apr 27, 2015 2:01PM PDT

Google "How to make a HIJACKTHIS log."

I understand some don't want to reveal that much but it's one of the things I look over. If this is too much, head on over to the bleepingcomputer.com forum where they did even deeper.
Bob

- Collapse -
(NT) PS. SIgning off. BBL.
by r. proffitt Former Forum moderator Apr 27, 2015 2:03PM PDT
- Collapse -
there's connection in safe mode
by renyizhang Apr 27, 2015 1:08PM PDT

I am able to access any websites and game with pretty much the normal internet speed.

- Collapse -
Safe mode
by pgc3 Apr 27, 2015 10:29PM PDT

Sounds as if you have a bug. Go to a clean computer, download Malwarebytes, send it to a flash drive..boot the sick system into SAFE MODE WITH NETWORKING, input the FD, run a MWB scan and see what it finds..at the end of the scan, click SHOW RESULTS, then attempt removal of any items highlighted in red. Good luck.

- Collapse -
I did find some indication of a trojan.
by r. proffitt Former Forum moderator Apr 28, 2015 12:30AM PDT

But without more clues that's all I got. Let's hope a hijackthis log will show it.
Bob

- Collapse -
here is the hijack log
by renyizhang Apr 28, 2015 3:08AM PDT
- Collapse -
(NT) BRB. Next time. Keep links simple.
by r. proffitt Former Forum moderator Apr 28, 2015 3:43AM PDT
- Collapse -
Can't decode where the file is.
by r. proffitt Former Forum moderator Apr 28, 2015 3:44AM PDT

You could paste the text in a reply.

- Collapse -
It won't let me paste the log
by renyizhang Apr 28, 2015 6:14AM PDT
- Collapse -
tried that.
by r. proffitt Former Forum moderator Apr 28, 2015 6:26AM PDT

I can't guess why there are illegal symbols. HIJACKTHIS logs are plain text. As we have reached an impasse you will have to know or research each line in the log file.
Bob

- Collapse -
Answer
Now it worked. Guess the dropper was offline.
by Former Forum moderator Apr 28, 2015 6:32AM PDT

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 12:02:25 PM, on 2015-04-28
Platform: Unknown Windows (WinNT 6.02.100Cool
MSIE: Internet Explorer v11.0 (11.00.9600.17416)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Users\renyi_000\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe
C:\Program Files (x86)\Tencent\QQ\QQProtect\Bin\QQProtect.exe
C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
C:\Program Files (x86)\Tencent\QQ\Bin\TXPlatform.exe
C:\Program Files (x86)\Tencent\QQ\bin\QQ.exe
C:\Program Files (x86)\Tencent\QQ\bin\QQExternal.exe
C:\Users\renyi_000\Desktop\HijackThis.exe
C:\Program Files (x86)\Tencent\QQ\txupd.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: VideoUrlSniffer - {00000ADA-7E0D-47C1-986C-F017D09C4304} - C:\Users\Public\Thunder Network\XMP5\Addins\VideoUrlSniffer.2.3.3.211.(986).dll
O2 - BHO: Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll
O2 - BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - C:\Program Files (x86)\360\360safe\safemon\safemon.dll
O2 - BHO: QQMiniDL Helper Class - {C9C7334B-5657-41e1-8F79-F6AACECA05F4} - C:\Program Files (x86)\Common Files\Tencent\QQMiniDL\60\Browser\QQIEHelper01.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll
O2 - BHO: AccountProtect - {DDD362CF-523B-4BC9-8FDC-58F93B6BC945} - C:\Users\renyi_000\AppData\Roaming\Tencent\QQ\QQAntiPhishing\AccountProtect.dll
O2 - BHO: Xunlei BHO Platform - {DE05CF4A-7B0A-4775-B5E5-396244938679} - C:\Program Files (x86)\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
O3 - Toolbar: Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Raptr] C:\PROGRA~2\Raptr\raptrstub.exe --startup
O4 - HKLM\..\Run: [360Safetray] "C:\Program Files (x86)\360\360safe\safemon\360Tray.exe" /start
O4 - HKLM\..\Run: [ZoneAlarm] "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe"
O4 - HKCU\..\Run: [QQ2009] "C:\Program Files (x86)\Tencent\QQ\QQProtect\Bin\QQProtect.exe" /background
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\renyi_000\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [Bitdefender Wallet Agent] "C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe"
O4 - HKCU\..\Run: [XMP] "C:\Users\Public\THUNDE~1\XMP5\V5115~1.379\Program\xmp.exe" /embedding /sstartfrom Startup104
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: ???? - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: ???? - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: ???? - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O8 - Extra context menu item: ???? - C:\Program Files (x86)\Common Files\Tencent\QQMiniDL\60\Browser\xfgeturl.htm
O9 - Extra button: (no name) - {14c1d00e-0b92-4379-880b-444fa2d740dd} - C:\Users\Public\Thunder Network\XMP5\V5.1.15.3791\Program\XmpIEToolMenu.htm (file missing)
O9 - Extra 'Tools' menuitem: ?????? - {14c1d00e-0b92-4379-880b-444fa2d740dd} - C:\Users\Public\Thunder Network\XMP5\V5.1.15.3791\Program\XmpIEToolMenu.htm (file missing)
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar32.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~2\KuGou\KGMusic\KUGOO3~1.OCX
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~2\KuGou\KGMusic\KUGOO3~1.OCX
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: BaiduYunUtility - Unknown owner - C:\Users\renyi_000\AppData\Roaming\baidu\BaiduYunGuanjia\YunUtilityService.exe (file missing)
O23 - Service: @oem41.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service (BcmBtRSupport) - Unknown owner - C:\windows\system32\BtwRSupportService.exe (file missing)
O23 - Service: BDHY Service (bddlsvc) - Unknown owner - C:\Users\renyi_000\AppData\Roaming\baidu\BaiduRJDownloader\1.5.0.89\bddlsvc.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EasyAntiCheat - EasyAntiCheat Ltd - C:\windows\system32\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GamesAppIntegrationService - WildTangent - C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
O23 - Service: GamesAppService - WildTangent, Inc. - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\windows\system32\nvvsvc.exe (file missing)
O23 - Service: HP SimplePass Service (omniserv) - Softex Inc. - C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
O23 - Service: RosettaStoneDaemon - Rosetta Stone Ltd. - C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10101 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Bitdefender Desktop Update Service (UPDATESRV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies Ltd. - C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: Bitdefender Virus Shield (VSSERV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: ZoneAlarm Privacy Service (ZAPrivacyService) - Check Point Software Technologies, Ltd. - C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe
O23 - Service: ???? (ZhuDongFangYu) - 360.cn - C:\Program Files (x86)\360\360safe\deepscan\ZhuDongFangYu.exe

--
End of file - 14466 bytes

- Collapse -
See the malware TENCENT?
by r. proffitt Former Forum moderator Apr 28, 2015 6:40AM PDT
- Collapse -
that's odd
by renyizhang Apr 28, 2015 8:06AM PDT

That is kind of odd. Since Tencent is a company who developed QQ which is a messaging software we've been using for quite a long time. Same with 360, I stopped using that for about a year cause I got Bitdefender since they are incompatible, and I got it back just yesterday, because it is compatible again and I was hoping it would fix the problem, which it didn't. So since I tried everything about 3 times, do you want me to uninstall them and try again?

- Collapse -
Your choice.
by r. proffitt Former Forum moderator Apr 28, 2015 8:13AM PDT

You can research those titles and from what I see they are suspect as malware/adware and more.

If you want, start over at Bleepingcomputer.com. They should spot these and maybe more.

In short, I know folk that want bad apps.
Bob

- Collapse -
Thanks
by renyizhang Apr 28, 2015 8:29AM PDT

OK, I will try again and bleepingcomputer. Thanks for your help!

- Collapse -
Well.
by renyizhang Apr 28, 2015 8:08AM PDT

Well, I mean the only things that I can go on right now are google's homepage and search with it, but can't open any websites and QQ (Tencent)

- Collapse -
Time to use your backup image/restore media?
by Dafydd Apr 28, 2015 8:36AM PDT

I mean a Chinese messaging app? What could possibly go wrong. As a test get shot of it, if things don't improve, time for the backup.
Dafydd.

- Collapse -
Answer
Story continues on Bleepingcomputer.
by Former Forum moderator Apr 28, 2015 8:47AM PDT
- Collapse -
Legit or not.
by Dafydd Apr 28, 2015 8:58AM PDT
- Collapse -
Folk that don't know me or Grif
by r. proffitt Former Forum moderator Apr 28, 2015 9:01AM PDT

Seem to have a rough time removing the iffy or bad things. They may need a choir, sermon and exorcism.
Bob

- Collapse -
Probelm Solved. But..
by renyizhang Apr 28, 2015 10:00AM PDT

Now, after I uninstall QQ and 360 in safemode and did the Griff's thing, I was able to access internet. But downloading speed still sit at 2Mbps. Is there anything else I could do?

- Collapse -
That Unknown Windows is a bothersome item.
by r. proffitt Former Forum moderator Apr 28, 2015 10:05AM PDT
Back to Computer Help forum

CNET Forums

Operating Systems
Software
Electronics & Gadgets
Hardware
Tablets & Mobile Devices
General Help
Brand Forums
Roadshow Autos
Off Topic

Other Forums

Forum Info