Chrome Firefox中毒(首页出现websearch)

引用:原帖由 傻豹^^ 於 2013-10-1 10:28 AM 发表
试过设定其他首页 重开又变番websearch 求解决方法

另外我用左Malwarebytes Anti-Malware扫瞄 但唔知应该删边个

上传左报告 http://www.s ...

引用:
O2 - BHO: VideoUrlSniffer - {00000ADA-7E0D-47C1-986C-F017D09C4304} - (no file)
O2 - BHO: XlBrowserAddinBho.XlBrowserAddinBhoObject - {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - D:\Thunder Network\BHO\XlBrowserAddin1.0.5.64.dll
O2 - BHO: SearchNewTab - {4846ECFE-AA68-2B7E-B448-567E747C771E} - C:\ProgramData\SearchNewTab\t.dll
O2 - BHO: 瑞俴弝畦温挚狟婥郪璃 - {4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA} - C:\Users\yin\funshion\funshiontools\FunshionHelper.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Thunder Network\BHO\XunleiBHO7.2.3.3254.dll
O2 - BHO: Dowanlloada! keeeper - {92BB0E86-0F68-CA7B-794D-A9087ACBDB12} - C:\ProgramData\Dowanlloada! keeeper\NHlCL6zjx.dll
O2 - BHO: TopSpaceHelper - {C8625893-2C0F-4484-8C18-52B00D5A8BB9} - C:\Program Files (x86)\TopSpace\bin\TopSpaceHelper.dll (file missing)
O2 - BHO: 螃龚 - {DA742A73-CFA7-4DE2-BF28-1FC51CF214BC} - C:\Users\yin\AppData\Roaming\OpenTab\OpenTab.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll


O4 - HKLM\..\Run: [TopSpace] C:\Program Files (x86)\TopSpace\bin\TopSpaceHelper.exe UPDATE
O4 - HKLM\..\Run: [appis.exe] C:\Users\yin\AppData\Local\AppIs\appis.exe
O4 - HKCU\..\Run: [KeywordSearchUpdater] C:\Program Files (x86)\Keyword Search\KeywordSearchUpdater.exe
O4 - HKCU\..\Run: [sponsorkeywordagent] C:\Program Files (x86)\sponsorkeyword\sponsorkeywordagent.exe
O4 - HKCU\..\Run: [ZhuoXiu] "C:\Program Files (x86)\袤凅\ZhuoXiu.exe" -auto
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [Opentab] C:\Users\yin\AppData\Roaming\Opentab\Opentab.exe
O4 - HKCU\..\Run: [FDoumiStart] C:\Users\yin\AppData\Roaming\FileDoumi\FileDoumiUpgrade.exe
O4 - HKCU\..\Run: [FDoumiup2Start] "c:\users\yin\appdata\roaming\filedoumi\filedoumiuphp.exe"
O4 - HKCU\..\Run: [Disker] rundll32.exe C:\Windows\system32\HIMYM.DLL,DW
O4 - HKCU\..\Run: [GarenaPlus] "C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe" -autolaunch
O4 - HKCU\..\Run: [SE] "C:\Users\yin\AppData\Roaming\SkypEmoticons\SE.exe" /minimized
O4 - HKCU\..\Run: [Funshion] "C:\Program Files (x86)\Funshion Online\2.8.6.51\Funshion.exe" startbywindows tray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - Global Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe

O8 - Extra context menu item: &使用迅雷下载 - D:\Thunder Network\BHO\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\Thunder Network\BHO\GetAllUrl.htm
O8 - Extra context menu item: &使用迅雷离线下载 - D:\Thunder Network\BHO\OfflineDownload.htm
O8 - Extra context menu item: Foxy 下载 - res://D:\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜寻 - res://D:\Foxy\Foxy.exe/search.htm
O20 - AppInit_DLLs: himym.dll c:\progra~2\ss-hel~1\sprote~1.dll c:\progra~2\websea~1\sprote~1.dll

引用:
:files
C:\Users\yin\AppData\Roaming\SkypEmoticons\SE.exe
D:\Thunder Network\BHO\XlBrowserAddin1.0.5.64.dll
C:\ProgramData\SearchNewTab\t.dll
C:\Users\yin\funshion\funshiontools\FunshionHelper.dll
D:\Thunder Network\BHO\XunleiBHO7.2.3.3254.dll
C:\ProgramData\Dowanlloada! keeeper\NHlCL6zjx.dll
C:\Users\yin\AppData\Roaming\OpenTab\OpenTab.dll
C:\Program Files (x86)\Yontoo\YontooIEClient.dll
C:\Users\yin\AppData\Local\AppIs\appis.exe
C:\Users\yin\AppData\Roaming\Opentab\Opentab.exe
C:\Users\yin\AppData\Roaming\FileDoumi\FileDoumiUpgrade.exe
c:\users\yin\appdata\roaming\filedoumi\filedoumiuphp.exe
C:\Windows\system32\HIMYM.DLL
C:\Users\yin\AppData\Roaming\SkypEmoticons\SE.exe
C:\Program Files (x86)\Funshion Online\2.8.6.51\Funshion.exe
c:\progra~2\ss-hel~1\sprote~1.dll
c:\progra~2\websea~1\sprote~1.dll

引用:原帖由 傻豹^^ 於 2013-10-1 08:59 PM 发表
是否勾选下列所有项? THX

引用:原帖由 SILVESTERABEND 於 2013-10-2 09:42 AM 发表


执行Hijackthis ,fix checked #4帖第1项所有项目。

引用:原帖由 j32738 於 2013-10-2 02:20 PM 发表
楼主解决左未??

第时上网小心禁野...同埋最好装番个防毒,咁就唔洗搞几日了~

引用:原帖由 傻豹^^ 於 2013-10-2 05:58 PM 发表

已完成 好像已解决

JRT扫毒报告
9151124
ComboFix扫毒报告
9151125新1份Hijackthis扫瞄报告
9151126

引用:原帖由 SILVESTERABEND 於 2013-10-2 07:32 PM 发表
1. 楼主MBAM扫毒报告显示部份PUP档案(威胁)仍未删除。
要勾选MBAM扫到所档案,按Remove Selected做删除。

2. 观察1两天,睇3个浏览器(IE/Chrome/Firefox)重有冇被websearch绑架。
(系统有好多PUP/恶意程式 ...