[已解决]

引用:原帖由 milan080320 於 2014-3-14 08:21 PM 发表
GOOGLE CHROME 扩充功能无法移除 YTADuREMoiVal 1.5

求教! THX 师兄><

9516747

引用:原帖由 SILVESTERABEND 於 2014-3-14 08:28 PM 发表



下载 Hijackthis至桌面 > 按 Install > 按[ Accept] > 按 [Do a system scan and save a logfile ] > 完成扫瞄系统，hijackthis会弹出报告。

储存该扫瞄报告於桌面。请把Hijackthis 扫瞄报告贴上。

引用:
R3 - URLSearchHook: Splashtop Connect SearchHook - {0F3DC9E0-C459-4a40-BCF8-747BD9322E10} - C:\Program Files (x86)\Splashtop\Splashtop Connect IE\AddressBarSearch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll
O2 - BHO: Xunlei BHO Platform - {DE05CF4A-7B0A-4775-B5E5-396244938679} - C:\Program Files (x86)\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll


O4 - HKLM\..\Run: [THX TruStudio NB Settings] "C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [SmartViewAgent] "C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe"
O4 - HKLM\..\Run: [STCAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STCAgent.exe"
O4 - HKLM\..\Run: [ZyngaGamesAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe"
O4 - HKLM\..\Run: [ROC_roc_ssl_v12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
O4 - HKCU\..\Run: [Extraram] C:\Program Files (x86)\Extra RAM\ExtraRAM.exe
O4 - HKCU\..\Run: [Hoolapp Android] "C:\Users\Hau\AppData\Roaming\HOOLAP~1\Hoolapp.exe" /Minimized
O4 - HKCU\..\Run: [qwupdate] C:\Program Files (x86)\Wise\update.exe
O4 - HKCU\..\Run: [Thunder] C:\Program Files (x86)\Thunder Network\Thunder\Program\Thunder.exe -silent -StartType:AutoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe

O8 - Extra context menu item: &妏蚚&捃泞烛盄狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥窒蝈诿 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: Foxy 下载 - res://D:\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜寻 - res://D:\Foxy.exe/search.htm
O8 - Extra context menu item: 使用光影编辑和美化 - C:\Program Files (x86)\nEO iMAGING\NeoOpenNeo.htm
O8 - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm
O9 - Extra 'Tools' menuitem: ??迅雷看看播放器 - {14c1d00e-0b92-4379-880b-444fa2d740dd} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm
O9 - Extra button: ??迅雷看看播放器 - {24c1d00e-0b92-4379-880b-444fa2d740dd} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolBar.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll/206 (file missing)
O18 - Protocol: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~2\KuGou\KGMusic\KUGOO3~1.OCX (file missing)
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~2\KuGou\KGMusic\KUGOO3~1.OCX (file missing)
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Baidu Updater (BaiduUpdater) - Baidu.com, Inc. - C:\Program Files (x86)\Baidu\BaiduUpdate\bdupdate.exe
O23 - Service: BitComet Disk Boost Service (BITCOMET_HELPER_SERVICE) - www.BitComet.com - C:\Program Files\BitComet\tools\BitCometService.exe
O23 - Service: Splashtop Connect IE Software Updater Service (WCUService_STC_IE) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe

引用:
:files
C:\Program Files (x86)\Wise\update.exe
C:\Program Files (x86)\Thunder Network\Thunder\Program\Thunder.exe
C:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe
C:\Program Files (x86)\Thunder Network\Thunder\Program\XLUEOPS.exe
c:\program files (x86)\common files\thunder network\tp\ver1\1.1.2.226_1111\thunderplatform.exe
C:\Program Files (x86)\Splashtop\Splashtop Connect IE\AddressBarSearch.dll
C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll
C:\Program Files (x86)\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STCAgent.exe
C:\Users\Hau\AppData\Roaming\HOOLAP~1\Hoolapp.exe
C:\Program Files (x86)\Baidu\BaiduUpdate\bdupdate.exe
C:\Program Files\BitComet\tools\BitCometService.exe
C:\Program Files (x86)\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe

引用:原帖由 SILVESTERABEND 於 2014-3-15 06:49 PM 发表
开机按F8,入安全模式做Fix checked & OTM 删除。
1. 执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。

2. 下载/执行 OTM做删除。
cop ...

引用:原帖由 SILVESTERABEND 於 2014-3-15 08:47 PM 发表
1. 楼主要去程式集移除以下3套程式(如果见到的话):
a. EXstraCouupone
b. SSaVErExtennsioNN
c. YTADuREMoiVal

2. 下载/执行 AdwCleaner (Xplode) 扫毒。(按[Clean] 扫毒/删除)
(执行AdwCleaner关闭所有浏览器 ...

引用:
:OTL
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=SPLEP1&pc=SPLH
IE - HKCU\..\SearchScopes\{16A5F9E0-FBC8-45CA-88D5-4F2C9A701461}: "URL" = }
IE - HKCU\..\SearchScopes\{BF2C83E0-99B5-4df6-8E3B-26A91DC8E850}: "URL" = http://www.google.com/cse?cx=partner-pub-3794288947762788%3A6976579318&ie=UTF-8&q=&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A6976579318&q={searchTerms}
IE - HKCU\..\SearchScopes\{C578CD2E-72EB-468a-9468-0443EBF3A328}: "URL" =
CHR - Extension: YTADuREMoiVal = C:\Users\Hau\AppData\Local\Google\Chrome\User Data\Default\Extensions\pknkokegmcgkohgjmaibnnmapmenipgg\1.5_0\
O2:64bit: - BHO: (捃泞狟婥盓厥) - {004B0726-A010-4ABF-8556-FCDB7F1FCA1E} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.9.18.4724.dll (深圳市迅雷网络技术有限公司)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [STCAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STCAgent.exe" File not found
O4 - HKLM..\Run: [ZyngaGamesAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe" File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8:64bit: - Extra context menu item: &使用BitComet下载 - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8:64bit: - Extra context menu item: &使用BitComet下载全部链接 - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8:64bit: - Extra context menu item: 使用光影编辑和美化 - C:\Program Files (x86)\nEO iMAGING\NeoOpenNeo.htm ()
O8:64bit: - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm ()
O8:64bit: - Extra context menu item: 添加当前页到迅雷看看播放器标签 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenuAddStoreTab.htm ()
O8 - Extra context menu item: &使用BitComet下载 - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &使用BitComet下载全部链接 - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: 使用光影编辑和美化 - C:\Program Files (x86)\nEO iMAGING\NeoOpenNeo.htm ()
O8 - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm ()
O8 - Extra context menu item: 添加当前页到迅雷看看播放器标签 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenuAddStoreTab.htm ()
O9 - Extra 'Tools' menuitem : 启动迅雷看看播放器 - {14c1d00e-0b92-4379-880b-444fa2d740dd} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm ()
O9 - Extra Button: 启动迅雷看看播放器 - {24c1d00e-0b92-4379-880b-444fa2d740dd} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolBar.htm ()
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9772A082-A86F-4581-8E01-3C11728F5708}: DhcpNameServer = 203.185.0.32 203.185.0.33 203.185.0.34
O18:64bit: - Protocol\Handler\KuGoo - No CLSID value found
O18:64bit: - Protocol\Handler\KuGoo3 - No CLSID value found
O18 - Protocol\Handler\KuGoo {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~2\KuGou\KGMusic\KUGOO3~1.OCX File not found
O18 - Protocol\Handler\KuGoo3 {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~2\KuGou\KGMusic\KUGOO3~1.OCX File not found
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll File not found

:Files
C:\Program Files (x86)\EXstraCouupone
C:\Program Files (x86)\SSaVErExtennsioNN
C:\Program Files (x86)\YTADuREMoiVal
C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
C:\Windows\tasks\WpsUpdateTask_Hau.job
C:\Windows\tasks\Wise Disk Cleaner Schedule Task.job
C:\ProgramData\V93GE
C:\ProgramData\T09F8
C:\Windows\SysWow64\pub_store.dat

ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]

引用:原帖由 SILVESTERABEND 於 2014-3-16 11:55 AM 发表
双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。

...

引用:原帖由 milan080320 於 2014-3-16 07:10 PM 发表
YTADuREMoiVal 1.5仍未UNINTALL>

引用:原帖由 milan080320 於 2014-3-16 09:47 PM 发表
无REDIRECT,但在CHORME>工具>扩充功能>YTADuREMoiVal == ><
仍然见到

引用:原帖由 milan080320 於 2014-3-17 01:26 PM 发表
已重灌GOOGLE CHROME,成功删除了! THANKS :loveliness: