唔知系咪中左毒 求救 THX

撷取2.PNG (449.79 KB)

2014-2-20 08:23 PM

撷取.PNG (23.07 KB)

2014-2-20 08:24 PM

引用:原帖由 tonylin159 於 2014-2-20 08:23 PM 发表
1.使用的Windows 7
2.问题rundll32 已经停止运作 同下面图片果D
3.出问题前NO 图片果D好奈之前都有 但冇乜为意就冇理 rundll32 已经停止运作系大约1星期前发生唔知点解咁

引用:原帖由 SILVESTERABEND 於 2014-2-20 09:38 PM 发表


睇上述资料,系统应该冇中毒。
1图 : 病毒/威胁己被防毒软件隔离。
2图: 唔系毒,祗系用黎测试的Eicar档案(假毒)。

如果出现rundll32问题,建议先做Hijackthis扫瞄报告贴上。

hijackthis.log (11.64 KB)

2014-2-20 09:54 PM, 下载次数: 3

引用:原帖由 tonylin159 於 2014-2-20 09:47 PM 发表
但系Eicar档案唔知点解日日都有.......

引用:原帖由 SILVESTERABEND 於 2014-2-20 10:11 PM 发表
1. 下载/执行Junkware Removal Tool扫毒。执行扫毒前请关闭所有浏览器同程式。
(JRT会自动删除附於浏览器的恶意程式/档案/登录档)

2. 下载/执行 AdwCleaner (Xplode) 扫毒。(按[Clean] 扫毒/删除)
(执行AdwClea ...

log.txt (33.83 KB)

2014-2-21 01:04 AM, 下载次数: 5

AdwCleaner[S1].txt (1.45 KB)

2014-2-21 01:04 AM, 下载次数: 4

JRT.txt (1.32 KB)

2014-2-21 01:04 AM, 下载次数: 3

OTL.Txt (108.13 KB)

2014-2-21 01:04 AM, 下载次数: 2

引用:原帖由 tonylin159 於 2014-2-21 01:04 AM 发表
我用双防毒 NOD32+Bitdefender Antivirus Free Edition

引用:
:OTL
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR
IE - HKCU\..\SearchScopes\{569C0026-B5AA-456D-B222-5B08D49F5FD7}: "URL" =
CHR - Extension: Good Smile Company = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifaliahpcbohdpbocfjpfeaofkmcjai\2_0\
CHR - Extension: Advanced SystemCare Surfing Protection = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_1\
CHR - Extension: Google \u96fb\u5b50\u9322\u5305 = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
O2:64bit: - BHO: (ExplorerWnd Helper) - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
O2 - BHO: (Advanced SystemCare Browser Protection) - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [SoftEther VPN Client UI Helper] D:\Program Files (x86)\SoftEther VPN Client\vpnclient_x64.exe (SoftEther VPN Project at University of Tsukuba, Japan.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O13 - gopher Prefix: missing
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msnim - No CLSID value found

:Files
ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]

引用:原帖由 SILVESTERABEND 於 2014-2-21 11:03 AM 发表
双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。

...

OTL.Txt (108.13 KB)

2014-2-21 12:24 PM, 下载次数: 2

引用:
:OTL
SRV - [2013/10/24 17:46:44 | 000,069,368 | ---- | M] (Bitdefender) [Auto | Running] -- D:\Program Files (x86)\Bitdefender\Antivirus Free Edition\gzserv.exe -- (gzserv)
DRV:64bit: - [2013/05/28 12:12:19 | 000,382,536 | ---- | M] (BitDefender S.R.L.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\trufos.sys -- (trufos)
DRV:64bit: - [2013/04/22 13:21:00 | 000,148,696 | ---- | M] (BitDefender LLC) [File_System | System | Running] -- C:\Windows\SysNative\drivers\gzflt.sys -- (gzflt)
DRV:64bit: - [2013/04/17 14:59:58 | 000,593,144 | ---- | M] (BitDefender) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\avckf.sys -- (avckf)
DRV:64bit: - [2013/04/17 14:59:56 | 000,718,840 | ---- | M] (BitDefender) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avc3.sys -- (avc3)
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR
FF - HKCU\Software\MozillaPlugins\@tightropeinteractive.com/Plugin: C:\Users\admin\AppData\Local\TNT2\2.0.0.1627\npTNT2.dll (Search.Us.com)
FF - HKCU\Software\MozillaPlugins\@tnt2ghost.com/Plugin: C:\Users\admin\AppData\Local\TNT2\2.0.0.1627\npTNT2ghost.dll (Search.Us.com)
CHR - Extension: Good Smile Company = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifaliahpcbohdpbocfjpfeaofkmcjai\2_0\
CHR - Extension: Advanced SystemCare Surfing Protection = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_1\
CHR - Extension: Google \u96fb\u5b50\u9322\u5305 = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
O2:64bit: - BHO: (ExplorerWnd Helper) - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
O2 - BHO: (Advanced SystemCare Browser Protection) - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\livecall - No CLSID value found
O18 - Protocol\Handler\msnim - No CLSID value found

:Files
C:\Windows\PEV.exe
C:\Windows\MBR.exe
C:\Windows\sed.exe
C:\Windows\grep.exe
C:\Windows\zip.exe
C:\Windows\SysWow64\pub_store.dat

ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]

引用:原帖由 SILVESTERABEND 於 2014-2-21 07:47 PM 发表
双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。

...

02212014_203830.log (13.46 KB)

2014-2-21 08:43 PM, 下载次数: 1

引用:原帖由 SILVESTERABEND 於 2014-2-21 08:57 PM 发表
OK,暂时唔理BD AV Free残留driver档案住。
1. 重有冇弹rundll32通知?
2. NOD有冇继续侦测到Eicar程式?

引用:原帖由 tonylin159 於 2014-2-22 12:20 AM 发表
冇弹了 唔该哂版主

引用:原帖由 SILVESTERABEND 於 2014-2-22 09:52 AM 发表



rundll32通知可能系装两套防毒软件冲突影响。
建议楼主再做新1份OTL.txt扫瞄报告贴上,删除埋BD AV Free残留档案/驱动程式。

new OTL.Txt (112.5 KB)

2014-2-22 01:36 PM, 下载次数: 1