电脑疑似中毒

hijackthis.log (12.34 KB)

2014-5-21 10:14 AM, 下载次数: 3

引用:原帖由 亮叔 於 2014-5-21 10:14 AM 发表
部电机唔知点解有时会好似一直禁住alt制同shift制咁
姐系一拣野就同时拣左好多
打1234就自动变!@#$
跟住试过蚊左个keyboard佢拣野都系咁
用完Malwarebytes Anti-Malware删毒都系无用
附上hijackthis求救: ...

引用:
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - f:\program files\real\realplayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: BrowserHelper - {4BF2CB0E-658A-442B-AC83-A64EC2150BFC} - F:\Documents and Settings\All Users\Application Data\PPBrowserHelper\BHO\TipsBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - F:\Program Files\Thunder Network\Thunder\BHO\XunleiBHO7.9.16.4670.dll
O2 - BHO: QvodExtend - {A8502600-B272-4F68-A67B-A0305D46D297} - F:\Program Files\QvodPlayer\QvodExtend.dll (file missing)
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - F:\Documents and Settings\Administrator\Application Data\FlashGetBHO\FlashGetBHO.dll
O2 - BHO: Xunlei BHO Platform - {DE05CF4A-7B0A-4775-B5E5-396244938679} - F:\Program Files\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll


O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QvodTerminal] "F:\Program Files\QvodPlayer\QvodTerminal.exe" -autorun
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [kuping] 162
O4 - HKLM\..\Run: [mobilegeni daemon] F:\Program Files\Mobogenie\DaemonProcess.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [GarenaPlus] "F:\Program Files\Garena Plus\GarenaMessenger.exe" -autolaunch
O4 - HKCU\..\Run: [] F:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [Pando Media Booster] F:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [DAEMON Tools Ultra Agent] "F:\Program Files\DAEMON Tools Ultra\DTAgent.exe" -autorun
O4 - HKCU\..\Run: [se] "F:\Documents and Settings\Administrator\Application Data\SkypEmoticons\SE.exe" /minimized


O8 - Extra context menu item: &使用BitComet下载本页视讯 - res://F:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &使用迅雷下载 - F:\Program Files\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\Program Files\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: &使用迅雷离线下载 - F:\Program Files\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: Foxy ?r?q - res://F:\Documents and Settings\Administrator\桌面\Foxy.exe/search.htm
O8 - Extra context menu item: Foxy ?? - res://F:\Documents and Settings\Administrator\桌面\Foxy.exe/download.htm
O8 - Extra context menu item: Search the Web - F:\Program Files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
O8 - Extra context menu item: 使用BitComet下载全部连结 - res://F:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: 使用BitComet下载连结(&B) - res://F:\Program Files\BitComet\BitComet.exe/AddLink.htm
O9 - Extra button: (no name) - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\Program Files\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
O9 - Extra button: 发布至部落格 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - F:\Program Files\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
O9 - Extra button: 店??弦 - {4248FE82-7FCB-46AC-B270-339F08212110} - F:\Program Files\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - F:\Program Files\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - F:\Program Files\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
O9 - Extra button: 浪琩呼? - {CCF151D8-D089-449F-A5A4-D9909053F20F} - F:\Program Files\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://F:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O23 - Service: IviRegMgr - InterVideo - F:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - F:\WINDOWS\system32\GameMon.des.exe (file missing)

引用:
:files
f:\program files\real\realplayer\rpbrowserrecordplugin.dll
F:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
F:\Documents and Settings\All Users\Application Data\PPBrowserHelper\BHO\TipsBHO.dll
F:\Program Files\Thunder Network\Thunder\BHO\XunleiBHO7.9.16.4670.dll
F:\Documents and Settings\Administrator\Application Data\FlashGetBHO\FlashGetBHO.dll
F:\Program Files\Thunder Network\Thunder\Thunder BHO Platform\np_tdieplat.dll
F:\Program Files\QvodPlayer\QvodTerminal.exe
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\Pando Networks\Media Booster\PMB.exe
F:\Documents and Settings\Administrator\Application Data\SkypEmoticons\SE.exe

OTL.Txt (76.6 KB)

2014-5-21 09:03 PM, 下载次数: 3

JRT.txt (5.57 KB)

2014-5-21 09:03 PM, 下载次数: 3

log.txt (26.1 KB)

2014-5-21 09:03 PM, 下载次数: 3

引用:
:OTL
IE - HKLM\..\SearchScopes,DefaultScope = {BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.amaizingsearches.info/?l=1&q={searchTerms}&pid=34&r=2014/03/29&hid=7366470573040629675&lg=EN&cc=HK&unqvl=51
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.hao123.com/?tn=62002018_5_hao_pg [binary data]
IE - HKCU\..\SearchScopes\{1FF7973D-AB0A-496d-82C1-4EADBBA11E7B}: "URL" = http://www.soso.com/q?sc=web&cid=th.ub&w={searchTerms}&cin=eFZ3Ru2LDG3kNsP7wlKaug0000c30g00&lr=&ie={inputEncoding}&unc=y400372_95
IE - HKCU\..\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}: "URL" = http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&bar=13&tn=synacast_cb
FF - HKLM\Software\MozillaPlugins\@pps.tv/npWebPlayer: F:\Program Files\PPStream\npWebPlayer.dll File not found
FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodInsert: F:\Program Files\QvodPlayer\npQvodInsert.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
CHR - plugin: Error reading preferences file
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {65F8A3D2-4C22-4A33-9633-73167EAEEC45} - No CLSID value found.
O4 - Startup: F:\Documents and Settings\All Users\「开始」功能表\程式集\启动\McAfee Security Scan Plus.lnk = F:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: &ｨﾏ･ﾎｨｳｹp､Uｸ - Reg Error: Key error. File not found
O8 - Extra context menu item: &ｨﾏ･ﾎｨｳｹp､Uｸ・ｳ｡ﾃ・ｵ - F:\Program Files\Thunder Network\Thunder\BHO\getAllurl.htm ()
O8 - Extra context menu item: &ｨﾏ･ﾎｨｳｹpﾂ?[u､Uｸ - Reg Error: Key error. File not found
O8 - Extra context menu item: &使用优蛋下载 - F:\Program Files\UDown\getUrl.htm File not found
O8 - Extra context menu item: &使用优蛋下载全部链接 - F:\Program Files\UDown\getAllUrl.htm File not found
O8 - Extra context menu item: ﾊｹﾓﾃｿ・ｵ3ﾏﾂﾔﾘ - F:\Program Files\FlashG@@@@2013-08-09work\FlashGet 3\BHO\fdgeturl.htm File not found
O8 - Extra context menu item: ﾊｹﾓﾃｿ・ｵ3ﾏﾂﾔﾘｵｱﾇｰﾊﾓﾆｵ - F:\Program Files\FlashG@@@@2013-08-09work\FlashGet 3\BHO\fdgetflvurl.htm File not found
O8 - Extra context menu item: ﾊｹﾓﾃｿ・ｵ3ﾏﾂﾔﾘﾈｫｲｿﾁｴｽﾓ - F:\Program Files\FlashG@@@@2013-08-09work\FlashGet 3\BHO\fdgetallurl.htm File not found
O8 - Extra context menu item: ﾊｹﾓﾃｿ・ｵ3ﾏﾂﾔﾘﾈｫｲｿﾊﾓﾆｵ - F:\Program Files\FlashG@@@@2013-08-09work\FlashGet 3\BHO\fdgetallflvurl.htm File not found
@Alternate Data Stream - 139 bytes -> F:\Documents and Settings\All Users\Application Data\TEMP:F47F54AA


:Files
F:\WINDOWS\tasks\SW.Booster-S-872270714.job
F:\WINDOWS\tasks\User_Feed_Synchronization-{3691A6D1-4313-41B3-84AB-A395DB748699}.job
F:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-1563985344-1801674531-500UA.job
F:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-1563985344-1801674531-500Core.job

ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]

AdwCleaner[S0].txt (7.56 KB)

2014-5-21 11:30 PM, 下载次数: 3

mbam log.txt (1.04 KB)

2014-5-21 11:30 PM, 下载次数: 3

OTL.Txt (75.93 KB)

2014-5-21 11:30 PM, 下载次数: 3

引用:原帖由 亮叔 於 2014-5-21 11:30 PM 发表
感觉部机快番好多

引用:原帖由 亮叔 於 2014-5-22 02:26 PM 发表
正常番了
唔该晒