求求大家帮下手,部机中左广告毒同上网好慢,首页又被骑劫

hijackthis.log (23.29 KB)

2014-5-6 01:03 PM, 下载次数: 5

hijackthis.log (23.29 KB)

2014-5-6 01:02 PM, 下载次数: 3

引用:
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: TBLayoutBHO - {008f6853-9cb4-41c5-a950-39d55e5e06ba} - C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll
O2 - BHO: XlBrowserAddinBho.XlBrowserAddinBhoObject - {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.8.71.dll
O2 - BHO: QPMIEHelper - {50F4150A-48B2-417A-BE4C-C83F580FB904} - C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3192\npQQPhoneManagerExt.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\xunleiBHO7.2.10.3694.dll
O2 - BHO: ValueApps Loader - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files (x86)\Conduit\ValueApps\IE\ValueAppsLoader.dll
O2 - BHO: Movies Toolbar (Dist. by MaxiGet Ltd.) - {a25ac361-002e-48e8-833b-e614322236b4} - C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~2\IE\searchresultsDx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: SerialTrunc - {e76b4f24-4a2f-4e65-ad36-e2aa934e547c} - C:\Program Files (x86)\SerialTrunc\SerialTruncBHO.dll (file missing)
O2 - BHO: SerialTrunc - {e93a89a5-325d-4ef5-809d-819f657f498e} - C:\Program Files (x86)\SerialTrunc\SerialTruncBHO.dll (file missing)
O2 - BHO: AlxHelper - {F443A627-5009-4323-9C1D-7FD598D0D712} - C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll
O3 - Toolbar: Amazon Browser Bar - {EA582743-9076-4178-9AA6-7393FDF4D5CE} - C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Movies Toolbar (Dist. by MaxiGet Ltd.) - {a25ac361-002e-48e8-833b-e614322236b4} - C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~2\IE\searchresultsDx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll


O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [kuping] c:\kuping\kuping_v4.exe start
O4 - HKLM\..\Run: [stools tray] "C:\Program Files (x86)\STools\stools.exe" -tray
O4 - HKLM\..\Run: [ADSK DLMSession] C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
O4 - HKLM\..\Run: [wjplay2_News] "C:\Program Files (x86)\wjplay2\2014041612\WJFast.exe" -mini
O4 - HKLM\..\Run: [wjplay2] "C:\Program Files (x86)\wjplay2\2014041612\wjplay.exe" -mini
O4 - HKLM\..\Run: [kxesc] "c:\program files (x86)\kingsoft\kingsoft antiviruskxetray.exe" -autorun
O4 - HKCU\..\Run: [SugarSync] "C:\Program Files (x86)\SugarSync\SugarSyncManager.exe" -startInTray -usedelay=true
O4 - HKCU\..\Run: [GarenaPlus] "C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe" -autolaunch
O4 - HKCU\..\Run: [HKToolbarManager] "C:\Program Files (x86)\881903\IETOOLBAR\hkmgr.exe"
O4 - HKCU\..\Run: [riliquicken] "C:\Users\Charlie\AppData\Local\uCalendar\riliquicken.exe" -run
O4 - HKCU\..\Run: [91GameBox] C:\Program Files (x86)\91GameBox\91GameBox.exe -run
O4 - HKCU\..\Run: [91gbquicken] "C:\Program Files (x86)\91GameBox\91GameBox.exe" -run
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Charlie\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Charlie\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-967422786-3743307257-1201484489-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe

O8 - Extra context menu item: &妏蚚&捃泞烛盄狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥窒蝈诿 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java 主控台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O20 - AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll C:\PROGRA~3\Wincert\WIN32C~1.DLL C:\PROGRA~2\MOVIES~1\SAFETY~1\SAFETY~2.DLL
O23 - Service: SafetyNut Manager (SafetyNutManager) - SafetyNut Inc. - C:\Program Files (x86)\Movies Toolbar\SafetyNut\SafetyNutManager.exe
O23 - Service: SToolSrv - Beijing Skycenter Technology Limited - C:\Program Files (x86)\STools\MSrv.exe
O23 - Service: Update SerialTrunc - Unknown owner - C:\Program Files (x86)\SerialTrunc\updateSerialTrunc.exe
O23 - Service: Util SerialTrunc - Unknown owner - C:\Program Files (x86)\SerialTrunc\bin\utilSerialTrunc.exe

引用:
:files
C:\Program Files (x86)\Ask.com\Updater\Updater.exe
C:\Program Files (x86)\STools\stools.exe
C:\Program Files (x86)\wjplay2\2014041612\WJFast.exe
C:\Program Files (x86)\SugarSync\SugarSyncManager.exe
C:\Users\Charlie\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\SerialTrunc\bin\SerialTrunc.BrowserAdapter.exe
C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
C:\Program Files (x86)\Amazon Browser Bar\AmazonBrowserBar.3.0.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.8.71.dll
C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3192\npQQPhoneManagerExt.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\xunleiBHO7.2.10.3694.dll
C:\Program Files (x86)\Conduit\ValueApps\IE\ValueAppsLoader.dll
C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
c:\kuping\kuping_v4.exe
c:\program files (x86)\kingsoft\kingsoft antiviruskxetray.exe
C:\Users\Charlie\AppData\Local\uCalendar\riliquicken.exe
C:\Program Files (x86)\91GameBox\91GameBox.exe
C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
C:\PROGRA~3\Wincert\WIN32C~1.DLL
C:\PROGRA~2\MOVIES~1\SAFETY~1\SAFETY~2.DLL
C:\Program Files (x86)\STools\MSrv.exe
C:\Program Files (x86)\SerialTrunc\updateSerialTrunc.exe
C:\Program Files (x86)\SerialTrunc\bin\utilSerialTrunc.exe

hijackthis.log (15.19 KB)

2014-5-6 04:27 PM, 下载次数: 4

JRT.txt (10.7 KB)

2014-5-6 04:27 PM, 下载次数: 4

combofix.txt (40.37 KB)

2014-5-6 04:27 PM, 下载次数: 3

引用:原帖由 ga2006113259 於 2014-5-6 04:27 PM 发表
板主,我首页依然比hao123 驱劫左,D广告上都系有弹。以下为新的报告。唔该你。

OTL.Txt (165.97 KB)

2014-5-6 10:43 PM, 下载次数: 3

OTL Extras.Txt (129.68 KB)

2014-5-6 10:43 PM, 下载次数: 1

adwcleaner.txt (29.67 KB)

2014-5-6 10:43 PM, 下载次数: 2

mbam.txt (15.49 KB)

2014-5-6 10:43 PM, 下载次数: 2

引用:原帖由 ga2006113259 於 2014-5-6 10:43 PM 发表
板主我首页仲系咁但广告就冇了!!!

引用:
:OTL
IE - HKLM\..\SearchScopes\{46197f3d-30e7-4905-a14b-02bee3aaeb58}: "URL" = http://search.tb.ask.com/search/GGmain.jhtml?p2=^ZR^xpt372^YYA^hk&si=installldownload&ptb=8E851078-2837-4D33-AA2F-8B1A7B5C12AF&ind=2014050609&n=780bf931&psa=&st=sb&searchfor={searchTerms}
IE - HKCU\..\URLSearchHook: {0953a3a2-9223-4990-a1c9-efb4d4686ef2} - No CLSID value found
IE - HKCU\..\SearchScopes\{46197f3d-30e7-4905-a14b-02bee3aaeb58}: "URL" = http://search.tb.ask.com/search/GGmain.jhtml?p2=^ZR^xpt372^YYA^hk&si=installldownload&ptb=8E851078-2837-4D33-AA2F-8B1A7B5C12AF&ind=2014050609&n=780bf931&psa=&st=sb&searchfor={searchTerms}
IE - HKCU\..\SearchScopes\86DF66283EFE46B5BE3418954D2E6E58: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_enHK505
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
FF - prefs.js..browser.search.order.3: "Bing "
FF - prefs.js..browser.search.useDBForOrder: true
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdcntb: File not found
FF - HKLM\Software\MozillaPlugins\@kingsfot.com/npkws: c:\program files (x86)\kingsoft\kingsoft antivirus\npkws.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@popularscreensavers.com/Plugin: C:\Program Files (x86)\PopularScreensavers\NPp5Stub.dll File not found
FF - HKLM\Software\MozillaPlugins\@PopularScreensavers_7i.com/Plugin: C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\NP7iStub.dll (Mindspark)
FF - HKLM\Software\MozillaPlugins\@rising.com.cn/nprising: File not found
2012/10/08 15:16:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Extensions
[2014/05/06 21:55:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions
[2012/11/03 23:15:42 | 000,000,000 | ---D | M] (Thunder Extension) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions\{1B33E42F-EF14-4cd3-B6DC-174571C4349C}
[2013/11/14 22:14:24 | 000,000,000 | ---D | M] (New tab) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions\{C027AC3E-D886-5855-9BCA-C03C00A269D3}
[2014/05/05 15:04:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions\[email protected]
[2013/09/02 19:53:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profilesrjnbc1ld.default\extensions
[2013/09/02 19:53:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profilesrjnbc1ld.default\extensions\staged
[2014/05/05 15:04:18 | 000,058,031 | ---- | M] () (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions\[email protected]
[2013/06/22 21:58:38 | 000,027,275 | ---- | M] () (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions\[email protected]
[2014/05/05 15:04:18 | 000,092,003 | ---- | M] () (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions\[email protected]
[2014/05/05 15:04:18 | 000,094,195 | ---- | M] () (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions\[email protected]
[2014/05/05 15:04:18 | 000,038,812 | ---- | M] () (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions\[email protected]
[2014/05/05 15:04:18 | 000,011,470 | ---- | M] () (No name found) -- C:\Users\Charlie\AppData\Roaming\Mozilla\Firefox\Profiles\rjnbc1ld.default\extensions\[email protected]
[2014/05/05 20:42:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/05/05 20:41:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2014/05/05 20:41:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\[email protected]
[2014/05/05 20:41:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\myextensions
[2012/12/19 02:21:58 | 000,031,456 | ---- | M] (popularscreensavers.com) -- C:\Program Files (x86)\mozilla firefox\plugins\NPp5Stub.dll
CHR - plugin: Error reading preferences file
O2:64bit: - BHO: (捃泞狟婥盓厥) - {004B0726-A010-4ABF-8556-FCDB7F1FCA1E} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.2.10.3694.dll (深圳市迅雷网络技术有限公司)
O2:64bit: - BHO: (no name) - {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} - No CLSID value found.
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (Toolbar BHO) - {0709f2cc-d1e6-4b43-9efc-1c0701cb173d} - C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibar.dll (Mindspark)
O2 - BHO: (Search Assistant BHO) - {3a6625a2-591b-4e83-ac3f-8c25eea30ac0} - C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7iSrcAs.dll (Mindspark)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (PopularScreensavers) - {f339a07f-9578-412d-85e0-b8a80277151a} - C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibar.dll (Mindspark)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (PopularScreensavers) - {F339A07F-9578-412D-85E0-B8A80277151A} - C:\Program Files (x86)\PopularScreensavers_7i\bar\1.bin\7ibar.dll (Mindspark)
O4:64bit: - HKLM..\Run: [SynLenovoGestureMgr] C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe (Synaptics)
O4:64bit: - HKLM..\Run: [Sysdiag] "C:\Program Files (x86)\Huorong\Sysdiag\bin\HipsTray.exe" File not found
O4 - HKLM..\Run: [] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\osf - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.


:Files
C:\Users\Charlie\AppData\Local\IAC
C:\Users\Charlie\AppData\Local\PopularScreensavers_7i
C:\Program Files (x86)\PopularScreensavers_7i
C:\Windows\tasks\GoogleUpdateTaskMachineUA1cf4d72a1396b24.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\SysWow64\pub_store.dat


ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]

05072014_110444.log (57.24 KB)

2014-5-7 11:18 AM, 下载次数: 1

引用:原帖由 ga2006113259 於 2014-5-7 11:18 AM 发表
首页都系未得,BTW我个CHROME 首页都系咁。唔该板主

引用:原帖由 ga2006113259 於 2014-5-11 01:27 PM 发表
今次真系唔该晒板主!