怀疑chrome中广告毒(附HIJACKTHIS)

hijackthis.log (8.71 KB)

2014-5-15 11:54 PM, 下载次数: 3

引用:原帖由 makstan 於 2014-5-15 11:54 PM 发表
今日上天文台睇天气时
9675918

9675917

冇那那变左嗰广告

唔知系咪中左毒呢?

firefox同IE上都冇事

引用:
O2 - BHO: QQCycloneHelper - {00000000-12C9-4305-82F9-43058F20E8D2} - E:\Program Files\Tencent\QQDownload\QQIEHelper01.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Users\makstan\Desktop\BitComet?? 1.32\tools\bitcometbho.dll (file missing)
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - (no file)
O2 - BHO: QQMiniDLBHOHelper - {C9C7334B-5657-41e1-8F79-F6AACECA05F4} - C:\Program Files\Common Files\Tencent\QQMiniDL\43\Browser\QQIEHelper01.dll
O2 - BHO: AccountProtect - {DDD362CF-523B-4BC9-8FDC-58F93B6BC945} - C:\Users\makstan\AppData\Roaming\Tencent\QQ\QQAntiPhishing\AccountProtect.dll


O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [SafeInCloud] "C:\Program Files\Safe In Cloud\SafeInCloud.exe" /auto-start
O4 - HKCU\..\Run: [f.lux] "C:\Users\makstan\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
O4 - HKCU\..\Run: [BaiduYunGuanjia] "C:\Users\makstan\AppData\Roaming\baidu\BaiduYunGuanjia\BaiduYunGuanjia.exe" AutoRun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = makstan\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: 雄沧厒芩饪.lnk = makstan\AppData\Local\Tudou\FeisuTudou\TudouVa.exe
O4 - Global Startup: PlayStation(R)??e???lnk
O4 - Global Startup: SoftEther VPN Client ??H?鞜??釪.lnk

O8 - Extra context menu item: &?g?pBitComet?? - res://E:\Users\makstan\Desktop\BitComet?? 1.32\BitComet_86.exe/AddLink.htm
O8 - Extra context menu item: &?g?pBitComet???S??A? - res://E:\Users\makstan\Desktop\BitComet?? 1.32\BitComet_86.exe/AddAllLink.htm
O8 - Extra context menu item: ?g?p?纚?? - E:\QQDownload\geturl.htm
O8 - Extra context menu item: 妏蚚QQ狟婥翑忒狟婥 - C:\Program Files\Common Files\Tencent\QQMiniDL\43\Browser\xfgeturl.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Users\makstan\Desktop\BitComet?? 1.32\tools\bitcometbho.dll/206 (file missing)
O23 - Service: Kingsoft Core Service (kxescore) - Unknown owner - c:\program files\kingsoft\kingsoft antivirus\kxescore.exe (file missing)

引用:
:files
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Safe In Cloud\SafeInCloud.exe
C:\Users\makstan\AppData\Local\FluxSoftware\Flux\flux.exe
C:\Users\makstan\AppData\Roaming\baidu\BaiduYunGuanjia\BaiduYunGuanjia.exe
C:\Users\makstan\AppData\Roaming\Dropbox\bin\Dropbox.exe
E:\Program Files\Tencent\QQDownload\QQIEHelper01.dll
C:\Program Files\Common Files\Tencent\QQMiniDL\43\Browser\QQIEHelper01.dll
C:\Users\makstan\AppData\Roaming\Tencent\QQ\QQAntiPhishing\AccountProtect.dll
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

引用:原帖由 SILVESTERABEND 於 2014-5-16 10:29 AM 发表


楼主先去程式集移除Kingsoft antivirus。

引用:原帖由 makstan 於 2014-5-16 10:42 AM 发表
一年前左右已经移除左

引用:原帖由 SILVESTERABEND 於 2014-5-16 10:40 AM 发表
开机按F8,入安全模式做Fix checked & OTM 删除。
1. 执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。

2. 下载/执行 OTM做删除。
cop ...

JRT.txt (1.72 KB)

2014-5-16 11:54 AM, 下载次数: 2

ComboFix.txt (23.83 KB)

2014-5-16 11:54 AM, 下载次数: 2

OTL.Txt (78.02 KB)

2014-5-16 11:54 AM, 下载次数: 3

引用:
:OTL
SRV - File not found [Auto | Stopped] -- c:\program files\kingsoft\kingsoft antivirus\kxescore.exe /service kxescore -- (kxescore)
DRV - File not found [Kernel | Auto | Stopped] -- C:\Windows\system32\drivers\kisknl.sys -- (kisknl)
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = E:\DOWNLOADS\IEDownload
IE - HKCU\..\SearchScopes,DefaultScope = {C555C1AA-AE4A-4e1e-9BCB-F3DE555441FD}
IE - HKCU\..\SearchScopes\{C555C1AA-AE4A-4e1e-9BCB-F3DE555441FD}: "URL" = http://www.google.com.hk/search?q={searchTerms}&src=IE-SearchBox
FF - prefs.js..network.proxy.autoconfig_url: "[url=file:///E:/nico/proxy.pac]file:///E:/nico/proxy.pac[/url]"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@115.com/CheckPluginEx: C:\Program Files\115\115com\np_115download_plugin.dll (115.COM Inc.)
[2013/08/21 18:28:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Extensions
[2014/05/12 12:16:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions
[2014/05/12 12:16:50 | 000,058,031 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\[email protected]
[2014/05/12 12:16:50 | 000,028,596 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\[email protected]
[2014/05/12 12:16:50 | 000,092,003 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\[email protected]
[2014/03/12 09:54:21 | 000,303,362 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\[email protected]
[2013/08/21 18:28:41 | 000,111,371 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\[email protected]
[2014/05/11 11:48:12 | 000,038,812 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\[email protected]
[2013/08/21 18:28:41 | 000,011,470 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\[email protected]
[2014/04/04 12:59:41 | 000,417,899 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\[email protected]
[2014/05/03 23:36:30 | 000,029,013 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\[email protected]
[2014/05/05 11:51:25 | 000,293,729 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
[2013/10/04 16:29:19 | 000,316,800 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}.xpi
[2014/05/01 19:57:21 | 000,957,880 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014/03/30 01:07:25 | 000,287,566 | ---- | M] () (No name found) -- C:\Users\makstan\AppData\Roaming\Mozilla\Firefox\Profiles\9aojl9cx.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2014/05/11 11:47:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014/05/11 11:47:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\distribution\extensions
[2014/05/11 11:47:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\distribution\extensions\[email protected]
[2014/05/11 11:47:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\distribution\myextensions
CHR - Extension: Google \u7535\u5B50\u94B1\u5305 = C:\Users\makstan\AppData\Local\115ComChrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O4 - HKLM..\Run: [SoftEther VPN Client UI Helper] C:\Program Files\SoftEther VPN Client\vpnclient.exe (SoftEther VPN Project at University of Tsukuba, Japan.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: 妏蚚唅瑞狟婥 - E:\QQDownload\geturl.htm File not found
O8 - Extra context menu item: 使用旋风下载(&X) - E:\Program Files\Tencent\QQDownload\xfgeturl.htm ()
O8 - Extra context menu item: 使用旋风下载全部链接(&Q) - E:\Program Files\Tencent\QQDownload\xfgetAllurl.htm ()
O8 - Extra context menu item: 使用旋风极速下载(会员特&#26435(&J) - E:\Program Files\Tencent\QQDownload\xftopspeed.htm ()
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
(C:\Users\makstan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\???件) -- C:\Users\makstan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\115网?) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\115网盘
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\???件) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯软件

:Files
C:\Users\makstan\AppData\Roaming\DropboxMaster
C:\Users\makstan\AppData\Roaming\SMILE
C:\Users\makstan\AppData\Roaming\kingsoft
C:\Users\makstan\AppData\Roaming\happies
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Happies
C:\Users\makstan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\脳内彼女
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\脳内彼女
C:\Users\makstan\AppData\Roaming\Youtube Downloader HD
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\yatagarasu
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\system32\drivers\kisknl.sys
c:\program files\kingsoft\kingsoft antivirus\kxescore.exe

ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]

引用:原帖由 SILVESTERABEND 於 2014-5-16 09:56 PM 发表
1. 双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。 ...

AdwCleaner[S0].txt (2.06 KB)

2014-5-16 11:03 PM, 下载次数: 2

mbam-log-2014-05-16.txt (1.57 KB)

2014-5-16 11:03 PM, 下载次数: 3

05162014_220853.log (37.58 KB)

2014-5-16 11:03 PM, 下载次数: 2

OTL fix log

OTL2.Txt (76.75 KB)

2014-5-16 11:03 PM, 下载次数: 2

引用:原帖由 SILVESTERABEND 於 2014-5-17 08:28 AM 发表
去程式集移除Chrome / Firefox (不要保留旧设定) > 重启电脑 > 重新安装Chrome/Firefox。
(暂时唔好用旧gmail注册Chrome)

引用:原帖由 makstan 於 2014-5-17 11:25 AM 发表
而家用另一个gmail入Chrome冇再变广告啦唔该晒版主