当前位置：首页 → 问答吧 → chrome中左广告毒

chrome中左广告毒

时间：2014-05-31

来源：互联网

CHROME好似中左广告毒
之前都无乜为意
有阵开D网会DIRECT左去canadaaltax
今日又试过direct左去binarysystem4u

以下附上hijackthis log
唔该哂版主!!

hijackthis.log (22.69 KB)

[ 本帖最后由 MDYIP 於 2014-5-19 06:37 PM 编辑 ]

作者: MDYIP 发布时间: 2014-05-31

开机按F8,入安全模式做Fix checked & OTM 删除。
1. 执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。

引用:
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: 113.105.167.244 www.dangdang.com
O1 - Hosts: 113.105.167.244 dangdang.com
O1 - Hosts: 122.227.0.167 doshome.net
O1 - Hosts: 122.227.0.167 doshome.com
O2 - BHO: ShowHKToolbar Class - {06433BFE-4946-4E89-823D-CD359C81CD06} - C:\Program Files (x86)\881903\IETOOLBAR\hktbar.dll
O2 - BHO: MediaMonitor.XlMediaMonitorBhoObject - {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.1.29.dll
O2 - BHO: UTUbeeNoAods - {3BEC91C1-8762-F36D-D161-20079B99E13C} - C:\ProgramData\UTUbeeNoAods\If1.dll (file missing)
O2 - BHO: Hong Kong Toolbar - {481EE3EC-C026-4F9A-BA22-FD07654ADFC0} - C:\Program Files (x86)\881903\IETOOLBAR\hktbar.dll
O2 - BHO: CmjBrowserHelperObject Object - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - C:\Program Files (x86)\Mindjet\MindManager 11\Mm8InternetExplorer.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.1.8.2302.dll
O2 - BHO: A24A7204-5896-CE9E-123D-6B7F0883D13F Class - {A24A7204-5896-CE9E-123D-6B7F0883D13F} - C:\Program Files (x86)\QvodPlayer\AddIn\{A24A7204-5896-CE9E-123D-6B7F0883D13F}\QvodAddr.dll (file missing)
O2 - BHO: DownloadAssistant.XlDownloadAssistantBhoObject - {B0E2F470-0B07-48f0-B3B1-5749505FAE9B} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.1.29.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~2\IDM\QUICKF~1\PlugIns\IEHelp.dll
O3 - Toolbar: Hong Kong Toolbar - {481EE3EC-C026-4F9A-BA22-FD07654ADFC0} - C:\Program Files (x86)\881903\IETOOLBAR\hktbar.dll

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [YouCam Mirage] "c:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"
O4 - HKLM\..\Run: [YouCam Tray] "c:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe" /s
O4 - HKLM\..\Run: [HD Tune Pro] C:\Users\Ken\Desktop\HD_TUN~1.00\HDTUNE~1.EXE
O4 - HKLM\..\Run: [HKToolbarManager] "C:\Program Files (x86)\881903\IETOOLBAR\hkmgr.exe"
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files (x86)\Mindjet\MindManager 11\MMReminderService.exe
O4 - HKCU\..\Run: [HKToolbarManager] C:\Program Files (x86)\881903\IETOOLBAR\hkmgr.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKUS\S-1-5-21-576407467-2571458779-1255389361-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [HKToolbarManager] C:\Program Files (x86)\881903\IETOOLBAR\hkmgr.exe (User '?')
O4 - HKUS\S-1-5-21-576407467-2571458779-1255389361-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent (User '?')
O4 - S-1-5-21-576407467-2571458779-1255389361-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 Startup: Dropbox.lnk = C:\Users\Ken\AppData\Roaming\Dropbox\bin\Dropbox.exe (User '?')
O4 - S-1-5-21-576407467-2571458779-1255389361-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 Startup: KKBOX_Tray.lnk = C:\Program Files (x86)\KKBOX\KKBOX_Tray.exe (User '?')
O4 - Startup: Dropbox.lnk = C:\Users\Ken\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: KKBOX_Tray.lnk = C:\Program Files (x86)\KKBOX\KKBOX_Tray.exe
O4 - Global Startup: SolidWorks Background Downloader.lnk = ?

O8 - Extra context menu item: Send Image To Mindjet - res://C:\Program Files (x86)\Mindjet\MindManager 11\Mm8InternetExplorer.dll/201
O8 - Extra context menu item: Send Link To Mindjet - res://C:\Program Files (x86)\Mindjet\MindManager 11\Mm8InternetExplorer.dll/203
O8 - Extra context menu item: Send Page To Mindjet - res://C:\Program Files (x86)\Mindjet\MindManager 11\Mm8InternetExplorer.dll/204
O8 - Extra context menu item: Send Text To Mindjet - res://C:\Program Files (x86)\Mindjet\MindManager 11\Mm8InternetExplorer.dll/202
O8 - Extra context menu item: 使用迅雷下载 - C:\Users\Ken\Desktop\Thunder v5.9.21.1442\Thunder v5.9.21.1442\Program\geturl.htm
O8 - Extra context menu item: 使用迅雷下载全部连结 - C:\Users\Ken\Desktop\Thunder v5.9.21.1442\Thunder v5.9.21.1442\Program\getallurl.htm
O8 - Extra context menu item: 妏蚚捃泞狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: 妏蚚捃泞狟婥窒蝈诿 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\getAllurl.htm
O8 - Extra context menu item: 透过Mipony下载 - [url=file://C:\Program]file://C:\Program[/url] Files (x86)\MiPony\Browser\IEContext.htm
O9 - Extra button: Send to Mindjet - {2F72393D-2472-4F82-B600-ED77F354B7FF} - C:\Program Files (x86)\Mindjet\MindManager 11\Mm8InternetExplorer.dll
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll

2. 下载/执行 OTM做删除。
copy & paste 以下项目於Paste Instructions for Items to be Moved的框格内。
按MoveIt > OK > 重启电脑。

引用:
:files
C:\Program Files (x86)\881903\IETOOLBAR\hktbar.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.1.29.dll
C:\Program Files (x86)\Mindjet\MindManager 11\Mm8InternetExplorer.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.1.8.2302.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.1.29.dll
C:\PROGRA~2\IDM\QUICKF~1\PlugIns\IEHelp.dll
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
c:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
c:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe
C:\Users\Ken\Desktop\HD_TUN~1.00\HDTUNE~1.EXE
C:\Program Files (x86)\881903\IETOOLBAR\hkmgr.exe
C:\Program Files (x86)\Mindjet\MindManager 11\MMReminderService.exe
C:\Users\Ken\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\KKBOX\KKBOX_Tray.exe

3. 下载/执行Junkware Removal Tool扫毒。执行扫毒前请关闭所有浏览器同程式。
(JRT会自动删除附於浏览器的恶意程式/档案/登录档)

4. 关闭所有防毒软件(包括Windows Defender),下载ComboFix至桌面 ,执行 ComboFix 扫毒。
扫瞄时不要执行其他程式或点击 ComboFix视窗。
完成扫瞄后,ComboFix 报告会自动弹出。

5. 下载 OTL.exe於桌面。双按OTL.exe > 按Run Scan > 完成后请将OTL扫瞄报告(OTL.txt)贴上。
(OTL扫瞄需时较长,请耐心等候)

请贴上以下报告:
a. JRT扫毒报告。
b. ComboFix扫毒报告。
c. OTL.txt扫瞄报告。

作者: SILVESTERABEND 发布时间: 2014-05-31

头先开UWANTS黎登入弹左个POPUP...

作者: MDYIP 发布时间: 2014-05-31

头先开UWANTS黎登入弹左个POPUP...

JRT.txt (3.39 KB)

ComboFix.txt (42.9 KB)

OTL.Txt (124.69 KB)

作者: MDYIP 发布时间: 2014-05-31

1. 双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。

请将OTL fix log贴上。

引用:
:OTL
IE - HKLM\..\URLSearchHook: - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - prefs.js..extensions.enabledAddons: FirefoxAddon%40similarWeb.com:2.0.5
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.order.1,S: S", ""
FF - prefs.js..browser.search.defaultenginename,S: S", ""
FF - prefs.js..browser.search.selectedEngine,S: S", ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..keyword.URL: ""
FF - prefs.js..browser.startup.homepage: ""
FF - user.js - File not found
[2013/03/07 22:01:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ken\AppData\Roaming\mozilla\Extensions
[2014/05/18 13:12:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ken\AppData\Roaming\mozilla\Firefox\Profiles\puozhson.default\extensions
[2013/04/18 11:00:57 | 000,000,000 | ---D | M] (Hong Kong Toolbar(Version: 5.2.0.9)) -- C:\Users\Ken\AppData\Roaming\mozilla\Firefox\Profiles\puozhson.default\extensions\{93ed9dfe-1cdd-4b73-840b-22051ad9955b}
[2013/04/12 00:55:38 | 000,000,000 | ---D | M] ("SimilarWeb") -- C:\Users\Ken\AppData\Roaming\mozilla\Firefox\Profiles\puozhson.default\extensions\[email protected]
[2014/02/19 22:46:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2014/04/20 20:58:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
O2:64bit: - BHO: (UTUbeeNoAods) - {3BEC91C1-8762-F36D-D161-20079B99E13C} - C:\ProgramData\UTUbeeNoAods\If1.x64.dll File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {481EE3EC-C026-4F9A-BA22-FD07654ADFC0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Reg Error: Value error.)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 10.17.2)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 10.45.2)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 10.45.2)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
[2013/05/17 13:49:16 | 000,001,057 | ---- | M] ()(C:\Users\Ken\Desktop\百度影音??器.lnk) -- C:\Users\Ken\Desktop\百度影音浏览器.lnk
[2013/05/17 13:49:16 | 000,001,057 | ---- | C] ()(C:\Users\Ken\Desktop\百度影音??器.lnk) -- C:\Users\Ken\Desktop\百度影音浏览器.lnk
[2012/12/29 22:28:42 | 000,001,212 | ---- | M] ()(C:\Users\Public\Desktop\三??online桌面版.lnk) -- C:\Users\Public\Desktop\三国杀online桌面版.lnk
[2012/12/29 22:27:48 | 000,001,212 | ---- | C] ()(C:\Users\Public\Desktop\三??online桌面版.lnk) -- C:\Users\Public\Desktop\三国杀online桌面版.lnk
(C:\Users\Ken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\百度影音??器) -- C:\Users\Ken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\百度影音浏览器
(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度影音??器) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\百度影音浏览器

:Files
C:\Users\Ken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\笑傲江湖Online
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-576407467-2571458779-1255389361-1000UA.job
C:\windows\tasks\AliUpdater{4337450D-B2CE-4943-A2DA-87ECF59F05AA}.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-576407467-2571458779-1255389361-1000Core.job

ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]

2. 下载/执行 AdwCleaner (Xplode) 扫毒。(按Scan[Clean] 扫毒/删除)
(执行AdwCleaner关闭所有浏览器/程式)

请贴上以下报告:
a. AdwCleaner删毒报告。
b. 新1份OTL.txt扫瞄报告。

作者: SILVESTERABEND 发布时间: 2014-05-31

开POST之前用过ADWCLEANER清一次
所以呢份少野D
唔该哂版主!

AdwCleaner[S0].txt (1.08 KB)

OTL2.txt (28.12 KB)

作者: MDYIP 发布时间: 2014-05-31

开浏览器重有冇被re-direct?

作者: SILVESTERABEND 发布时间: 2014-05-31

呢层唔肯定
因为间中先会遇到
我会继续留意下！

作者: MDYIP 发布时间: 2014-05-31

观察多几日,浏览器有冇装AdBlock ?

作者: SILVESTERABEND 发布时间: 2014-05-31

本来有装
但应该扫毒果阵被DELETE哂
但我见到UTUBeeNoAds仲系度

作者: MDYIP 发布时间: 2014-05-31

引用:原帖由 MDYIP 於 2014-5-18 08:29 PM 发表
本来有装
但应该扫毒果阵被DELETE哂
但我见到UTUBeeNoAds仲系度

移除Chrome > 重启电脑 > 重新安装Chrome。
(重装Chrome暂时唔好用旧gmail注册)

作者: SILVESTERABEND 发布时间: 2014-05-31

已经无左UTUbeeNoAds!
唔该哂版主!

请问一下我系咪唔应该再装返adsblock果d?
因为果d extension似乎有毒咁样

作者: MDYIP 发布时间: 2014-05-31

引用:原帖由 MDYIP 於 2014-5-18 11:11 PM 发表
已经无左UTUbeeNoAds!
唔该哂版主!

请问一下我系咪唔应该再装返adsblock果d?
因为果d extension似乎有毒咁样

先装番AdBlock。
唔好装咁多无谓extensions,暂时较为可靠拦截程式都系AdBlock。

作者: SILVESTERABEND 发布时间: 2014-05-31

引用:原帖由 MDYIP 於 2014-5-18 11:11 PM 发表
已经无左UTUbeeNoAds!
唔该哂版主!

请问一下我系咪唔应该再装返adsblock果d?
因为果d extension似乎有毒咁样

You're welcome.

1. 如果浏览器首页回复正常,请跟#8帖移除Hijackthis/ComboFix等等的扫瞄软件。
http://computer.uwants.com/viewthread.php?tid=12999541&extra=page%3D1

2. 请用CCleaner Free删除temp files/登录档,用Windows预载defrag功能,做番1次磁碟重组(defrag)。

3. 请将[病毒移除]主题改为[已解决]。Tks.

作者: SILVESTERABEND 发布时间: 2014-05-31

chrome中左广告毒

热门阅读

热门下载