中左特洛伊木马病毒,删极都仲有(已解决)

引用:原帖由 today2025 於 2014-4-7 09:52 PM 发表
中左特洛伊木马病毒,删极都仲有,
有咩方法整走佢 唔该

引用:原帖由 SILVESTERABEND 於 2014-4-8 09:47 AM 发表


下载 Hijackthis至桌面 > 按 Install > 按[ Accept] > 按 [Do a system scan and save a logfile ] > 完成扫瞄系统，hijackthis会弹出报告。

储存该扫瞄报告於桌面。请把Hijackthis 扫瞄报告贴上。

hijackthis.log (9.65 KB)

2014-4-8 06:10 PM, 下载次数: 8

引用:原帖由 j32738 於 2014-4-8 05:32 PM 发表
楼主有无用防毒软件ga~?

引用:原帖由 today2025 於 2014-4-8 06:14 PM 发表

有用呀 check到有毒,移左好多次都仲系度

引用:原帖由 KRally 於 2014-4-8 06:30 PM 发表


路过................
ching用边个防毒软件侦测到特洛伊木马病毒?
有冇图?

引用:原帖由 today2025 於 2014-4-8 07:13 PM 发表
我两个都有

引用:原帖由 today2025 於 2014-4-8 06:10 PM 发表

唔该c兄帮我睇睇

引用:
O2 - BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll
O2 - BHO: SohuBHO - {452ADB5B-00BE-469D-A65F-3046146B2ED5} - C:\Program Files\搜狐影音\SoHuAutoDetector.dll (file missing)
O2 - BHO: BrowserHelper - {4BF2CB0E-658A-442B-AC83-A64EC2150BFC} - C:\Documents and Settings\All Users\Application Data\PPBrowserHelper\BHO\TipsBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~1\IObit\SURFIN~1\BROWER~1\ASCPLU~1.DLL
O3 - Toolbar: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
O4 - HKCU\..\Run: [Advanced SystemCare Ultimate] "C:\Program Files\IObit\Advanced SystemCare Ultimate\ASCTray.exe" /Auto
O8 - Extra context menu item: &使用BitComet下载 - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &使用BitComet下载全部连结 - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Foxy 下载 - res://F:\foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜寻 - res://F:\foxy\Foxy.exe/search.htm
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPTV\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPTV\PPLive.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll/206 (file missing)
O18 - Protocol: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~1\KUGOU2~1\KUGOO3~1.OCX
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~1\KUGOU2~1\KUGOO3~1.OCX
O23 - Service: WinZiper service (winzipersvc) - Taiwan Shui Mu Chih Ching Technology Limited. - C:\Program Files\WinZipper\winzipersvc.exe

引用:
:files
C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll
C:\Documents and Settings\All Users\Application Data\PPBrowserHelper\BHO\TipsBHO.dll
C:\PROGRA~1\IObit\SURFIN~1\BROWER~1\ASCPLU~1.DLL
C:\Program Files\WinZipper\winzipersvc.exe

引用:原帖由 SILVESTERABEND 於 2014-4-8 08:45 PM 发表
开机按F8,入安全模式做Fix checked & OTM 删除。
1. 执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。

2. 下载/执行 OTM做删除。
cop ...

hijackthis.log (4.54 KB)

2014-4-8 10:16 PM, 下载次数: 4

JRT.txt (3.85 KB)

2014-4-8 10:16 PM, 下载次数: 5

引用:原帖由 today2025 於 2014-4-8 10:16 PM 发表

comboFix check完自动重新开机 无弹报告 试左两次都系甘

引用:原帖由 SILVESTERABEND 於 2014-4-9 09:56 AM 发表
1. 下载/执行 AdwCleaner (Xplode) 扫毒。(按[Clean] 扫毒/删除)
(执行AdwCleaner关闭所有浏览器/程式)

2. 下载/安装Malwarebytes Anti-Malware Free 扫毒。更新后做Threat Scan,扫到毒按Select all > 再按Remov ...

AdwCleaner[S0].txt (6.27 KB)

2014-4-9 08:45 PM, 下载次数: 2

MBAM txt.txt (1.29 KB)

2014-4-9 08:45 PM, 下载次数: 2

OTL.Txt (117.56 KB)

2014-4-9 08:45 PM, 下载次数: 2

引用:原帖由 SILVESTERABEND 於 2014-4-9 09:49 AM 发表


ComboFix扫瞄报告储存於C:\ComboFix.txt 。

引用:原帖由 today2025 於 2014-4-9 08:49 PM 发表

C:搵唔到ComboFix.txt

引用:
:OTL
PRC - [2013/12/30 15:28:00 | 000,214,368 | ---- | M] (PPLive Corporation) -- C:\Program Files\Common Files\PPLiveNetwork\PPAP.exe
PRC - [2013/09/07 01:30:16 | 000,273,296 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://hao.360.cn/?1004
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\..\SearchScopes\{05046B93-CC41-4CF5-84CF-3AC3004B22A7}: "URL" = http://www.google.cn/cse?cx=partner-pub-0166105436203332:pzdukf-nfb1&cr=&ie=UTF-8&hl=zh-CN&sa=%E6%90%9C%E5%B0%8B&q={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\Baidu: "URL" = http://www.baidu.com/s?tn=yokcom_pg&ie=UTF-8&wd={searchTerms}&cl=3
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: ascsurfingprotection%40iobit.com:1.0
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
[2010/12/16 21:39:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2014/04/03 22:56:20 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\g8yl64nd.default\extensions
CHR - default_search_provider: qvo6 (Enabled)
CHR - plugin: 360MMPlugin (Enabled) = C:\Program Files\360\360Safe\MobileMgr\np360MMPlugIn.dll
CHR - Extension: No name found = C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd\1.0.0_0\
O4 - HKCU..\Run: [PPAP] C:\Program Files\Common Files\PPLiveNetwork\PPAP.EXE (PPLive Corporation)
O4 - Startup: C:\Documents and Settings\All Users\「开始」功能表\程式集\启动\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe (McAfee, Inc.)
O8 - Extra context menu item: 收藏到搜狐影音 - Reg Error: Value error. File not found
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 61.10.1.146 203.168.223.202
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D5C79B2-B1B6-4A7E-8715-D002425C7E18}: DhcpNameServer = 61.10.1.146 203.168.223.202
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]


:Files
C:\WINDOWS\tasks\ImCleanDisabled
C:\Documents and Settings\Administrator\Application Data\360SuperKiller


ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYJAVA]
[EMPTYTEMP]
[reboot]

引用:原帖由 SILVESTERABEND 於 2014-4-9 09:32 PM 发表
双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。

...

04082014_215625.log (15.52 KB)

2014-4-9 10:02 PM, 下载次数: 3

引用:原帖由 today2025 於 2014-4-10 07:40 PM 发表
暂时无喇,上纲都快左d 唔该晒主版