中左广告毒
时间：2014-06-04
来源：互联网
中左广告毒
hijackthis.log (13.32 KB)
hijackthis.log (13.32 KB)
2014-5-23 09:47 PM, 下载次数: 6
作者: vita3752001 发布时间: 2014-06-04
开机按F8,入安全模式做Fix checked & OTM 删除。
1. 执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。
copy & paste 以下项目於Paste Instructions for Items to be Moved的框格内。
按MoveIt > OK > 重启电脑。
(JRT会自动删除附於浏览器的恶意程式/档案/登录档)
4. 关闭所有防毒软件(包括Windows Defender),下载ComboFix至桌面 ,执行 ComboFix 扫毒。
扫瞄时不要执行其他程式或点击 ComboFix视窗。
完成扫瞄后,ComboFix 报告会自动弹出。
5. 下载 OTL.exe於桌面。双按OTL.exe > 按Run Scan > 完成后请将OTL扫瞄报告(OTL.txt)贴上。
(OTL扫瞄需时较长,请耐心等候)
请贴上以下报告:
a. JRT扫毒报告。
b. ComboFix扫毒报告。
c. OTL.txt扫瞄报告。
1. 执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。
引用:
O2 - BHO: 26EAB8AD-2428-C69A-7BE3-ED8B0747A40C Class - {26EAB8AD-2428-C69A-7BE3-ED8B0747A40C} - C:\Program Files\QvodPlayer\AddIn\{26EAB8AD-2428-C69A-7BE3-ED8B0747A40C}\QvodAddr.dll
O2 - BHO: ·cDDEOAμ2￥·A?°IAOO×e?t - {4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA} - C:\Documents and Settings\Administrator\funshion\funshiontools\FunshionHelper.dll
O2 - BHO: QvodExtend - {A8502600-B272-4F68-A67B-A0305D46D297} - C:\Program Files\QvodPlayer\QvodExtend\5.0.97.0\QvodExtend.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QvodTerminal] "C:\Program Files\QvodPlayer\QvodTerminal.exe" -autorun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKLM\..\Run: [Search Protection] C:\Documents and Settings\All Users\Application Data\Search Protection\SearchProtection.exe
O4 - HKLM\..\Run: [AdAwareTray] "C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe"
O4 - HKLM\..\RunOnce: [NCInstallQueue] rundll32 netman.dll,ProcessQueue
O4 - HKCU\..\Run: [uTorrent] "C:\Documents and Settings\Administrator\Application Data\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\system32\Oobe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,DelNodeRunDLL32 "%SystemRoot%\System32\dllcache" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_08] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_09] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_10] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\system32\Oobe" (User 'NETWORK SERVICE')
O8 - Extra context menu item: &使用BitComet下载 - res://C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX41.140\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &使用BitComet下载全部连结 - res://C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX41.140\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: &使用迅雷离线下载 - C:\Program Files\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: Foxy 下载 - res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.984\Foxy2015\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜寻 - res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.984\Foxy2015\Foxy.exe/search.htm
O8 - Extra context menu item: Getchaman 搜索 - res://C:\Program Files\Getchaman 2\Getchaman.exe/search.htm
O8 - Extra context menu item: 下载 - res://C:\Program Files\Honey\kupeer\9kupe.exe/download.htm
O8 - Extra context menu item: 搜寻 - res://C:\Program Files\Honey\kupeer\9kupe.exe/search.htm
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPTV\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPTV\PPLive.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX01.062\tools\bitcometbho.dll/206 (file missing)
O20 - AppInit_DLLs: C:\DOCUME~1\ALLUSE~1\APPLIC~1\Wincert\WIN32C~1.DLL C:\PROGRA~1\MOVIES~1\Datamngr\mgrldr.dll
O23 - Service: Datamngr Coordinator (DatamngrCoordinator2) - Unknown owner - C:\Program Files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe (file missing)
2. 下载/执行 OTM做删除。O2 - BHO: 26EAB8AD-2428-C69A-7BE3-ED8B0747A40C Class - {26EAB8AD-2428-C69A-7BE3-ED8B0747A40C} - C:\Program Files\QvodPlayer\AddIn\{26EAB8AD-2428-C69A-7BE3-ED8B0747A40C}\QvodAddr.dll
O2 - BHO: ·cDDEOAμ2￥·A?°IAOO×e?t - {4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA} - C:\Documents and Settings\Administrator\funshion\funshiontools\FunshionHelper.dll
O2 - BHO: QvodExtend - {A8502600-B272-4F68-A67B-A0305D46D297} - C:\Program Files\QvodPlayer\QvodExtend\5.0.97.0\QvodExtend.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QvodTerminal] "C:\Program Files\QvodPlayer\QvodTerminal.exe" -autorun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKLM\..\Run: [Search Protection] C:\Documents and Settings\All Users\Application Data\Search Protection\SearchProtection.exe
O4 - HKLM\..\Run: [AdAwareTray] "C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe"
O4 - HKLM\..\RunOnce: [NCInstallQueue] rundll32 netman.dll,ProcessQueue
O4 - HKCU\..\Run: [uTorrent] "C:\Documents and Settings\Administrator\Application Data\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\system32\Oobe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,DelNodeRunDLL32 "%SystemRoot%\System32\dllcache" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_08] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_09] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_10] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\system32\Oobe" (User 'NETWORK SERVICE')
O8 - Extra context menu item: &使用BitComet下载 - res://C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX41.140\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &使用BitComet下载全部连结 - res://C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX41.140\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: &使用迅雷离线下载 - C:\Program Files\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: Foxy 下载 - res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.984\Foxy2015\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜寻 - res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.984\Foxy2015\Foxy.exe/search.htm
O8 - Extra context menu item: Getchaman 搜索 - res://C:\Program Files\Getchaman 2\Getchaman.exe/search.htm
O8 - Extra context menu item: 下载 - res://C:\Program Files\Honey\kupeer\9kupe.exe/download.htm
O8 - Extra context menu item: 搜寻 - res://C:\Program Files\Honey\kupeer\9kupe.exe/search.htm
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPTV\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files\PPLive\PPTV\PPLive.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX01.062\tools\bitcometbho.dll/206 (file missing)
O20 - AppInit_DLLs: C:\DOCUME~1\ALLUSE~1\APPLIC~1\Wincert\WIN32C~1.DLL C:\PROGRA~1\MOVIES~1\Datamngr\mgrldr.dll
O23 - Service: Datamngr Coordinator (DatamngrCoordinator2) - Unknown owner - C:\Program Files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe (file missing)
copy & paste 以下项目於Paste Instructions for Items to be Moved的框格内。
按MoveIt > OK > 重启电脑。
引用:
:files
C:\Program Files\Common Files\Baidu\BaiduProtect\1.2.11.49\BaiduProtect.exe
C:\Program Files\QvodPlayer\QvodTerminal.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QvodPlayer\AddIn\{26EAB8AD-2428-C69A-7BE3-ED8B0747A40C}\QvodAddr.dll
C:\Documents and Settings\Administrator\funshion\funshiontools\FunshionHelper.dll
C:\Program Files\QvodPlayer\QvodExtend\5.0.97.0\QvodExtend.dll
C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Documents and Settings\All Users\Application Data\Search Protection\SearchProtection.exe
C:\Documents and Settings\Administrator\Application Data\uTorrent\uTorrent.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Wincert\WIN32C~1.DLL
C:\PROGRA~1\MOVIES~1\Datamngr\mgrldr.dll
3. 下载/执行Junkware Removal Tool扫毒。执行扫毒前请关闭所有浏览器同程式。:files
C:\Program Files\Common Files\Baidu\BaiduProtect\1.2.11.49\BaiduProtect.exe
C:\Program Files\QvodPlayer\QvodTerminal.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QvodPlayer\AddIn\{26EAB8AD-2428-C69A-7BE3-ED8B0747A40C}\QvodAddr.dll
C:\Documents and Settings\Administrator\funshion\funshiontools\FunshionHelper.dll
C:\Program Files\QvodPlayer\QvodExtend\5.0.97.0\QvodExtend.dll
C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Documents and Settings\All Users\Application Data\Search Protection\SearchProtection.exe
C:\Documents and Settings\Administrator\Application Data\uTorrent\uTorrent.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Wincert\WIN32C~1.DLL
C:\PROGRA~1\MOVIES~1\Datamngr\mgrldr.dll
(JRT会自动删除附於浏览器的恶意程式/档案/登录档)
4. 关闭所有防毒软件(包括Windows Defender),下载ComboFix至桌面 ,执行 ComboFix 扫毒。
扫瞄时不要执行其他程式或点击 ComboFix视窗。
完成扫瞄后,ComboFix 报告会自动弹出。
5. 下载 OTL.exe於桌面。双按OTL.exe > 按Run Scan > 完成后请将OTL扫瞄报告(OTL.txt)贴上。
(OTL扫瞄需时较长,请耐心等候)
请贴上以下报告:
a. JRT扫毒报告。
b. ComboFix扫毒报告。
c. OTL.txt扫瞄报告。
作者: SILVESTERABEND 发布时间: 2014-06-05
combofix果个唔知点解去到尾会自己reset部机,但系就冇报告,
JRT.txt (654 Bytes)
2014-5-25 11:26 PM, 下载次数: 4
OTL.Txt (89.85 KB)
2014-5-25 11:26 PM, 下载次数: 6
作者: vita3752001 发布时间: 2014-06-05
1. 双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。
请将OTL fix log贴上。
(执行AdwCleaner关闭所有浏览器/程式)
3. 下载/安装Malwarebytes Anti-Malware Free 扫毒。更新后做Threat Scan,扫到毒按Select all > 再按Remove Selected做删除。
请贴上以下报告:
a. AdwCleaner删毒报告。
b. MBAM扫毒报告。
c. 新1份OTL.txt扫瞄报告。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。
请将OTL fix log贴上。
引用:
:OTL
PRC - [2014/05/02 02:03:08 | 000,173,070 | ---- | M] () -- C:\Program Files\PCDApp\dgen.exe
PRC - [2014/01/02 11:22:48 | 006,801,408 | ---- | M] () -- C:\Program Files\PCDApp\cudaminer.exe
SRV - File not found [Auto | Stopped] -- C:\Program Files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe -- (DatamngrCoordinator2)
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ASUM_zh-TWHK569
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
File not found (No name found) -- C:\PROGRAM FILES\AMIEXT\FLASHENHANCER\FF
File not found (No name found) -- C:\PROGRAM FILES\MEDIABUZZV1\MEDIABUZZV1MODE4071\FF
CHR - plugin: Error reading preferences file
O2 - BHO: (茼蚚惘珨莹假蚾唇璃) - {50F4150A-48B2-417A-BE4C-C83F580FB904} - C:\Program Files\Common Files\Tencent\QQPhoneManager\2.0.201.3196\npQQPhoneManagerExt.dll (腾讯公司)
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Getchaman 下载 - res://C:\Program Files\Getchaman 2\Getchaman.exe/download.htm File not found
O8 - Extra context menu item: 使用快播按图找片 - C:\Program Files\QvodPlayer\AddIn\ImgSeed.htm ()
:Files
C:\Program Files\Supporter
C:\WINDOWS\tasks\Microsoft Windows XP 终止服务通知登入.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
ipconfig /flushdns /c
:Commands
[PURITY]
[EMPTYTEMP]
[reboot]
2. 下载/执行 AdwCleaner (Xplode) 扫毒。(先按Scan后按Clean 扫毒/删除):OTL
PRC - [2014/05/02 02:03:08 | 000,173,070 | ---- | M] () -- C:\Program Files\PCDApp\dgen.exe
PRC - [2014/01/02 11:22:48 | 006,801,408 | ---- | M] () -- C:\Program Files\PCDApp\cudaminer.exe
SRV - File not found [Auto | Stopped] -- C:\Program Files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe -- (DatamngrCoordinator2)
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ASUM_zh-TWHK569
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
File not found (No name found) -- C:\PROGRAM FILES\AMIEXT\FLASHENHANCER\FF
File not found (No name found) -- C:\PROGRAM FILES\MEDIABUZZV1\MEDIABUZZV1MODE4071\FF
CHR - plugin: Error reading preferences file
O2 - BHO: (茼蚚惘珨莹假蚾唇璃) - {50F4150A-48B2-417A-BE4C-C83F580FB904} - C:\Program Files\Common Files\Tencent\QQPhoneManager\2.0.201.3196\npQQPhoneManagerExt.dll (腾讯公司)
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Getchaman 下载 - res://C:\Program Files\Getchaman 2\Getchaman.exe/download.htm File not found
O8 - Extra context menu item: 使用快播按图找片 - C:\Program Files\QvodPlayer\AddIn\ImgSeed.htm ()
:Files
C:\Program Files\Supporter
C:\WINDOWS\tasks\Microsoft Windows XP 终止服务通知登入.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
ipconfig /flushdns /c
:Commands
[PURITY]
[EMPTYTEMP]
[reboot]
(执行AdwCleaner关闭所有浏览器/程式)
3. 下载/安装Malwarebytes Anti-Malware Free 扫毒。更新后做Threat Scan,扫到毒按Select all > 再按Remove Selected做删除。
请贴上以下报告:
a. AdwCleaner删毒报告。
b. MBAM扫毒报告。
c. 新1份OTL.txt扫瞄报告。
作者: SILVESTERABEND 发布时间: 2014-06-05
AdwCleaner[S0].txt (7.93 KB)
2014-5-27 01:50 AM, 下载次数: 4
OTL.Txt (89.85 KB)
2014-5-27 01:50 AM, 下载次数: 4
Report 2014-05-16 00.24.12.txt (66.59 KB)
2014-5-27 01:50 AM, 下载次数: 3
作者: vita3752001 发布时间: 2014-06-05
引用:原帖由 vita3752001 於 2014-5-27 01:50 AM 发表
1. 如果系统运作回复正常,请跟#8帖移除Hijackthis/ComboFix等等的扫瞄软件。
http://computer.uwants.com/viewthread.php?tid=12999541&extra=page%3D1
2. 请用CCleaner Free删除temp files/登录档,用Windows预载defrag功能,做番1次磁碟重组(defrag)。
3. 请将[病毒移除]主题改为[已解决]。Tks.
作者: SILVESTERABEND 发布时间: 2014-06-05
相关阅读 更多
热门阅读
-
office 2019专业增强版最新2021版激活秘钥/序列号/激活码推荐 附激活工具
阅读：74
-
如何安装mysql8.0
阅读：31
-
Word快速设置标题样式步骤详解
阅读：28
-
20+道必知必会的Vue面试题（附答案解析）
阅读：37
-
HTML如何制作表单
阅读：22
-
百词斩可以改天数吗？当然可以，4个步骤轻松修改天数！
阅读：31
-
ET文件格式和XLS格式文件之间如何转化？
阅读：24
-
react和vue的区别及优缺点是什么
阅读：121
-
支付宝人脸识别如何关闭?
阅读：21
-
腾讯微云怎么修改照片或视频备份路径?
阅读：28
