当前位置：首页 → 问答吧 → 求救 HAO123首页及自动安装软件

求救 HAO123首页及自动安装软件

时间：2014-01-25

来源：互联网

IE 同 GOOGLE CHROME个首页变左HAO123
每次开机都系咁
同埋自动安装大陆软件 E.G GG输入法大陆GAME...

hijackthis.log (19.08 KB)

2014-1-10 03:47 PM, 下载次数: 10

作者: victoryhihi1 发布时间: 2014-01-25

开机按F8,入安全模式做Fix checked & OTM 删除。
1. 执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。

引用:
O2 - BHO: VideoUrlSniffer - {00000ADA-7E0D-47C1-986C-F017D09C4304} - C:\Users\Public\Thunder Network\XMP4\Core\Program\VideoUrlSniffer.2.2.0.136.(602).dll
O2 - BHO: (no name) - {06433BFE-4946-4E89-823D-CD359C81CD06} - (no file)
O2 - BHO: XlBrowserAddinBho.XlBrowserAddinBhoObject - {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.8.71.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - (no file)
O2 - BHO: 39758562-0D4D-4346-D186-54569E1B9EAB Class - {39758562-0D4D-4346-D186-54569E1B9EAB} - C:\Program Files (x86)\QvodPlayer\AddIn\{39758562-0D4D-4346-D186-54569E1B9EAB}\QvodAddr.dll
O2 - BHO: TheBflix - {467A1F94-825C-42C4-AA45-6CE615EA1C33} - (no file)
O2 - BHO: (no name) - {481EE3EC-C026-4F9A-BA22-FD07654ADFC0} - (no file)
O2 - BHO: 瑞俴弝畦温挚狟婥郪璃 - {4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA} - C:\Users\NG\funshion\funshiontools\FunshionHelper.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.2.10.3694.dll
O2 - BHO: QvodExtend - {A8502600-B272-4F68-A67B-A0305D46D297} - C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.97.0\QvodExtend.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Bcool - {AF485367-81F6-4DDB-B2F3-3DF5DAA80327} - (no file)
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\NG\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
O2 - BHO: NavigateBHO - {CD79381A-F551-4E4E-9FE5-68105416C550} - C:\Users\NG\AppData\Roaming\baidu\BaiduPlayerBrowser\2.6.0.185_1\ProtectBHO.dll (file missing)
O2 - BHO: PPStream Video Acc Helper - {FB4F6285-4C32-49F2-950F-A5998F9CEC6C} - D:\PPS.tv\PPStream\plugins\IEHelper.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QvodTerminal] "C:\Program Files (x86)\QvodPlayer\QvodTerminal.exe" -autorun
O4 - HKLM\..\Run: [bdbtray] C:\Users\NG\AppData\Roaming\baidu\BaiduPlayerBrowser\2.6.0.185_1\player\bdbtray.exe /exp
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\PPSKernel.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\PPSKernel.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\PPSKernel.exe (User 'Default user')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

O8 - Extra context menu item: &妏蚚&捃泞烛盄狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥窒蝈诿 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm
O8 - Extra context menu item: 妏蚚办陬3狟婥 - C:\Users\NG\AppData\Roaming\FlashGetBHO\GetUrl.htm
O8 - Extra context menu item: 妏蚚办陬3狟婥绞弝 - C:\Users\NG\AppData\Roaming\FlashGetBHO\GetFlvUrl.htm
O8 - Extra context menu item: 妏蚚办陬3狟婥窒弝 - C:\Users\NG\AppData\Roaming\FlashGetBHO\GetAllFlvUrl.htm
O8 - Extra context menu item: 妏蚚办陬3狟婥窒蝈诿 - C:\Users\NG\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
O9 - Extra button: (no name) - {0000016b-c524-4050-81a0-243669a86b9f} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm
O9 - Extra 'Tools' menuitem: ??迅雷看看播放器 - {0000016b-c524-4050-81a0-243669a86b9f} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm
O9 - Extra button: 迅雷看看播放器 - {0000026b-c524-4050-81a0-243669a86b9f} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolBar.htm
O9 - Extra button: 返回主? - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - http://www.8687.cn (file missing)
O9 - Extra button: 迅雷看看 - {5D578929-E74E-46A2-A810-4F33D011DC52} - C:\Program Files (x86)\Common Files\Thunder Network\Kankan\XLStartKankan.exe
O9 - Extra button: 网址大全 - {6096E38F-5AC1-1200-8EC4-75DFA92FB32F} - http://wz.8687.cn (file missing)
O9 - Extra 'Tools' menuitem: 网址大全 - {6096E38F-5AC1-1200-8EC4-75DFA92FB32F} - http://wz.8687.cn (file missing)
O9 - Extra button: 百度一下，你就知道 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://s.8687.cn (file missing)
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe
O23 - Service: Guang Su Service (GSService) - Unknown owner - C:\Program Files (x86)\gssoft\gswb\2.7.1.3126\Config.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: IQIYI Video Platform Service (QiyiService) - BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.,LTD. - C:\Program Files (x86)\iQIYI\QiyiService.exe
O23 - Service: TunngleService - Tunngle.net GmbH - C:\Program Files (x86)\Tunngle\TnglCtrl.exe

2. 下载/执行 OTM做删除。
copy & paste 以下项目於Paste Instructions for Items to be Moved的框格内。
按MoveIt > OK > 重启电脑。

引用:
:files
C:\Program Files (x86)\QvodPlayer\QvodTerminal.exe
C:\Users\Public\Thunder Network\XMP4\Core\Program\VideoUrlSniffer.2.2.0.136.(602).dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.8.71.dll
C:\Program Files (x86)\QvodPlayer\AddIn\{39758562-0D4D-4346-D186-54569E1B9EAB}\QvodAddr.dll
C:\Users\NG\funshion\funshiontools\FunshionHelper.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.2.10.3694.dll
C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.97.0\QvodExtend.dll
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
C:\Users\NG\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
D:\PPS.tv\PPStream\plugins\IEHelper.dll
C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\QuickTime\QTTask.exe
C:\Users\NG\AppData\Roaming\baidu\BaiduPlayerBrowser\2.6.0.185_1\player\bdbtray.exe
D:\PPS.tv\PPStream\PPSKernel.exe

3. 下载/执行Junkware Removal Tool扫毒。执行扫毒前请关闭所有浏览器同程式。
(JRT会自动删除附於浏览器的恶意程式/档案/登录档)

4. 关闭所有防毒软件(包括Windows Defender),下载ComboFix至桌面 ,执行 ComboFix 扫毒。
扫瞄时不要执行其他程式或点击 ComboFix视窗。
完成扫瞄后,ComboFix 报告会自动弹出。

请贴上以下报告:
a. JRT扫毒报告。
b. ComboFix扫毒报告。
c. 新1份Hijackthis扫瞄报告。

作者: GoodestEngilsh 发布时间: 2014-01-25