请帮帮忙中左广告毒 用几个防毒都扫唔走

hijackthis.log (13.44 KB)

2014-2-27 04:04 AM, 下载次数: 10

引用:
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: 375332C6-0AA8-02AC-3FC8-2D92EBADF43A Class - {375332C6-0AA8-02AC-3FC8-2D92EBADF43A} - D:\QvodPlayer\AddIn\{375332C6-0AA8-02AC-3FC8-2D92EBADF43A}\QvodAddr.dll (file missing)
O2 - BHO: 砩杬BHO - {876D0712-C780-4347-B56D-C30C520033C5} - C:\Program Files (x86)\ShoppingAssistant\ruyitao\3.4.2.8\ShoppingAssistant.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Users\User\Desktop\MiniThunder\BHO\XunleiBHO7.2.7.3498.dll (file missing)
O2 - BHO: KMP Media Toolbar - {daf5b34c-1aa3-4c33-ae24-766a370635d2} - C:\Program Files (x86)\kmpmediatoolbar\searchresultsDx.dll
O2 - BHO: iToolsBHO - {E1499FE7-129D-4B6E-B681-DDF21E14172C} - C:\Users\User\Documents\iTools\Plugin\iToolsBHO.dll
O3 - Toolbar: Astroburn Toolbar - {EFEED92A-A33D-4873-BA8F-32BAA631E54D} - C:\Program Files (x86)\Astroburn Toolbar\ABToolbar.dll (file missing)
O3 - Toolbar: KMP Media Toolbar - {daf5b34c-1aa3-4c33-ae24-766a370635d2} - C:\Program Files (x86)\kmpmediatoolbar\searchresultsDx.dll


O4 - HKCU\..\Run: [GarenaPlus] "C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe" -autolaunch
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [BaiduYunGuanjia] "D:\Baidu\BaiduYunGuanjia\BaiduYunGuanjia.exe" AutoRun
O4 - HKUS\S-1-5-18\..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\PPSAP.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\PPSAP.exe (User 'Default user')
O4 - Startup: KKBOX_Tray.lnk = C:\Program Files (x86)\KKBOX\KKBOX_Tray.exe


O8 - Extra context menu item: Foxy 下载 - res://G:\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜寻 - res://G:\Foxy.exe/search.htm
O8 - Extra context menu item: 添加为阿里旺旺表情 - D:\AliWangWang\7.21.02C\AddNewEmotion.htm
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPTV\PPLive.exe
O9 - Extra button: 砩杬 - {A5A1BF2A-36DA-4241-B8A9-D1C51CA06FF5} - C:\Program Files (x86)\ShoppingAssistant\ruyitao\3.4.2.8\ShoppingAssistant.dll

引用:
:files
D:\Baidu\BaiduYunGuanjia\BaiduYunGuanjia.exe
C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
C:\Program Files (x86)\ShoppingAssistant\ruyitao\3.4.2.8\ShoppingAssistant.dll
C:\Program Files (x86)\kmpmediatoolbar\searchresultsDx.dll
C:\Users\User\Documents\iTools\Plugin\iToolsBHO.dll
D:\PPS.tv\PPStream\PPSAP.exe
C:\Program Files (x86)\KKBOX\KKBOX_Tray.exe

引用:原帖由 SILVESTERABEND 於 2014-2-27 10:41 AM 发表
开机按F8,入安全模式做Fix checked & OTM 删除。
1.执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。

2. 下载/执行 OTM做删除。
copy ...

OTM02272014_142009.log (1.46 KB)

2014-2-27 03:16 PM, 下载次数: 3

JRT.txt (3.5 KB)

2014-2-27 03:16 PM, 下载次数: 7

ComboFix.txt (28.14 KB)

2014-2-27 03:16 PM, 下载次数: 5

OTL.Txt (118.29 KB)

2014-2-27 03:16 PM, 下载次数: 3

引用:原帖由 SILVESTERABEND 於 2014-2-27 08:05 PM 发表
1. 下载/执行 AdwCleaner (Xplode) 扫毒。(按[Clean] 扫毒/删除)
(执行AdwCleaner关闭所有浏览器/程式)

2. 下载/安装Malwarebytes Anti-Malware Free 扫毒。更新后做全面扫瞄,扫到毒按Select all > 再按Remove S ...

AdwCleaner[R0].txt (860 Bytes)

2014-2-28 01:54 AM, 下载次数: 4

AdwCleaner[S0].txt (924 Bytes)

2014-2-28 01:54 AM, 下载次数: 2

mbam-log-2014-02-27 (22-38-08).txt (4.73 KB)

2014-2-28 01:54 AM, 下载次数: 3

OTL.Txt (121.54 KB)

2014-2-28 01:54 AM, 下载次数: 10

引用:原帖由 mxBB 於 2014-2-27 01:33 AM 发表
如题中左广告毒 JS:Agent-BHP
弹出同一广告
我用左Avast + kaspersky + AdwCleaner + SpyHunter 都扫唔走 ..
请师兄帮帮忙~ thanks


9477294

引用:原帖由 Luchriste 於 2014-2-28 03:23 PM 发表


路过................
系统不可以同时有两套以上防毒在运行,师兄系时候要在Avast / Kaspersky取舍。

引用:原帖由 mxBB 於 2014-2-28 01:54 AM 发表


因为之前用过AdwCleaner扫过一次 已经Uninstall
这次重新下载AdwCleaner (Xplode) 扫毒
只扫到少量报告

引用:
:OTL
O2:64bit: - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D298} - D:\QvodPlayer\QvodExtend\5.0.83.0\QvodExtend_x64.dll (Shenzhen QVOD Technology Co.,Ltd)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\RunOnce: [Report] C:\AdwCleaner\AdwCleaner[S0].txt ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8:64bit: - Extra context menu item: 使用迅雷精简版下载 - C:\Users\User\Desktop\MiniThunder\BHO\minixlgeturl.htm ()
O8:64bit: - Extra context menu item: 使用迅雷精简版下载全部链接 - C:\Users\User\Desktop\MiniThunder\BHO\minixlgetAllurl.htm ()
O8 - Extra context menu item: 使用迅雷精简版下载 - C:\Users\User\Desktop\MiniThunder\BHO\minixlgeturl.htm ()
O8 - Extra context menu item: 使用迅雷精简版下载全部链接 - C:\Users\User\Desktop\MiniThunder\BHO\minixlgetAllurl.htm ()
O13 - gopher Prefix: missing
O15 - HKLM\..Trusted Domains: @@@ ([]gb2 in Trusted sites)
O15 - HKLM\..Trusted Domains: @@@ ([]http in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 203.185.0.33 203.185.0.34 203.185.0.35
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6A3DC2A1-E9DC-463E-9CAE-AD56F5856761}: DhcpNameServer = 203.185.0.33 203.185.0.34 203.185.0.35
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found


:Files
C:\Windows\tasks\ruyiUpdate.job
C:\Windows\tasks\AliUpdater{58B11D69-6662-4B31-B1F5-968B5277342A}.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1160285446-2016674338-1733306640-1000UA.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1160285446-2016674338-1733306640-1000Core.job


ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]

引用:原帖由 SILVESTERABEND 於 2014-2-28 10:03 PM 发表



双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑 ...

02282014_235817.log (11.6 KB)

2014-3-1 12:09 AM, 下载次数: 3

引用:原帖由 mxBB 於 2014-3-1 12:09 AM 发表




9482151

引用:原帖由 SILVESTERABEND 於 2014-3-1 04:44 PM 发表


楼主仍沿用旧版Avast ? 重有冇update ?
建议在安全模式执行Avast Uninstall Utility (avastclear.exe)移除旧Avast > 重启电脑 > 重新安装最新版Avast,Avast报毒问题应可顺利解决。
(或索性唔装Avast,因为已经装 ...

引用:原帖由 SILVESTERABEND 於 2014-3-2 10:39 AM 发表
移除旧版Avast,可能系误报。