当前位置：首页 → 问答吧 → 中广告毒

中广告毒

时间：2014-02-28

来源：互联网

Chrome成日弹广告
求救plz

hijackthis.log (9.84 KB)

2014-2-19 11:47 PM, 下载次数: 8

作者: 031004 发布时间: 2014-02-28

引用:原帖由 031004 於 2014-2-19 11:47 PM 发表
Chrome成日弹广告
求救plz

楼主先去程式集移除以下两套程式:
a. 360所有程式。
b. MyPC Backup。

作者: SILVESTERABEND 发布时间: 2014-02-28

开机按F8,入安全模式做Fix checked & OTM 删除。
1. 执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。

引用:
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - C:\Program Files (x86)\360\360safe\safemon\safemon.dll
O4 - HKLM\..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
O4 - HKCU\..\Run: [NextLive] C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O8 - Extra context menu item: &妏蚚&捃泞烛盄狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥窒蝈诿 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: &妏蚚FLVCD凤挂珜弝腔狟婥华硊 - C:\Users\user\AppData\Roaming\flvcd\flvcd_link.htm
O8 - Extra context menu item: &妏蚚FLVCD凤蚬弝腔狟婥华硊 - C:\Users\user\AppData\Roaming\flvcd\flvcd_href.htm
O23 - Service: Computer Backup (MyPC Backup) (BackupStack) - Just Develop It - C:\Program Files (x86)\MyPC Backup\BackupStack.exe
O23 - Service: Baidu Updater (BaiduUpdater) - Baidu.com, Inc. - C:\Program Files (x86)\Baidu\BaiduUpdate\bdupdate.exe
O23 - Service: MgAssist Service (MgAssistService) - Unknown owner - C:\Program Files (x86)\Mobogenie\MgAssist.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files (x86)\PDF Complete\pdfsvc.exe

2. 下载/执行 OTM做删除。
copy & paste 以下项目於Paste Instructions for Items to be Moved的框格内。
按MoveIt > OK > 重启电脑。

引用::files
C:\Program Files (x86)\360\360safe\safemon\safemon.dll
C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
C:\Users\user\AppData\Roaming\newnext.me\nengine.dll
C:\Program Files (x86)\Baidu\BaiduUpdate\bdupdate.exe
C:\Program Files (x86)\MyPC Backup\BackupStack.exe
C:\Program Files (x86)\Mobogenie\MgAssist.exe
C:\Program Files (x86)\PDF Complete\pdfsvc.exe

3. 下载/执行Junkware Removal Tool扫毒。执行扫毒前请关闭所有浏览器同程式。
(JRT会自动删除附於浏览器的恶意程式/档案/登录档)

4. 关闭所有防毒软件(包括Windows Defender),下载ComboFix至桌面 ,执行 ComboFix 扫毒。
扫瞄时不要执行其他程式或点击 ComboFix视窗。
完成扫瞄后,ComboFix 报告会自动弹出。

请贴上以下报告:
a. JRT扫毒报告。
b. ComboFix扫毒报告。
c. 新1份Hijackthis扫瞄报告。

作者: SILVESTERABEND 发布时间: 2014-02-28

完成

hijackthis.log (7.7 KB)

2014-2-20 10:48 PM, 下载次数: 5

log.txt (28.97 KB)

2014-2-20 10:48 PM, 下载次数: 2

JRT.txt (7.31 KB)

2014-2-20 10:48 PM, 下载次数: 2

作者: 031004 发布时间: 2014-02-28

1. 下载/执行 AdwCleaner (Xplode) 扫毒。(按[Clean] 扫毒/删除)
(执行AdwCleaner关闭所有浏览器/程式)

2. 下载/安装Malwarebytes Anti-Malware Free 扫毒。更新后做全面扫瞄,扫到毒按Select all > 再按Remove Selected做删除。

3. 下载 OTL.exe於桌面。双按OTL.exe > 按Run Scan > 完成后请将OTL扫瞄报告(OTL.txt)贴上。
(OTL扫瞄需时较长,请耐心等候)

请贴上以下报告:
a. AdwCleaner删毒报告。
b. MBAM扫毒报告。
c. OTL.txt扫瞄报告。

作者: SILVESTERABEND 发布时间: 2014-02-28

DONE

AdwCleaner[S0].txt (5.58 KB)

2014-2-21 06:05 PM, 下载次数: 2

OTL.Txt (79.25 KB)

2014-2-21 06:05 PM, 下载次数: 3

mbam-log-2014-02-21 (16-49-50).txt (6.01 KB)

2014-2-21 06:05 PM, 下载次数: 2

Extras.Txt (79.9 KB)

2014-2-21 06:05 PM, 下载次数: 1

作者: 031004 发布时间: 2014-02-28

双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。

请将OTL fix log贴上。

引用:
:OTL
PRC - File not found --
PRC - [2006/03/24 23:23:22 | 000,098,304 | ---- | M] (Brio) -- C:\Program Files (x86)\FolderSize\FolderSizeSvc.exe
SRV - [2006/03/24 23:23:22 | 000,098,304 | ---- | M] (Brio) [Auto | Running] -- C:\Program Files (x86)\FolderSize\FolderSizeSvc.exe -- (FolderSize)
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.tao123.com/?6493
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=CMDTDFJS
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@baidu.com/YunWebDetectPlugin: C:\Users\user\AppData\Roaming\baidu\BaiduYunGuanjia\npYunWebDetect.dll File not found
FF - HKLM\Software\MozillaPlugins\@xunlei.com/npxluser: File not found
FF - HKCU\Software\MozillaPlugins\360.cn/UploadPlugin: C:\Users\user\AppData\Roaming\360YunPan\npUploadPlugin.dll File not found
FF - HKCU\Software\MozillaPlugins\@xunlei.com/npxluser: C:\Program Files (x86)\Common Files\Thunder Network\UserAgent\npxluser2.0.2.3.dll File not found
FF - HKCU\Software\MozillaPlugins\kuaikuai.cn/kkbrowseraddin: C:\Program Files (x86)\duowan\gamebox\npkkbrowseraddin.dll (广州华多网络科技有限公司)
FF - HKCU\Software\MozillaPlugins\KuaiWanInsert: C:\Users\user\Downloads\QvodPlayerPortable\App\QvodPlayer\AddIn\KWWebgame\npKWWebGame.dll (Shenzhen QVOD Technology Co.,Ltd)
CHR - default_search_provider: search_url = http://www.baidu.com/s?ie={inputEncoding}&wd={searchTerms}
CHR - Extension: Google \u6587\u4EF6 = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_1\
CHR - Extension: Google \u96F2\u7AEF\u786C\u789F = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_1\
CHR - Extension: UTuberAdBlocKer = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjcpgdmijibchnmclifjghmjligkjjga\2.3_0\
CHR - Extension: Google \u96FB\u5B50\u9322\u5305 = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_1\
CHR - Extension: Gmail = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2\
O2:64bit: - BHO: (CoUpuExteNsion) - {3220E509-9562-87FF-910F-01517E8B7BC0} - C:\ProgramData\CoUpuExteNsion\vqe3Da.x64.dll File not found
O2:64bit: - BHO: (RanndoomPricE) - {458F06F2-5630-C04F-2526-A3A801554803} - C:\ProgramData\RanndoomPricE\C9CcHESnt.x64.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8:64bit: - Extra context menu item: &妏蚚&捃泞狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm File not found
O8:64bit: - Extra context menu item: &妏蚚&捃泞狟婥窒蝈诿 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm File not found
O8:64bit: - Extra context menu item: &妏蚚&捃泞烛盄狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm File not found
O8:64bit: - Extra context menu item: &妏蚚FLVCD凤挂珜弝腔狟婥华硊 - C:\Users\user\AppData\Roaming\flvcd\flvcd_link.htm ()
O8:64bit: - Extra context menu item: &妏蚚FLVCD凤蚬弝腔狟婥华硊 - C:\Users\user\AppData\Roaming\flvcd\flvcd_href.htm ()
O8 - Extra context menu item: &妏蚚&捃泞狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm File not found
O8 - Extra context menu item: &妏蚚&捃泞狟婥窒蝈诿 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm File not found
O8 - Extra context menu item: &妏蚚&捃泞烛盄狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm File not found
O8 - Extra context menu item: &妏蚚FLVCD凤挂珜弝腔狟婥华硊 - C:\Users\user\AppData\Roaming\flvcd\flvcd_link.htm ()
O8 - Extra context menu item: &妏蚚FLVCD凤蚬弝腔狟婥华硊 - C:\Users\user\AppData\Roaming\flvcd\flvcd_href.htm ()
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

:Files
C:\$360Section
C:\ProgramData\fjcpgdmijibchnmclifjghmjligkjjga
C:\Windows\SysWow64\pub_store.dat
C:\Users\user\AppData\Roaming\room_v3.dat

ipconfig /flushdns /c

:Commands
[PURITY]
[EMPTYTEMP]
[reboot]

作者: SILVESTERABEND 发布时间: 2014-02-28

中广告毒

热门阅读

热门下载