当前位置：首页 → 问答吧 → 经常自动发出CLICK CLICK 声....系唔系被HACK...

经常自动发出CLICK CLICK 声....系唔系被HACK...

时间：2014-03-27

来源：互联网

如题
附上hijackthis logfile
希望大大能帮忙

[ 本帖最后由 chiuyikwai 於 2014-3-6 08:20 PM 编辑 ]

hijackthis.log (12.75 KB)

2014-2-28 06:50 PM, 下载次数: 7

作者: chiuyikwai 发布时间: 2014-03-27

引用:原帖由 chiuyikwai 於 2014-2-28 06:50 PM 发表
如题
附上hijackthis logfile
希望大大能帮忙

Hijackthis扫瞄报告见唔到有被hack问题。
建议楼主先去程式集移除360所有程式,避免被利用作为[入侵跳板]。

作者: SILVESTERABEND 发布时间: 2014-03-27

开机按F8,入安全模式做Fix checked & OTM 删除。
1. 执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。

引用:
O1 - Hosts: 94.102.51.71 sc.@@@@3-4-2011
O1 - Hosts: 94.102.51.71 www.@@@@3-4-2011
O2 - BHO: XlBrowserAddinBho.XlBrowserAddinBhoObject - {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.8.71.dll
O2 - BHO: 466C78E8-F97F-C225-002B-B882A8E2A158 Class - {466C78E8-F97F-C225-002B-B882A8E2A158} - C:\Program Files (x86)\QvodPlayer\AddIn\{466C78E8-F97F-C225-002B-B882A8E2A158}\QvodAddr.dll
O2 - BHO: 瑞俴弝畦温挚狟婥郪璃 - {4ADBABBD-E1CA-4f11-BD01-73B0B6E4B5BA} - C:\Users\BananaChiu\funshion\funshiontools\FunshionHelper.dll
O2 - BHO: DefaultTabBHO - {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Users\BananaChiu\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.2.13.3882.dll
O2 - BHO: QvodGameExtend - {94C3E4BB-A261-4A83-B437-EA6F7A28CA68} - C:\Program Files (x86)\Kuaiwan\QvodGameExtend.dll
O2 - BHO: QvodExtend - {A8502600-B272-4F68-A67B-A0305D46D297} - C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.95.0\QvodExtend.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\BananaChiu\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll

O4 - HKLM\..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.130.270\AsusWSPanel.exe /S
O4 - HKLM\..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
O4 - HKCU\..\Run: [FlashGetBHO] "C:\Program Files (x86)\FlashG@@@@2013-08-09work\FlashGet 3\mxhelper.exe"
O4 - HKCU\..\Run: [EADM] C:\Program Files (x86)\Origin\Origin.exe -AutoStart
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O8 - Extra context menu item: &妏蚚&捃泞烛盄狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥窒蝈诿 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: &捃泞狟婥善忒侬 - http://static.u.155.com/shoulei/shouleidl.htm
O8 - Extra context menu item: 使用快车3下载 - C:\Users\BananaChiu\AppData\Roaming\FlashGetBHO\GetUrl.htm
O8 - Extra context menu item: 使用快车3下载全部链结 - C:\Users\BananaChiu\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
O8 - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm
O9 - Extra button: (no name) - {019c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm
O9 - Extra 'Tools' menuitem: ??迅雷看看播放器 - {019c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm
O9 - Extra button: ??迅雷看看播放器 - {119c3416-8cb2-491a-a3c7-d9fcddc9d600} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolBar.htm

O18 - Protocol: kuwo - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0C} - (no file)
O23 - Service: Bdvb Update Service (BdvbmSvc) (BdvbmSvc) - Baidu Inc. - C:\Program Files (x86)\Baidu\VbUpdate\BdvbUpdate.exe
O23 - Service: Baidu Video Service Platform (BdvbServicePlatform) - 百度在?网?技?（北京）有限公司 - C:\Program Files (x86)\baidu\iQyBaiduVideoBrowser\Application\2.5.0.12\ServicePlatform.exe
O23 - Service: Bdvb Update Service (BdvbSvc) (BdvbSvc) - Baidu Inc. - C:\Program Files (x86)\Baidu\VbUpdate\BdvbUpdate.exe
O23 - Service: DefaultTabSearch - Unknown owner - C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe
O23 - Service: DefaultTabUpdate - Unknown owner - C:\Users\BananaChiu\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe
O23 - Service: MgAssist Service (MgAssistService) - Unknown owner - C:\Program Files (x86)\Mobogenie\MgAssist.exe
O23 - Service: SplashtopR Remote Service (SplashtopRemoteService) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
O23 - Service: Splashtop Software Updater Service (SSUService) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe

2. 下载/执行 OTM做删除。
copy & paste 以下项目於Paste Instructions for Items to be Moved的框格内。
按MoveIt > OK > 重启电脑。

引用:
:files
C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
C:\Program Files (x86)\Origin\Origin.exe
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.8.71.dll
C:\Program Files (x86)\QvodPlayer\AddIn\{466C78E8-F97F-C225-002B-B882A8E2A158}\QvodAddr.dll
C:\Users\BananaChiu\funshion\funshiontools\FunshionHelper.dll
C:\Users\BananaChiu\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.2.13.3882.dll
C:\Program Files (x86)\Kuaiwan\QvodGameExtend.dll
C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.95.0\QvodExtend.dll
C:\Users\BananaChiu\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll
C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
C:\Program Files (x86)\Baidu\VbUpdate\BdvbUpdate.exe
C:\Program Files (x86)\baidu\iQyBaiduVideoBrowser\Application\2.5.0.12\ServicePlatform.exe
C:\Program Files (x86)\Baidu\VbUpdate\BdvbUpdate.exe
C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe
C:\Users\BananaChiu\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe
C:\Program Files (x86)\Mobogenie\MgAssist.exe
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe

3. 下载/执行Junkware Removal Tool扫毒。执行扫毒前请关闭所有浏览器同程式。
(JRT会自动删除附於浏览器的恶意程式/档案/登录档)

4. 关闭所有防毒软件(包括Windows Defender),下载ComboFix至桌面 ,执行 ComboFix 扫毒。
扫瞄时不要执行其他程式或点击 ComboFix视窗。
完成扫瞄后,ComboFix 报告会自动弹出。

请贴上以下报告:
a. JRT扫毒报告。
b. ComboFix扫毒报告。
c. 新1份Hijackthis扫瞄报告。

作者: SILVESTERABEND 发布时间: 2014-03-27

已完成
THX ALOT!!

JRT.txt (6.99 KB)

2014-3-2 01:01 PM, 下载次数: 5

log.txt (23.25 KB)

2014-3-2 01:01 PM, 下载次数: 3

hijackthis1.log (8.47 KB)

2014-3-2 01:01 PM, 下载次数: 4

作者: chiuyikwai 发布时间: 2014-03-27

1. 下载/执行 AdwCleaner (Xplode) 扫毒。(按[Clean] 扫毒/删除)
(执行AdwCleaner关闭所有浏览器/程式)

2. 下载/安装Malwarebytes Anti-Malware Free 扫毒。更新后做全面扫瞄,扫到毒按Select all > 再按Remove Selected做删除。

3. 下载 OTL.exe於桌面。双按OTL.exe > 按Run Scan > 完成后请将OTL扫瞄报告(OTL.txt)贴上。
(OTL扫瞄需时较长,请耐心等候)

请贴上以下报告:
a. AdwCleaner删毒报告。
b. MBAM扫毒报告。
c. OTL.txt扫瞄报告。

作者: SILVESTERABEND 发布时间: 2014-03-27

OK 喇

AdwCleaner[S0].txt (4.42 KB)

2014-3-4 10:55 AM, 下载次数: 4

OTL.Txt (106.79 KB)

2014-3-4 10:55 AM, 下载次数: 3

mbam-log-2014-03-03 (20-47-38).txt (14.36 KB)

2014-3-4 10:55 AM, 下载次数: 4

作者: chiuyikwai 发布时间: 2014-03-27

引用:原帖由 chiuyikwai 於 2014-3-4 10:55 AM 发表
OK 喇

1. 楼主要重新执行MBAM扫毒 > 勾选扫到可疑档案 > 按Remove selected做删除。

2. 重新做1份OTL.txt扫瞄报告贴上。

作者: SILVESTERABEND 发布时间: 2014-03-27

SORRY 我MISS左CLICK DEL FILE.....
THX!!

OTL.Txt (108.24 KB)

2014-3-5 08:45 PM, 下载次数: 2

作者: chiuyikwai 发布时间: 2014-03-27

引用:原帖由 chiuyikwai 於 2014-3-5 08:45 PM 发表
SORRY 我MISS左CLICK DEL FILE.....
THX!!

系统重有冇发出怪声?

作者: SILVESTERABEND 发布时间: 2014-03-27

暂时未没 THX ALOT!!!~~

作者: chiuyikwai 发布时间: 2014-03-27

引用:原帖由 chiuyikwai 於 2014-3-6 12:19 AM 发表
暂时未没 THX ALOT!!!~~

You're welcome.

1. 如果系统运作回复正常,请跟#8帖移除Hijackthis/ComboFix等等的扫瞄软件。
http://computer.uwants.com/viewthread.php?tid=12999541&extra=page%3D1

2. 请用CCleaner Free删除temp files/登录档,用Windows预载defrag功能,做番1次磁碟重组(defrag)。

3. 请将[病毒移除]主题改为[已解决]。Tks.

作者: SILVESTERABEND 发布时间: 2014-03-27

重有CLICK CLICK 声......

作者: chiuyikwai 发布时间: 2014-03-27

引用:原帖由 chiuyikwai 於 2014-3-6 08:20 PM 发表
重有CLICK CLICK 声......

load紧网页时的连续几下[的的声]?

作者: SILVESTERABEND 发布时间: 2014-03-27

双按OTL.exe > 将下列档案copy & paste 到Custom Scans/Fixes框架内 > 按左上角[Run Fix];执行fix前要关闭浏览器。
成功fixed (删除)会有通知(Fix complete! Click OK to open the fix log.) >按OK > 重启电脑。

请将OTL fix log贴上。

引用:
:OTL
PRC - [2011/03/24 23:11:18 | 000,107,800 | ---- | M] (Octoshape ApS) -- C:\Users\BananaChiu\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
SRV - [2013/01/09 23:28:39 | 004,600,832 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
FF - HKLM\Software\MozillaPlugins\@baidu.com/BdvbFfPlugin: C:\Program Files (x86)\baidu\iQyBaiduVideoBrowser\Application\2.5.0.12\npTestNetscapePlugIn.dll File not found
FF - HKLM\Software\MozillaPlugins\@baidu.com/npxbdyy: C:\Program Files (x86)\Baidu\BaiduPlayer\1.19.0.45\npxbdyy.dll File not found
FF - HKLM\Software\MozillaPlugins\@funshion.com/npFunshion: C:\Users\BananaChiu\funshion\funshiontools\npFunshion.dll File not found
FF - HKLM\Software\MozillaPlugins\@mytalkpal.com/ffplugin: C:\Program Files (x86)\Talkpal\Speech Plugin For EF\npTalkpalPlugin.dll (Shanghai Qitai Tech. Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@pps.tv/nppps: D:\PPS.tv\PPStream\nppps.dll ()
FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall: C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll File not found
FF - HKLM\Software\MozillaPlugins\@qq.com/QQPhotoDrawEx: C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll File not found
FF - HKLM\Software\MozillaPlugins\@qq.com/QzoneMusic: C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll File not found
FF - HKLM\Software\MozillaPlugins\@qq.com/TXSSO: C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.2.39\Bin\npSSOAxCtrlForPTLogin.dll File not found
FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodInsert: C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll (Shenzhen QVOD Technology Co.,Ltd)
FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodShare: C:\Program Files (x86)\QvodPlayer\npShareModule.dll (Shenzhen QVOD Technology Co.,Ltd)
FF - HKLM\Software\MozillaPlugins\@xunlei.com/DapCtrl: C:\Program Files (x86)\Common Files\Thunder Network\KanKan\npDapCtrl.3.1.0.7.(638).dll (ShenZhen Thunder Networking Technologies Ltd.)
FF - HKLM\Software\MozillaPlugins\@xunlei.com/npxluser: C:\Program Files (x86)\Thunder Network\Thunder\BHO\xluser\npxluser.dll (Thunder Networking Technologies,LTD)
FF - HKLM\Software\MozillaPlugins\@xunlei.com/npxunlei;version=1.0.0.2: C:\ProgramData\Thunder Network\Thunder\data\npxunlei1.0.0.2.dll ( )
FF - HKCU\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0: C:\Users\BananaChiu\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1103234-0-npoctoshape.dll (Octoshape ApS)
FF - HKCU\Software\MozillaPlugins\KuaiWanInsert: C:\Program Files (x86)\QvodPlayer\AddIn\KWWebgame\npKWWebGame.dll (Shenzhen QVOD Technology Co.,Ltd)
FF - HKCU\Software\MozillaPlugins\kwcheck: C:\Program Files (x86)\Kuaiwan\npKWCheck.dll (Shenzhen QVOD Technology Co.,Ltd)
CHR - plugin: WebLauncher (Enabled) = C:\GF2_WebLaunch\npWebLauncher.dll
CHR - plugin: 360MMPlugin (Enabled) = C:\Program Files (x86)\360\360Safe\MobileMgr\np360MMPlugIn.dll
CHR - plugin: BaiduPlayer Browser Plugin (Enabled) = C:\Program Files (x86)\Baidu\BaiduPlayer\1.19.0.45\npxbdyy.dll
CHR - plugin: Baidu VbUpdate (Enabled) = C:\Program Files (x86)\Baidu\VbUpdate\1.3.27.11\npBdvbUpdate7.dll
CHR - plugin: kwcheck-plugin (Enabled) = C:\Program Files (x86)\Kuaiwan\npKWCheck.dll
CHR - plugin: QvodInsert (Enabled) = C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll
CHR - plugin: QvodShareModule (Enabled) = C:\Program Files (x86)\QvodPlayer\npShareModule.dll
CHR - plugin: Funshion (Enabled) = C:\Users\BananaChiu\funshion\funshiontools\npFunshion.
CHR - plugin: PPS Browser Plugin (Enabled) = D:\PPS.tv\PPStream\nppps.dll
O2:64bit: - BHO: (捃泞狟婥盓厥) - {004B0726-A010-4ABF-8556-FCDB7F1FCA1E} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO647.2.13.3882.dll (深圳市迅雷网络技术有限公司)
O2:64bit: - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D298} - C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.95.0\QvodExtend_x64.dll (Shenzhen QVOD Technology Co.,Ltd)
O2 - BHO: (QQ狟婥翑忒銡拟讽璃) - {C9C7334B-5657-41e1-8F79-F6AACECA05F4} - C:\Program Files (x86)\Common Files\Tencent\QQMiniDL\45\Browser\QQIEHelper01.dll File not found
O2 - BHO: (AccountProtectBHO Class) - {DDD362CF-523B-4BC9-8FDC-58F93B6BC945} - C:\Users\BananaChiu\AppData\Roaming\Tencent\QQ\QQAntiPhishing\AccountProtect.dll File not found
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [ASUS Sync Loader] C:\Program Files (x86)\ASUS\ASUS Sync\asusUPCTLoader.exe (Futuredial Inc.)
O4 - HKCU..\Run: [Octoshape Streaming Services] C:\Users\BananaChiu\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (Octoshape ApS)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8:64bit: - Extra context menu item: 妏蚚QQ狟婥翑忒狟婥 - C:\Program Files (x86)\Common Files\Tencent\QQMiniDL\45\Browser\xfgeturl.htm File not found
O8:64bit: - Extra context menu item: 使用快播按图找片 - C:\Program Files (x86)\QvodPlayer\AddIn\ImgSeed.htm ()
O8 - Extra context menu item: 妏蚚QQ狟婥翑忒狟婥 - C:\Program Files (x86)\Common Files\Tencent\QQMiniDL\45\Browser\xfgeturl.htm File not found
O8 - Extra context menu item: 使用快播按图找片 - C:\Program Files (x86)\QvodPlayer\AddIn\ImgSeed.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 203.185.0.33 203.185.0.34 203.185.0.35
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5425352F-CB83-48C2-8587-123983A33CEF}: DhcpNameServer = 203.185.0.33 203.185.0.34 203.185.0.35
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{909DA87B-9853-4768-B875-99ED118D9097}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B011058F-EA80-4EB3-A677-DE3C9912D16F}: DhcpNameServer = 203.185.0.33 203.185.0.34 203.185.0.35
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FDD2F400-FC08-4238-8040-BC18DA632B69}: DhcpNameServer = 10.11.110.101 10.11.105.102
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

:Files
C:\Users\BananaChiu\AppData\Roaming\Funshion
C:\Users\BananaChiu\AppData\Roaming\360SuperKiller
C:\Users\BananaChiu\FunShion.ini
C:\Windows\tasks\ParetoLogic Update Version3 Startup Task.job

ipconfig /flushdns /c

:Commands
[RESETHOSTS]
[PURITY]
[EMPTYTEMP]
[reboot]

作者: SILVESTERABEND 发布时间: 2014-03-27

跟你个步骤整完之后
上唔到网
右下个连线变成交叉

作者: chiuyikwai 发布时间: 2014-03-27

我RESTORE 返3月3日既SYSTEM 依家就上得返网......

作者: chiuyikwai 发布时间: 2014-03-27