怀疑中毒, 请帮忙 [已附加 hijackthis, Malwarebytes(Quick scan)]

hijackthis paul.log(14.55 KB)

2013-5-22 11:50 PM, 下载次数: 4

Windows update.png(39.51 KB)

2013-5-22 11:50 PM

mbam-log-2013-05-22(Quick scan).txt(1.87 KB)

2013-5-23 03:12 AM, 下载次数: 3

引用:

原帖由 ballpaul 於 2013-5-22 11:50 PM 发表
琴日系 Facebook 唔小心按左朋友贴出黎的 link, 入左去之后先 后悔疑似系病毒 link 黎...
之后即刻做 Avast full scan 同埋 Malwarebytes full scan, 前者扫左无野, 后者扫左有3个 file 有 Trojan, 已经 Remove 左. ...

引用:

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [S-Bar] %PROGRAMFILES%\S-Bar\S-Bar.exe
O4 - HKLM\..\Run: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\Program Files (x86)\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-21-2508223342-464690592-3986302855-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2508223342-464690592-3986302855-1000\..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2508223342-464690592-3986302855-1000\..\Run: [Google Update] "C:\Users\TYeung\AppData\Local\Google\Update\GoogleUpdate.exe" /c (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2508223342-464690592-3986302855-1000\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2508223342-464690592-3986302855-1000\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2508223342-464690592-3986302855-1000\..\Run: [Core Temp] "C:\Users\TYeung\Desktop\CoreTemp\Core Temp.exe" (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2508223342-464690592-3986302855-1000\..\Run: [QQ2009] "D:\Program Files (x86)\Tencent\QQ\Bin\QQ.exe" /background (User 'UpdatusUser')

O8 - Extra context menu item: &妏蚚&捃泞狟婥 - D:\Program Files (x86)\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &妏蚚&捃泞狟婥窒蝈诿 - D:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: 使用迅雷看看播放器播放 - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm
O9 - Extra button: (no name) - {0000016b-c524-4050-81a0-243669a86b9f} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm
O9 - Extra 'Tools' menuitem: ??‥31p?Y?Y??cn?1 - {0000016b-c524-4050-81a0-243669a86b9f} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm
O9 - Extra button: ??‥31p?Y?Y??cn?1 - {0000026b-c524-4050-81a0-243669a86b9f} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolBar.htm

O23 - Service: KMService - Unknown owner - C:\windows\system32\srvany.exe

引用:

:files
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe

引用:

原帖由 SILVESTERABEND 於 2013-5-23 06:50 PM 发表


C:\Program Files (x86)\Trusteer\Rapport系咪自己装? from UK Bank?
重新开番Windows自动更新。
Hijackthis报告见唔到有可疑。试停部份启动同附於浏览器的add-ons 。

1.执行Hijackthis > Do a system scan ...

JRT.txt(769 Bytes)

2013-5-24 05:13 AM, 下载次数: 1

Combofix log.txt(26.33 KB)

2013-5-24 05:13 AM, 下载次数: 1

hijackthis 2.txt(12.75 KB)

2013-5-24 05:13 AM, 下载次数: 1

O4.png(204.49 KB)

2013-5-24 05:13 AM

引用:

原帖由 ballpaul 於 2013-5-24 05:13 AM 发表
thanks 师兄...
做依几个步骤时出现左 d 问题...希望无影响...
1. 做 Hijackthis 勾选下列项目...唔知点解搵唔到你讲果几样...只系搵到2个...(我附加左张图)...但之后做晒全部步骤之后再开 Hijackthis scan 果阵.. ...