当前位置：首页 → 问答吧 → 中了DELTA SEARCH毒(有HIJACKTHIS)

中了DELTA SEARCH毒(有HIJACKTHIS)

时间：2013-05-26

来源：互联网

在下不知何为中了DELTA SEARCH毒,开fire fox分页时都会变成DELTA SEARCH,可以教教我如何移除吗?

[ 本帖最后由杂果滨治武士G 於 2013-5-27 09:31 PM 编辑 ]

hijackthis.log(18.51 KB)

2013-5-26 10:44 PM, 下载次数: 4

作者: 杂果滨治武士G 发布时间: 2013-05-26

开机按F8,入安全模式做Fix checked & OTM 删除。

1.执行Hijackthis > Do a system scan only > 勾选下列项目 > 按Fix Checked (fix checked时关闭所有browsers/程式) > 按"是"。

引用:

R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\SSPlus\SAddr.dll
O2 - BHO: VideoUrlSniffer - {00000ADA-7E0D-47C1-986C-F017D09C4304} - (no file)
O2 - BHO: MediaMonitor.XlMediaMonitorBhoObject - {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.1.29.dll
O2 - BHO: WebCake Layers - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files (x86)\WebCake\WebCakeIEClient.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.31.2\bh\BabylonToolbar.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: (no name) - {669751ED-D558-49AE-B01A-3B374CC7910E} - C:\Program Files\TENCENT\SSPlus\SSup.dll
O2 - BHO: StartNow Toolbar Helper - {6E13D095-45C3-4271-9475-F3B48227DD9F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll
O2 - BHO: uTorrentControl_v2 - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.1.8.2302.dll
O2 - BHO: DealPly - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files (x86)\DealPly\DealPlyIE.dll
O2 - BHO: DownloadAssistant.XlDownloadAssistantBhoObject - {B0E2F470-0B07-48f0-B3B1-5749505FAE9B} - C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.1.29.dll
O2 - BHO: Tencent Browser Helper - {BB97B3A8-CA15-6C03-42E1-793B315CA9AF} - C:\Program Files\TENCENT\SSPlus\SAddr.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (file missing)
O2 - BHO: E97ECD1E-8529-3970-BDE0-93BCAC2AB593 Class - {E97ECD1E-8529-3970-BDE0-93BCAC2AB593} - C:\Program Files (x86)\QvodPlayer\AddIn\{E97ECD1E-8529-3970-BDE0-93BCAC2AB593}\QvodAddr.dll (file missing)

O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (file missing)
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.31.2\BabylonToolbarTlbr.dll
O3 - Toolbar: StartNow Toolbar - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll
O3 - Toolbar: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [StartNowToolbarHelper] "C:\Program Files (x86)\StartNow Toolbar\ToolbarHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [PPS Accelerator] D:\PPS.tv\PPStream\ppsap.exe
O4 - HKCU\..\Run: [RegistryBooster] "C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe" delay 20000
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [GarenaPlus] "C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe" -autolaunch
O4 - HKCU\..\Run: [WebCake Desktop] "C:\Users\ho\AppData\Roaming\WebCake\WebCakeDesktop.exe"
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

O8 - Extra context menu item: Foxy 狟徭 - res://C:\Program Files (x86)\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 刲? - res://C:\Program Files (x86)\Foxy\Foxy.exe/search.htm
O8 - Extra context menu item: Foxy 搜寻 - res://C:\Program Files (x86)\Foxy\Foxy.exe/search.htm
O8 - Extra context menu item: Foxy 下载 - res://C:\Program Files (x86)\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: 妏蚚捃泞狟婥 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetUrl.htm
O8 - Extra context menu item: 妏蚚捃泞狟婥窒蝈诿 - C:\Program Files (x86)\Thunder Network\Thunder\BHO\GetAllUrl.htm
O9 - Extra button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (file missing)

O11 - Options group: [INTERNATIONAL] International
O11 - Options group: [TBH] SOSO AddressBar Search

O20 - AppInit_DLLs: c:\progra~2\websea~1\sprote~1.dll

O23 - Service: Tencent SOSO Update Service (ARUpdate) - Tencent - C:\Program Files\TENCENT\AddrUpdate\AddrUpdate.exe
O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe
O23 - Service: WebCake Desktop Updater - Unknown owner - C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe" "C:\Users\ho\AppData\Roaming\WebCake\WebCakeDesktop.exe (file missing)

2. 下载/执行 OTM做删除。
copy & paste 以下项目於Paste Instructions for Items to be Moved的框格内。
按MoveIt > OK > 重启电脑。

引用:

:files
D:\PPS.tv\PPStream\PPSAP.exe
C:\Program Files (x86)\bfcloud\bfcloud.exe
C:\Users\ho\AppData\Roaming\WebCake\WebCakeDesktop.exe
C:\Program Files\TENCENT\SSPlus\SAddr.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.1.29.dll
C:\Program Files (x86)\WebCake\WebCakeIEClient.dll
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.31.2\bh\BabylonToolbar.dll
C:\Program Files\TENCENT\SSPlus\SSup.dll
C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll
C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XunleiBHO7.1.8.2302.dll
C:\Program Files (x86)\DealPly\DealPlyIE.dll
C:\Program Files (x86)\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.1.29.dll
C:\Program Files\TENCENT\SSPlus\SAddr.dll
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.31.2\BabylonToolbarTlbr.dll
C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll
C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
C:\Program Files (x86)\StartNow Toolbar\ToolbarHelper.exe
C:\Program Files (x86)\QuickTime\QTTask.exe
C:\Program Files (x86)\Uniblue\RegistryBooster\launcher.exe
C:\Users\ho\AppData\Roaming\WebCake\WebCakeDesktop.exe
c:\progra~2\websea~1\sprote~1.dll

3. 下载/执行Junkware Removal Tool扫毒。执行JRT扫毒时请关闭所有浏览器同程式。。
(JRT会自动删除附於浏览器的恶意程式/档案/登录档)

4. 下载/执行WinSockFix.bat for Win7修正/重设winsock > 重启电脑。

5. 关闭所有防毒软件(包括Windows Defender),下载ComboFix至桌面 ,执行 ComboFix 扫毒。
扫瞄时不要执行其他程式或点击 ComboFix视窗。
(ComboFix扫毒约10 -20分钟,唔使装"修复主控台程式")
完成扫瞄后,ComboFix 报告会自动弹出。

请贴上以下报告:
1. JRT捐毒报告。
2. ComboFix扫毒报告。
3. 新1份Hijackthis扫瞄报告。

作者: SILVESTERABEND 发布时间: 2013-05-27

谢版主,现在已经修复了

JRT.txt(169.68 KB)

2013-5-27 03:22 PM, 下载次数: 2

log.txt(29.41 KB)

2013-5-27 03:22 PM, 下载次数: 2

hijackthis.log(12.34 KB)

2013-5-27 03:22 PM, 下载次数: 5

作者: 杂果滨治武士G 发布时间: 2013-05-27

引用:

原帖由杂果滨治武士G 於 2013-5-27 03:22 PM 发表
谢版主,现在已经修复了

开3个浏览器(IE/Chrome/Firefox)重有冇弹Delta Search ?
楼主系统的恶意程式/PUPs 劲多.....

PS: 楼主做左呢项未?
下载/执行WinSockFix.bat for Win7修正/重设winsock > 重启电脑。

[ 本帖最后由 SILVESTERABEND 於 2013-5-27 06:55 PM 编辑 ]

作者: SILVESTERABEND 发布时间: 2013-05-27

已经冇左Delta Search既出现,咁我接下来应该点做?
P.S.我做左果项了

作者: 杂果滨治武士G 发布时间: 2013-05-27

引用:

原帖由杂果滨治武士G 於 2013-5-27 09:00 PM 发表
已经冇左Delta Search既出现,咁我接下来应该点做?
P.S.我做左果项了

1. 如果系统正常,请跟#8帖移除Hijackthis/ComboFix等等的扫瞄软件。
http://computer.uwants.com/viewthread.php?tid=12999541&extra=page%3D1

2. 请用CCleaner Free删除temp files/登录档,做番1次磁碟重组(defrag)。

3. 请将[求助]主题改为[已解决]。Tks.