查看完整版本: snap.do病毒,IE icon變咗做放大鏡,個名變咗做Search

wongkakuiwin 2013-6-4 10:41 PM

snap.do病毒,IE icon變咗做放大鏡,個名變咗做Search

如題
windows 7中左 snap.do 既病毒,
一開新分頁會自動連去snap.do 既 search page 度
IE icon變咗做放大鏡,個名變咗做Search

SILVESTERABEND 2013-6-5 08:48 AM

[quote]原帖由 [i]wongkakuiwin[/i] 於 2013-6-4 10:41 PM 發表 [url=http://computer.uwants.com/redirect.php?goto=findpost&pid=208226026&ptid=16211860][img]http://computer.uwants.com/images/common/back.gif[/img][/url]
如題
windows 7中左 snap.do 既病毒,
一開新分頁會自動連去snap.do 既 search page 度
IE icon變咗做放大鏡,個名變咗做Search [/quote]



[size=4]下載[/size][url=http://www.hijackthis.de/downloads/HJTInstall.exe][size=4]Hijackthis[/size][/url][size=4]至桌面 > 按 Install > 按[ Accept] > 按 [Do a system scan and save a logfile ] > 完成掃瞄系統,Hijackthis會彈出報告。

[color=blue]儲存該掃瞄報告於桌面。請把Hijackthis 掃瞄報告帖上。[/color][/size]


[color=red]PS:如果上網受影響,可以先在其他電腦用USB下載Hijackthis再在受感染電腦上執行[/color]。

wongkakuiwin 2013-6-5 10:32 PM

已上傳報告!
謝謝幫忙!

SILVESTERABEND 2013-6-5 11:00 PM

[color=#0000ff]開機按F8,入安全模式做Fix checked & OTM 刪除。

[/color]1.執行Hijackthis > Do a system scan only > 勾選下列項目 > 按Fix Checked (fix checked時關閉所有browsers/程式) > 按"是"。
[quote]
[color=blue]O2 - BHO: ShowHKToolbar Class - {06433BFE-4946-4E89-823D-CD359C81CD06[/color]} - C:\Program Files (x86)\881903\IETOOLBAR\hktbar.dll
[color=red]O2 - BHO: Snap.DoEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - mscoree.dll[/color] (file missing)
[color=blue]O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO[/color]_1.5.4.11.dll
[color=blue]O2 - BHO: Hong Kong Toolbar - {481EE3EC-C026-4F9A-BA22-FD07654ADFC0[/color]} - C:\Program Files (x86)\881903\IETOOLBAR\hktbar.dll
[color=red]O2 - BHO: tuvaro Helper Object - {5CB02877-EFBC-4317-B608-9E24B11BAB40} - C:\Program Files (x86)\tuvaro\tuvaro\1.8.17.1\bh\tuvaro.dll
[/color][color=blue]O2 - BHO: Google Toolbar Helper[/color] - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
[color=blue]O2 - BHO: Google Toolbar Notifier BHO[/color] - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll
[color=red]O2 - BHO: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.16.16\bh\delta.[/color]dll
[color=red]O3 - Toolbar: Google Toolbar[/color] - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
[color=red]O3 - Toolbar: Tuvaro Toolbar - {6F001652-AF51-45C6-B029-86E0265A1851} - C:\Program Files (x86)\tuvaro\tuvaro\1.8.17.1\tuvaroTlbr[/color].dll
[color=red]O3 - Toolbar: Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.16.16\deltaTlbr.dll
O3 - Toolbar: Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - mscoree.dll[/color] (file missing)
[color=blue]O3 - Toolbar: Hong Kong Toolbar - {481EE3EC-C026-4F9A-BA22-FD07654ADFC0} - C:\Program Files (x86)\881903\IETOOLBAR\hktbar[/color].dll


[color=blue]O4 - HKLM\..\Run: [HKToolbarManager[/color]] "C:\Program Files (x86)\881903\IETOOLBAR\hkmgr.exe"
[color=red]O4 - HKCU\..\Run: [kupe[/color]] \"C:\Program Files (x86)\Honey\9kupe.exe\" -tray
[color=blue]O4 - HKCU\..\Run: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
[/color][color=red]O4 - HKCU\..\Run: [PPS Accelerator[/color]] D:\PPS.tv\PPStream\PPSKernel.exe
[color=red]O4 - HKCU\..\Run[/color]: [Akamai NetSession Interface] "C:\Users\User\AppData\Local\Akamai\netsession_win.exe"
[color=red]O4 - HKCU\..\Run: [Browser Infrastructure Helper] C:\Users\User\AppData\Local\Smartbar\Application\SnapDo.exe startup
[/color][color=blue]O4 - HKCU\..\Run: [HKToolbarManager[/color]] C:\Program Files (x86)\881903\IETOOLBAR\hkmgr.exe
[color=blue]O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE'[/color])
[color=red]O4 - HKUS\S-1-5-19\..\Run: [PPS Accelerator[/color]] D:\PPS.tv\PPStream\PPSKernel.exe (User 'LOCAL SERVICE')
[color=blue]O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE'[/color])
[color=blue]O4 - HKUS\S-1-5-21-1862051715-1769390051-2963592769-1002\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser'[/color])
[color=red]O4 - HKUS\S-1-5-18\..\Run: [PPS Accelerator[/color]] D:\PPS.tv\PPStream\PPSKernel.exe (User 'SYSTEM')
[color=red]O4 - HKUS\.DEFAULT\..\Run: [PPS Accelerator[/color]] D:\PPS.tv\PPStream\PPSKernel.exe (User 'Default user')

O8 - Extra context menu item: &使用BitComet下載 - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &使用BitComet下載全部連結 - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: 下載 - res://C:\Program Files (x86)\Honey\kupeer\9kupe.exe/download.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll/206 (file missing)


[/quote]
2. [url=http://oldtimer.geekstogo.com/OTM.exe][color=#0000ff]下載/執行 OTM[/color][/url]做刪除。
copy & paste 以下項目於Paste Instructions for Items to be Moved的框格內。
按MoveIt > OK > 重啟電腦。
[quote]
[color=red]:files[/color]
[color=red]D:\PPS.tv\PPStream\PPSProtect.exe[/color]
[color=red]D:\PPS.tv\PPStream\PPSKernel.exe
C:\Users\User\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\881903\IETOOLBAR\hkmgr.exe[/color]
[color=red]C:\Users\User\AppData\Local\Akamai\netsession_win.exe[/color]
[color=red]C:\Program Files (x86)\881903\IETOOLBAR\hktbar.dll[/color]
[color=red]C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll[/color]
[color=red]C:\Program Files (x86)\tuvaro\tuvaro\1.8.17.1\bh\tuvaro.dll[/color]
[color=red]C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll[/color]
[color=red]C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll[/color]
[color=red]C:\Program Files (x86)\Delta\delta\1.8.16.16\bh\delta.dll[/color]
[color=red]C:\Program Files (x86)\tuvaro\tuvaro\1.8.17.1\tuvaroTlbr.dll[/color]
[color=red]C:\Program Files (x86)\Honey\9kupe.exe\[/color]
[color=red]C:\Users\User\AppData\Local\Smartbar\Application\SnapDo.exe[/color]

[/quote]
3. [color=black]下載/執行[/color][url=http://thisisudax.org/][color=#0000ff]Junkware Removal Tool[/color][/url][color=#0000ff][color=black]掃毒。[color=red]執行掃毒前請關閉所有瀏覽器同程式[/color]。
[/color][/color][color=black](JRT會自動刪除附於瀏覽器的惡意程式/檔案/登錄檔)
[/color][color=black]
[/color]
[color=black]4. 關閉所有防毒軟件(包括Windows Defender),下載[url=http://download.bleepingcomputer.com/sUBs/ComboFix.exe]ComboFix[/url]至桌面 ,執行 [color=black]ComboFix [/color]掃毒。
[font=Tahoma]掃瞄時不要執行其他程式或點擊 ComboFix視窗。[/font]
([color=#1f497d][color=blue]ComboFix[/color][/color][font=Tahoma][color=blue]掃毒約10 -20分鐘,唔使裝"修復主控台程式[/color][/font][color=blue]")
[/color][font=Tahoma]完成掃瞄後,[color=black]ComboFix[/color] 報告會自動彈出。[/font]

[color=blue]請貼上以下報告:[/color]
[color=blue]1. JRT掃毒報告。[/color]
[color=blue]2. ComboFix掃毒報告。[/color]
[color=blue]3. 新1份Hijackthis掃瞄報告。[/color]
[color=#0000ff][/color]

[color=blue]5. 樓主有冇印象裝左乜軟件/程式後出現snap.do ?[/color]
[/color]

wongkakuiwin 2013-6-5 11:34 PM

無咩印像,不過我都同其他師兄一樣有用gom player

請問勾選下列項目係勾選紅色籃色定黑色?

SILVESTERABEND 2013-6-6 10:55 AM

[quote]原帖由 [i]wongkakuiwin[/i] 於 2013-6-5 11:34 PM 發表 [url=http://computer.uwants.com/redirect.php?goto=findpost&pid=208253127&ptid=16211860][img]http://computer.uwants.com/images/common/back.gif[/img][/url]
無咩印像,不過我都同其他師兄一樣有用gom player

請問勾選下列項目係勾選紅色籃色定黑色? [/quote]

全部都要勾選fix checked。

wongkakuiwin 2013-6-6 11:32 PM

唔好意思
我係window 7、開機按F8冇一個入safe mode 的option
開機長按ctrl亦無反應,應該點入safe mode呢?

SILVESTERABEND 2013-6-7 11:56 AM

[quote]原帖由 [i]wongkakuiwin[/i] 於 2013-6-6 11:32 PM 發表 [url=http://computer.uwants.com/redirect.php?goto=findpost&pid=208279028&ptid=16211860][img]http://computer.uwants.com/images/common/back.gif[/img][/url]
唔好意思
我係window 7、開機按F8冇一個入safe mode 的option
開機長按ctrl亦無反應,應該點入safe mode呢? [/quote]

在正常模式fix checked亦可以。但fix checked時記得要關閉所有瀏覽器同程式。

wongkakuiwin 2013-6-7 08:27 PM

已完成所有動作,上傳了檔案

wongkakuiwin 2013-6-7 08:32 PM

情況依舊,分別是桌面沒有了放大鏡名叫search的icon
快捷鍵個放大鏡冇左,變左一個window唔知係咩的icon
仍然被綁架首頁

wongkakuiwin 2013-6-7 08:35 PM

[url=http://img442.imageshack.us/img442/8523/68933117.png]http://img442.imageshack.us/img442/8523/68933117.png[/url]

SILVESTERABEND 2013-6-7 09:31 PM

[quote]原帖由 [i]wongkakuiwin[/i] 於 2013-6-7 08:32 PM 發表 [url=http://computer.uwants.com/redirect.php?goto=findpost&pid=208300097&ptid=16211860][img]http://computer.uwants.com/images/common/back.gif[/img][/url]
情況依舊,分別是桌面沒有了放大鏡名叫search的icon
快捷鍵個放大鏡冇左,變左一個window唔知係咩的icon
仍然被綁架首頁 [/quote]


[color=#ff0000]去程式集[/color][color=#0000ff]移除 Chrome /Firefox (不要保留舊設定) > [color=red]重啟電腦[/color]  > 重新安裝Chrome / Firefox。[/color]

wongkakuiwin 2013-6-7 09:35 PM

但我用的是IE

wongkakuiwin 2013-6-7 09:37 PM

是否移除IE?
移除後無IE點重新download IE?

SILVESTERABEND 2013-6-8 09:08 AM

[quote]原帖由 [i]wongkakuiwin[/i] 於 2013-6-7 09:35 PM 發表 [url=http://computer.uwants.com/redirect.php?goto=findpost&pid=208302095&ptid=16211860][img]http://computer.uwants.com/images/common/back.gif[/img][/url]
但我用的是IE [/quote]


下載 [url=http://oldtimer.geekstogo.com/OTL.exe]OTL.exe[/url][color=#000000]於桌面。雙按OTL.exe > 按Run Scan > 完[/color][color=blue]成後請將OTL掃瞄報告(OTL.txt)貼上[/color][color=#000000]。
(OTL掃瞄需時較長,請耐心等候)

[/color]
頁: [1]
查看完整版本: snap.do病毒,IE icon變咗做放大鏡,個名變咗做Search