因為近日有疑似網路中毒的問題， 所以用了adwcleaner ， 一時手快，直接按第一個選項把它說要刪的東西全刪了... 以下是刪掉東西的紀錄QQ: -------------------- # AdwCleaner v6.046 - 記錄檔已建立 16/05/2017 於 10:56:31 # 已更新於 24/04/2017 由 Malwarebytes # 資料庫 : 2017-05-15.1 [伺服器] # 作業系統 : Windows 10 Pro (X64) # 使用者名稱 : USER - USER-PC # 執行自 : D:\adwcleaner\AdwCleanerPortable\adwcleaner_6.046.exe # 模式: 掃描 # 支援 : https://www.malwarebytes.com/support ***** [ 服務 ] ***** 服務已找到: iSafeKrnl 服務已找到: iSafeKrnlBoot 服務已找到: iSafeKrnlKit 服務已找到: iSafeKrnlMon 服務已找到: iSafeKrnlR3 服務已找到: iSafeNetFilter 服務已找到: iSafeService 服務已找到: WinSAPSvc 服務已找到: isafekrnl 服務已找到: isafekrnlboot 服務已找到: isafekrnlkit 服務已找到: isafekrnlmon 服務已找到: isafekrnlr3 服務已找到: isafenetfilter 服務已找到: isafeservice 服務已找到: SNARE 服務已找到: Kitty 服務已找到: SNAREA 服務已找到: BIT 服務已找到: ANSARE 服務已找到: WANARE 服務已找到: VNASRE 服務已找到: IISvr 服務已找到: NPASRE 服務已找到: CWASRE ***** [ 資料夾 ] ***** 資料夾已找到: C:\USERs\USER\SupTab 資料夾已找到: C:\USERs\USER\AppData\Local\FileViewPro 資料夾已找到: C:\USERs\USER\AppData\Local\genienext 資料夾已找到: C:\USERs\USER\AppData\Local\Mobogenie 資料夾已找到: C:\USERs\USER\AppData\Local\Rising 資料夾已找到: C:\USERs\USER\AppData\Local\SNAREA 資料夾已找到: C:\USERs\USER\AppData\Local\ANSARE 資料夾已找到: C:\USERs\USER\AppData\Local\WANARE 資料夾已找到: C:\USERs\USER\AppData\Local\VNASRE 資料夾已找到: C:\USERs\USER\AppData\Local\Dayglad 資料夾已找到: C:\USERs\USER\AppData\Local\background_fault 資料夾已找到: C:\USERs\USER\AppData\Local\NPASRE 資料夾已找到: C:\USERs\USER\AppData\Local\CWASRE 資料夾已找到: C:\USERs\USER\AppData\Roaming\Elex-tech 資料夾已找到: C:\USERs\USER\AppData\Roaming\WinZipper 資料夾已找到: C:\USERs\USER\AppData\Roaming\Tencent 資料夾已找到: C:\USERs\USER\AppData\Roaming\WinSAPSvc 資料夾已找到: C:\USERs\USER\AppData\Roaming\Dayglad 資料夾已找到: C:\USERs\USER\Documents\Mobogenie 資料夾已找到: C:\Program Files\Common Files\Tencent 資料夾已找到: C:\USERs\USER\AppData\Local\VirtualStore\Program Files (x86)\Tencent 資料夾已找到: C:\ProgramData\IHProtectUpDate 資料夾已找到: C:\ProgramData\QvodPlayer 資料夾已找到: C:\ProgramData\Rising 資料夾已找到: C:\ProgramData\Tencent 資料夾已找到: C:\ProgramData\Application Data\IHProtectUpDate 資料夾已找到: C:\ProgramData\Application Data\QvodPlayer 資料夾已找到: C:\ProgramData\Application Data\Rising 資料夾已找到: C:\ProgramData\Application Data\Tencent 資料夾已找到: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper 資料夾已找到: C:\Program Files (x86)\Elex-tech 資料夾已找到: C:\Program Files (x86)\QvodPlayer 資料夾已找到: C:\Program Files (x86)\Rising 資料夾已找到: C:\Program Files (x86)\Tencent 資料夾已找到: C:\Program Files (x86)\Dayglad 資料夾已找到: C:\Program Files (x86)\Common Files\Tencent 資料夾已找到: C:\Program Files (x86)\Firefox 資料夾已找到: C:\Users\USER\AppData\Roaming\Firefox 資料夾已找到: C:\Users\USER\AppData\Local\Firefox 資料夾已找到: C:\Users\USER\AppData\Local\SNARE 資料夾已找到: C:\Users\USER\AppData\Local\Kitty 資料夾已找到: C:\ProgramData\BIT 資料夾已找到: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\extensions\default_newtabff@gmail.com 資料夾已找到: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\extensions\arthurj8283@gmail.com 資料夾已找到: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\extensions\arthurj8283@gmail.com 資料夾已找到: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\extensions\arthurj8283@gmail.com 資料夾已找到: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\extensions\arthurj8283@gmail.com ***** [ 檔案 ] ***** 檔案已找到: C:\USERs\USER\daemonprocess.txt 檔案已找到: C:\WINDOWS\SysNative\log\iSafeKrnlCall.log 檔案已找到: C:\WINDOWS\SysNative\roboot64.exe 檔案已找到: C:\WINDOWS\SysNative\drivers\iSafeKrnlBoot.sys 檔案已找到: C:\WINDOWS\SysNative\drivers\iSafeNetFilter.sys 檔案已找到: C:\Users\Public\Documents\temp.dat 檔案已找到: C:\Users\Public\Documents\report.dat 檔案已找到: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\extensions\yahooprotected@gmail.com.xpi 檔案已找到: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\searchplugins\nice.xml 檔案已找到: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\searchplugins\luck.xml 檔案已找到: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\searchplugins\ourluckysites.xml ***** [ DLL ] ***** 未找到惡意 DLL。 ***** [ WMI ] ***** 未找到惡意機碼。 ***** [ 捷徑 ] ***** 已感染捷徑: C:\USERs\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk ( hxxp://www.ourluckysites.com/?type=sc&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw 已感染捷徑: C:\USERs\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\I1ternHt EVplorir.lnk ( hxxp://www.ourluckysites.com/?type=sc&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che 已感染捷徑: C:\USERs\USER\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk ( hxxp://www.ourluckysites.com/?type=sc&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct ***** [ 排程工作 ] ***** 排程工作已找到: LaunchSignup 排程工作已找到: Milimili 排程工作已找到: launchsignup 排程工作已找到: Windows-PG ***** [ 登錄檔 ] ***** 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.001 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.7z 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.arj 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.bz2 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.bzip2 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.cab 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.cpio 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.deb 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.dmg 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.fat 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.gz 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.gzip 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.hfs 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.iso 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.lha 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.lzh 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.lzma 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.ntfs 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.rar 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.rpm 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.squashfs 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.swm 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.tar 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.taz 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.tbz 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.tbz2 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.tgz 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.tpz 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.txz 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.vhd 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.wim 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.xar 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.xz 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.z 機碼已找到: HKLM\SOFTWARE\Classes\WinZipper.zip 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\WindowsMangerProtect 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\WindowsMangerProtect 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\winzipersvc 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\winzipersvc 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\PicexaService 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\PicexaService 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\windowsmangerprotect 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\windowsmangerprotect 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\SNARE 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\SNARE 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\SNAREA 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\SNAREA 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\ANSARE 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\ANSARE 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\WANARE 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\WANARE 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\VNASRE 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\VNASRE 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\NPASRE 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\NPASRE 機碼已找到: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\CWASRE 機碼已找到: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\CWASRE 機碼已找到: HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} 機碼已找到: HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52} 機碼已找到: HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B} 機碼已找到: HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD} 機碼已找到: HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A} 機碼已找到: HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB} 機碼已找到: HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5} 登錄已找到: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}] 機碼已找到: HKU\.DEFAULT\Software\Elex-tech 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\InstallCore 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Mozilla\Extends 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\simplytech 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\TNT2 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\V9 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\QvodPlayer 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\SIMPLYTECH 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D01A33E2-0A34-4659-82AA-8A90C51C0D21} 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\SEARCHPROTECT 機碼已找到: HKU\S-1-5-18\Software\Elex-tech 機碼已找到: HKCU\Software\InstallCore 機碼已找到: HKCU\Software\Mozilla\Extends 機碼已找到: HKCU\Software\simplytech 機碼已找到: HKCU\Software\TNT2 機碼已找到: HKCU\Software\V9 機碼已找到: HKCU\Software\QvodPlayer 機碼已找到: HKCU\Software\SIMPLYTECH 機碼已找到: HKLM\SOFTWARE\delta-homesSoftware 機碼已找到: HKLM\SOFTWARE\Elex-tech 機碼已找到: HKLM\SOFTWARE\FFPluginHp 機碼已找到: HKLM\SOFTWARE\hdcode 機碼已找到: HKLM\SOFTWARE\IHProtect 機碼已找到: HKLM\SOFTWARE\PicexaSvc 機碼已找到: HKLM\SOFTWARE\sweet-pageSoftware 機碼已找到: HKLM\SOFTWARE\V9 機碼已找到: HKLM\SOFTWARE\winzipersvc 機碼已找到: HKLM\SOFTWARE\ScreenShot 機碼已找到: HKLM\SOFTWARE\ourluckysitesSoftware 機碼已找到: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D01A33E2-0A34-4659-82AA-8A90C51C0D21} 機碼已找到: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP 機碼已找到: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar 機碼已找到: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey 機碼已找到: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect 機碼已找到: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com 機碼已找到: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance 機碼已找到: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SEARCHPROTECT 機碼已找到: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe 機碼已找到: [x64] HKCU\Software\InstallCore 機碼已找到: [x64] HKCU\Software\Mozilla\Extends 機碼已找到: [x64] HKCU\Software\simplytech 機碼已找到: [x64] HKCU\Software\TNT2 機碼已找到: [x64] HKCU\Software\V9 機碼已找到: [x64] HKCU\Software\QvodPlayer 機碼已找到: [x64] HKCU\Software\SIMPLYTECH 機碼已找到: [x64] HKLM\SOFTWARE\InterSect Alliance 機碼已找到: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D01A33E2-0A34-4659-82AA-8A90C51C0D21} 機碼已找到: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP 機碼已找到: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar 機碼已找到: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey 機碼已找到: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect 機碼已找到: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com 機碼已找到: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance 機碼已找到: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SEARCHPROTECT 資料已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://search.delta-homes.com/web/?type=ds&ts=1426769253&from=wpm031932&uid=WDCXWD10EZEX-08 資料已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t 資料已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://search.delta-homes.com/web/?type=ds&ts=1426769253&from=wpm031932&uid=WDCXWD10 資料已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3m 資料已找到: HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://search.delta-homes.com/web/?type=ds&ts=1426769253&from=wpm031932&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F107078970789&q={searchTerms} 資料已找到: HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10EZEX-08M2N 資料已找到: HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://search.delta-homes.com/web/?type=ds&ts=1426769253&from=wpm031932&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F107078970789&q={searchTer 資料已找到: HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10EZEX-08M2NA0_WD- 資料已找到: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10EZEX-08M2N 資料已找到: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.ourluckysites.com/search/?type=ds&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10E 資料已找到: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.ourluckysites.com/search/?type=ds&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10EZEX-08M 資料已找到: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10EZEX-08M2NA0_WD- 資料已找到: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://search.delta-homes.com/web/?type=ds&ts=1426769253&from=wpm031932&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F107078970789&q={searchTerms} 資料已找到: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10EZEX-08M 資料已找到: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://search.delta-homes.com/web/?type=ds&ts=1426769253&from=wpm031932&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F107078970789&q={searchT 資料已找到: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10EZEX-08M2NA0_W 資料已找到: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10EZEX-08M 資料已找到: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.ourluckysites.com/?type=hp&ts=1493999810&z=5acd83534584b96636c6b8dgezbtdc6t2tct3mdtcw&from=che0812&uid=WDCXWD10EZEX-08M2NA0_W 資料已找到: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.sweet-page.com/web/?type=ds&ts=1419169890&from=cor&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F107078970789&q={searchTerms} 資料已找到: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.sweet-page.com/web/?type=ds&ts=1419169890&from=cor&uid=WDCXWD10EZEX-08M2NA0_WD-WMC3F107078970789&q={searchTerms} 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} 資料已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] - 機碼已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C} 機碼已找到: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} 資料已找到: HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] - 機碼已找到: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C} 機碼已找到: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} 資料已找到: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope] - 機碼已找到: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} 資料已找到: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] - 機碼已找到: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C} 資料已找到: HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [] - "c:\program files\internet explorer\iexplore.exe" hxxp://www.ourluckysites.com/?type=sc&ts=1494853244&z=8498990a91e6593b1f9 資料已找到: HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command [] - "c:\program files (x86)\google\chrome\application\chrome.exe" hxxp://www.ourluckysites.com/?type=sc&ts=1494853244&z=849899 資料已找到: [x64] HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command [] - "c:\program files (x86)\google\chrome\application\chrome.exe" hxxp://www.ourluckysites.com/?type=sc&ts=1494853244&z=8498 資料已找到: HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command [] - "c:\program files (x86)\mozilla firefox\firefox.exe" hxxp://www.ourluckysites.com/?type=sc&ts=1494853244&z=8498990a91e6593b1 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\adnetworkperforma 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\mp.weixin.qq.com 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\ourluckysites.com 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\qq.com 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\v.qq.com 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.adnetworkperf 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.ourluckysites 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\adnetworkperformance 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\mp.weixin.qq.com 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ourluckysites.com 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\qq.com 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\v.qq.com 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.adnetworkperform 機碼已找到: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.ourluckysites.co 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\adnetworkperfor 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\mp.weixin.qq.co 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\ourluckysites.c 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\qq.com 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\v.qq.com 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.adnetworkpe 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.ourluckysit 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\adnetworkperforman 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\mp.weixin.qq.com 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\ourluckysites.com 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\qq.com 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\v.qq.com 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.adnetworkperfo 機碼已找到: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.ourluckysites. 機碼已找到: [x64] HKLM\SOFTWARE\Microsoft\Shared Tools\MsConfig\StartupReg\QvodTerminal 登錄已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Run [background_fault] 登錄已找到: HKU\S-1-5-21-2907024254-2848664714-3585611830-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [background_fault] 登錄已找到: HKCU\Software\Microsoft\Windows\CurrentVersion\Run [background_fault] 登錄已找到: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Run [background_fault] 機碼已找到: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd 登錄已找到: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost [WinSAPSvc] 機碼已找到: HKCU\SOFTWARE\Classes\ChromeHTML 機碼已找到: HKCU\SOFTWARE\Clients\StartMenuInternet\ChromeHTML 登錄已找到: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost [Kitty] 登錄已找到: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost [BIT] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_searchff@gmail.com] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [sweetsearch@gmail.com] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [arthurj8283@gmail.com] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [arthurj8283@gmail.com] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_searchff@gmail.com] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [sweetsearch@gmail.com] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [arthurj8283@gmail.com] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_searchff@gmail.com] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [sweetsearch@gmail.com] 登錄已找到: HKLM\SOFTWARE\Mozilla\Firefox\Extensions [arthurj8283@gmail.com] ***** [ 網頁瀏覽器 ] ***** Firefox 已找到: [C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\prefs.js] - "browser.newtab.url" - "chrome://quick_start/content/index.html" Firefox 已找到: [C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\prefs.js] - "browser.search.defaultenginename" - "nice" Firefox 已找到: [C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\prefs.js] - "browser.search.order.1" - "nice" Firefox 已找到: [C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\prefs.js] - "browser.search.searchengine.iconURL" - "hxxp://www.luckysearch123.com/favicon.ico?t=1" Firefox 已找到: [C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\prefs.js] - "browser.search.searchengine.url" - "hxxp://www.luckysearch123.com/search.php?type=ds&ts=1494490340&from=c8350511&u Firefox 已找到: [C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\prefs.js] - "browser.search.selectedEngine" - "nice" Firefox 已找到: [C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\prefs.js] - "browser.startup.homepage" - "hxxp://www.nicesearches.com?type=hp&ts=1459156390&from=10637238&uid=wdcxwd10ezex-08m2 Firefox 已找到: [C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\prefs.js] - "extensions.quick_start.enable_search1" - false Firefox 已找到: [C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\gdi9cssz.default\prefs.js] - "extensions.quick_start.sd.closeWindowWithLastTab_prev_state" - false Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - v9_ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - v9__ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - v9___ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - v9____ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - v9 Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - nicesearches.com Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - nice_ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - nice__ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - nice___ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - nice____ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - nice_____ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - nice______ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - nice Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - luckysearch123.com Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - luck_ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - luck__ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - luck___ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - luck____ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - luck_____ Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Web data] - luck Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - hxxp://www.nicesearches.com?type=hp&ts=1462263787&from=86490503&uid=wdcxwd10ezex-08m2na0_wd-wmc3f107078970789&z=839b4b Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - hxxp://search.delta-homes.com/webfavicon.ico Chromium 已找到: [C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences ] - hxxp://www.nicesearches.com?type=hp&ts=1462263787&from=86490503&uid=wdcxwd10ezex-08m2na0_wd-wmc3f107078970789&z=839b4 ************************* C:\AdwCleaner\AdwCleaner[S0].txt - [34198 位元組] - [16/05/2017 10:56:31] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [34276 位元組] ########## ------------- 感謝各位大大觀賞 刪完之後， google chrome無法開了，火狐也無法開了。 疑似有刪除不完整的狀況。 所以我按了系統還原，想還原到clean之前的狀態， 沒想到也不斷還原失敗， 分別有0x800070091跟0x80070005的錯誤訊息， 試過一些方法都沒用。 想直接重灌chrome， 但下載下來的chrome安裝檔: ChromeSetup 跟 ChromeStandaloneSetup64 都是點兩下之後， 滑鼠稍微跑一下(藍色圓圈)， 就跟沒事發生一樣，連錯誤訊息也沒有...。 在"軟體安裝與解除"那裏，已經沒有chrome的痕跡了 也試過用ccleaner修復登錄檔等問題， 也試過關服毒軟體再灌， 也試過去program file把google的資料夾刪掉再灌， 都沒用。 這該如何解決呢... 跪求高手大大解救， 將奉上500P 幣作為謝酬， 拜託了QQ --

※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 118.233.157.118 ※ 文章網址: https://webptt.com/m.aspx?n=bbs/AntiVirus/M.1494935683.A.1E4.html 不知道耶.. ※ 編輯: jodawa (118.233.157.118), 05/16/2017 19:59:21 ※ jodawa:轉錄至看板 Browsers 05/16 20:01 謝謝大大，可是我用了那個工具，它說找不到任何chrome的元件，然後跳出了 0xc0000005的錯誤訊息... 我現在發現連PDF檔也無法開啟了...(點了無反應)，應該是adobe程式也損壞， 天啊我好後悔去按那個adwcleaner... ※ 編輯: jodawa (118.233.157.118), 05/16/2017 21:49:43 ※ 編輯: jodawa (118.233.157.118), 05/16/2017 21:54:24 我目前的狀況似乎是，chrome不能開也無法重灌，然後adobe acrobat無法正常啟動。 chrome就認了，arcrobat也壞掉有點難理解，畢竟我在自己刪除的檔案也沒看到 acrobat的樣子。另外它似乎連還原點也視做無用檔案刪掉了，可能因此還原失敗... 我現在用Recuva救救看，如果不行就只好用win10的復原了 QQ ※ 編輯: jodawa (118.233.157.118), 05/17/2017 01:33:13