瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 IE被www.2345.com篡改~!求高手帮忙!!~天月进下~!

1   1  /  1  页   跳转

[求助] IE被www.2345.com篡改~!求高手帮忙!!~天月进下~!

IE被www.2345.com篡改~!求高手帮忙!!~天月进下~!

我今天早上电脑还是好的,就上了奇侠传的官网,然后发现IE主页被修改了http://www.2345.com/?525  用了很多方法,卡卡,1188,狗皮膏,等等都用了 但是问题没解决 谁能帮忙看下~!不知道以下内容是否有帮助
********** 日志开始 **********
[键]HKEY_CLASSES_ROOT\CLSID\{0002DF01-0000-0000-C000-000000000046}\LOCALSERVER32
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe"
[键]HKEY_CLASSES_ROOT\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_CLASSES_ROOT\CLSID\{3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_CLASSES_ROOT\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\HTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_CLASSES_ROOT\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\MHTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_CLASSES_ROOT\CLSID\{65014010-9F62-11D1-A651-00600811D5CE}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE
[值]COMMAND
[类型]REG_SZ
[内容]%programfiles%\internet explorer\iexplore.exe
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE\COMMAND
[值]@
[类型]REG_EXPAND_SZ
[内容]%programfiles%\internet explorer\iexplore.exe
[键]HKEY_CLASSES_ROOT\CLSID\{AE24FDAE-03C6-11D1-8B76-0080C744F389}\TOOLBOXBITMAP32
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_CLASSES_ROOT\CLSID\{FBF23B42-E3F0-101B-8488-00AA003E56F8}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]"%programfiles%\internet explorer\iexplore.exe",-32528
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{0002DF01-0000-0000-C000-000000000046}\LOCALSERVER32
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe"
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\HTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\MHTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{65014010-9F62-11D1-A651-00600811D5CE}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE
[值]COMMAND
[类型]REG_SZ
[内容]%programfiles%\internet explorer\iexplore.exe
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE\COMMAND
[值]@
[类型]REG_EXPAND_SZ
[内容]%programfiles%\internet explorer\iexplore.exe
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{AE24FDAE-03C6-11D1-8B76-0080C744F389}\TOOLBOXBITMAP32
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{FBF23B42-E3F0-101B-8488-00AA003E56F8}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]"%programfiles%\internet explorer\iexplore.exe",-32528
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{1F4DE370-D627-11D1-BA4F-00A0C91EEDBA}
[值]@
[类型]REG_SZ
[内容]computer search results folder
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{450D8FBA-AD25-11D0-98A8-0800361B1103}
[值]@
[类型]REG_SZ
[内容]空
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{450D8FBA-AD25-11D0-98A8-0800361B1103}
[值]REMOVAL MESSAGE
[类型]REG_SZ
[内容]@mydocs.dll,-900
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{645FF040-5081-101B-9F08-00AA002F954E}
[值]@
[类型]REG_SZ
[内容]recycle bin
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{E17D4FC0-5564-11D1-83F2-00A0C90DC849}
[值]@
[类型]REG_SZ
[内容]search results folder
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\CLASSICSTARTMENU
[值]{871C5380-42A0-1069-A2EA-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{20D04FE0-3AEA-1069-A2D8-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{450D8FBA-AD25-11D0-98A8-0800361B1103}
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{208D2C60-3AEA-1069-A2D7-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{871C5380-42A0-1069-A2EA-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\CLASSICSTARTMENU
[值]{871C5380-42A0-1069-A2EA-08002B30309D}
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\CLASSICSTARTMENU
[值]{208D2C60-3AEA-1069-A2D7-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\CLASSICSTARTMENU
[值]{20D04FE0-3AEA-1069-A2D8-08002B30309D}
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\CLASSICSTARTMENU
[值]{450D8FBA-AD25-11D0-98A8-0800361B1103}
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{871C5380-42A0-1069-A2EA-08002B30309D}
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{208D2C60-3AEA-1069-A2D7-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{20D04FE0-3AEA-1069-A2D8-08002B30309D}
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{450D8FBA-AD25-11D0-98A8-0800361B1103}
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_CLASSES_ROOT\HTTP\SHELL\OPEN\COMMAND
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe" -nohome
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]START PAGE
[类型]REG_SZ
[内容]http://www.sina.com.cn/
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]DEFAULT_PAGE_URL
[类型]REG_SZ
[内容]about:blank
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]FIRSTHOMEPAGE
[类型]REG_SZ
[内容]about:blank
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]SEARCH PAGE
[类型]REG_SZ
[内容]http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]FIRSTHOMEPAGE
[类型]REG_SZ
[内容]about:blank
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]LOCAL PAGE
[类型]REG_EXPAND_SZ
[内容]%systemroot%\system32\blank.htm
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]SEARCH PAGE
[类型]REG_SZ
[内容]http://www.sina.com.cn/
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]START PAGE
[类型]REG_SZ
[内容]http://www.microsoft.com/isapi/redir.dll?prd={sub_prd}&clcid={sub_clsid}&pver={sub_pver}&ar=home
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe"
[键]HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER
[值]PENDINGFILERENAMEOPERATIONS
[类型]REG_MULTI_SZ
[内容]\??\c:\docume~1\admini~1\locals~1\temp\~nsu.tmp\au_.exe
     
      \??\c:\docume~1\admini~1\locals~1\temp\~nsu.tmp
     
     
     
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\windows\system32\shell32.dll,17
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\windows\system32\mydocs.dll,0
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\windows\system32\shell32.dll,31
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DEFAULTICON
[值]FULL
[类型]REG_EXPAND_SZ
[内容]c:\windows\system32\shell32.dll,32
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DEFAULTICON
[值]EMPTY
[类型]REG_EXPAND_SZ
[内容]c:\windows\system32\shell32.dll,31
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER
[值]ATTRIBUTES
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH
[值]SEARCHASSISTANT
[类型]REG_SZ
[内容]http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH
[值]CUSTOMIZESEARCH
[类型]REG_SZ
[内容]http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchcust.htm
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
[值]NOINTERNETICON
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
[值]NOINTERNETICON
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
[值]HIDDEN
[类型]REG_DWORD
[内容]0x00000002
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
[值]HIDEFILEEXT
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
[值]SUPERHIDDEN
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
[值]SHOWSUPERHIDDEN
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_CLASSES_ROOT\.LNK
[值]@
[类型]REG_SZ
[内容]lnkfile
[键]HKEY_CLASSES_ROOT\.LNK\SHELLEX\{000214EE-0000-0000-C000-000000000046}
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_CLASSES_ROOT\.LNK\SHELLEX\{000214F9-0000-0000-C000-000000000046}
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_CLASSES_ROOT\.LNK\SHELLEX\{00021500-0000-0000-C000-000000000046}
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_CLASSES_ROOT\.LNK\SHELLEX\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_CLASSES_ROOT\.LNK\SHELLNEW
[值]COMMAND
[类型]REG_SZ
[内容]rundll32.exe appwiz.cpl,newlinkhere %1
[键]HKEY_CLASSES_ROOT\LNKFILE
[值]@
[类型]REG_SZ
[内容]快捷方式
[键]HKEY_CLASSES_ROOT\LNKFILE
[值]EDITFLAGS
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_CLASSES_ROOT\LNKFILE
[值]ISSHORTCUT
[类型]REG_SZ
[内容]空
[键]HKEY_CLASSES_ROOT\LNKFILE
[值]NEVERSHOWEXT
[类型]REG_SZ
[内容]空
[键]HKEY_CLASSES_ROOT\LNKFILE\CLSID
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_CLASSES_ROOT\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\OFFLINE FILES
[值]@
[类型]REG_SZ
[内容]{750fdf0e-2a26-11d1-a3ea-080036587f03}
[键]HKEY_CLASSES_ROOT\LNKFILE\SHELLEX\DROPHANDLER
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_CLASSES_ROOT\LNKFILE\SHELLEX\ICONHANDLER
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_CLASSES_ROOT\LNKFILE\SHELLEX\PROPERTYSHEETHANDLERS\SHIMLAYER PROPERTY PAGE
[值]@
[类型]REG_SZ
[内容]{513d916f-2a8e-4f51-aeab-0cbc76fb1af8}
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.LNK
[值]@
[类型]REG_SZ
[内容]lnkfile
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.LNK\SHELLEX\{000214EE-0000-0000-C000-000000000046}
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.LNK\SHELLEX\{000214F9-0000-0000-C000-000000000046}
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.LNK\SHELLEX\{00021500-0000-0000-C000-000000000046}
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.LNK\SHELLEX\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.LNK\SHELLNEW
[值]COMMAND
[类型]REG_SZ
[内容]rundll32.exe appwiz.cpl,newlinkhere %1
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE
[值]@
[类型]REG_SZ
[内容]快捷方式
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE
[值]EDITFLAGS
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE
[值]ISSHORTCUT
[类型]REG_SZ
[内容]空
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE
[值]NEVERSHOWEXT
[类型]REG_SZ
[内容]空
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE\CLSID
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\OFFLINE FILES
[值]@
[类型]REG_SZ
[内容]{750fdf0e-2a26-11d1-a3ea-080036587f03}
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE\SHELLEX\DROPHANDLER
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE\SHELLEX\ICONHANDLER
[值]@
[类型]REG_SZ
[内容]{00021401-0000-0000-c000-000000000046}
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE\SHELLEX\PROPERTYSHEETHANDLERS\SHIMLAYER PROPERTY PAGE
[值]@
[类型]REG_SZ
[内容]{513d916f-2a8e-4f51-aeab-0cbc76fb1af8}
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}
[值]INFOTIP
[类型]REG_EXPAND_SZ
[内容]@shdoclc.dll,-881
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}
[值]LOCALIZEDSTRING
[类型]REG_EXPAND_SZ
[内容]@shdoclc.dll,-880
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]shdoclc.dll,-190
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\windows\system32\shdocvw.dll
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32
[值]THREADINGMODEL
[类型]REG_SZ
[内容]apartment
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL
[值]@
[类型]REG_SZ
[内容]openhomepage
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE
[值]@
[类型]REG_SZ
[内容]打开主页(&h)
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE
[值]MUIVERB
[类型]REG_SZ
[内容]@shdoclc.dll,-10241
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE
[值]COMMAND
[类型]REG_SZ
[内容]%programfiles%\internet explorer\iexplore.exe
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE\COMMAND
[值]@
[类型]REG_EXPAND_SZ
[内容]%programfiles%\internet explorer\iexplore.exe
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER
[值]ATTRIBUTES
[类型]REG_DWORD
[内容]0x00000018
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER
[值]ATTRIBUTES
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}
[值]INFOTIP
[类型]REG_EXPAND_SZ
[内容]@shdoclc.dll,-881
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}
[值]LOCALIZEDSTRING
[类型]REG_EXPAND_SZ
[内容]@shdoclc.dll,-880
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]shdoclc.dll,-190
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\windows\system32\shdocvw.dll
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32
[值]THREADINGMODEL
[类型]REG_SZ
[内容]apartment
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL
[值]@
[类型]REG_SZ
[内容]openhomepage
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE
[值]@
[类型]REG_SZ
[内容]打开主页(&h)
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE
[值]MUIVERB
[类型]REG_SZ
[内容]@shdoclc.dll,-10241
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE
[值]COMMAND
[类型]REG_SZ
[内容]%programfiles%\internet explorer\iexplore.exe
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE\COMMAND
[值]@
[类型]REG_EXPAND_SZ
[内容]%programfiles%\internet explorer\iexplore.exe
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER
[值]ATTRIBUTES
[类型]REG_DWORD
[内容]0x00000018
[键]HKEY_USERS\S-1-5-21-1708537768-2049760794-682003330-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER
[值]ATTRIBUTES
[类型]REG_DWORD
[内容]0x00000000




http://bbs.ikaka.com/showtopic-8685996.aspx这个网址上的方法都用了  都不好用



附件已上传
用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

附件附件:

文件名:SREngLOG.log
下载次数:152
文件类型:application/octet-stream
文件大小:
上传时间:2010-5-19 19:40:40
描述:log

最后编辑梦的叹息 最后编辑于 2010-05-19 22:39:41
分享到:
gototop
 

回复:IE被www.2345.com篡改~!求高手帮忙!!

没人能帮楼主看,一般人也看不懂。
IE被劫持问题:http://bbs.ikaka.com/showtopic-8685996.aspx
参考一下吧
gototop
 

回复:IE被www.2345.com篡改~!求高手帮忙!!

不从桌面上打开IE浏览器,直接去浏览器主程序位置去打开浏览器主程序C:\Program Files\Internet Explorer\IEXPLORE.EXE看情况怎样。


用SRENG工具扫描系统日志发这论坛来,建议日志文件以附件形式发来

下载:http://www.kztechs.com/sreng/download.html

扫描操作图
百年以后,你的墓碑旁 刻着的名字不是我
gototop
 

回复:IE被www.2345.com篡改~!求高手帮忙!!

这里下载费尔木马强力清除助手,点选“抑制文件再生”删除下面文件。
附件: 费 尔.rar(内附说明)(右键选择“目标另存为”下载)本链接不支持迅雷等下载工具下载

删除:
C:\WINDOWS\system32\xxfix1.dll
C:\WINDOWS\system32\xfbho1.dll

不论删除结果如何,继续下面操作

—————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》Win32服务应用程序》里面找下面项删除,或将启动类型改为“Disabled”
==================================
驱动程序
[BDProtect System for EastFantasy / BDProtect][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\bdshldrv.sys><N/A>

—————————————————————————————
在扫日志的SRENG工具》系统修复》浏览器加载项》里面找下面删除
==================================
浏览器加载项
[System Fix]
  {C0E5D272-A352-4073-8DF8-FDA2150D8427} <C:\WINDOWS\system32\xxfix1.dll, EMC>
[fixbho1.FixBHO514]
  {767758F9-09EC-44F8-B29D-5E696D08AB6A} <C:\WINDOWS\system32\xfbho1.dll, FIR>
[System Fix]
  {C0E5D272-A352-4073-8DF8-FDA2150D8427} <C:\WINDOWS\system32\xxfix1.dll, EMC>

这个不知道是什么软件???
F:\XMedia\XMediaSystem.dll
百年以后,你的墓碑旁 刻着的名字不是我
gototop
 

回复:IE被www.2345.com篡改~!求高手帮忙!!

哈哈 谢谢~!!!但是还有个小问题就是我在IE上点右键发现少了个删除的选项~!!!
gototop
 

回复:IE被www.2345.com篡改~!求高手帮忙!!

那我不知道了
百年以后,你的墓碑旁 刻着的名字不是我
gototop
 

回复:IE被www.2345.com篡改~!求高手帮忙!!

天月~~~~在问下!是不是IE被篡改城别的也能用这个方法修复呢
gototop
 

回复 7F 梦的叹息 的帖子

IE被篡改的原因成千上万种,这方法仅针对此单一情况,不能用于其他的。
百年以后,你的墓碑旁 刻着的名字不是我
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT