1   1  /  1  页   跳转

[求助] 啊~邪恶的7322(已解决)

啊~邪恶的7322(已解决)

之前浏览器被劫持在论坛里下了个RavFixIE,KO!

重启之后发现打开所有浏览器主页均为www.7322.com(重启之前设置为空白)(电脑里有3种浏览器,IE、世界之窗、腾迅TT)。

查浏览器目标后面均为.exe http://www.7322.com 任何浏览器都是这样(重启之前没有)。

桌面每种浏览器EXE启动项都无缘无故多出2个(一个原来的,一个新冒出来的,重启之前删了) 。

求助解决办法!

用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler 4.0)
最后编辑不懂就要问 最后编辑于 2010-02-09 14:19:54
分享到:
gototop
 

回复:啊~邪恶的7322

********** 日志开始 **********

[键]HKEY_CLASSES_ROOT\CLSID\{0002DF01-0000-0000-C000-000000000046}\LOCALSERVER32
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe

[键]HKEY_CLASSES_ROOT\CLSID\{09860117-AE68-60E5-9DBE-C2C2388A068A}\SHELL\OPEN(&O)\COMMAND
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe http://www.6781.com

[键]HKEY_CLASSES_ROOT\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1

[键]HKEY_CLASSES_ROOT\CLSID\{3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1

[键]HKEY_CLASSES_ROOT\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\HTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1

[键]HKEY_CLASSES_ROOT\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\MHTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,22

[键]HKEY_CLASSES_ROOT\CLSID\{65014010-9F62-11D1-A651-00600811D5CE}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1

[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE\COMMAND
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe" http://www.7322.com

[键]HKEY_CLASSES_ROOT\CLSID\{AE24FDAE-03C6-11D1-8B76-0080C744F389}\TOOLBOXBITMAP32
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1

[键]HKEY_CLASSES_ROOT\CLSID\{FBF23B42-E3F0-101B-8488-00AA003E56F8}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]"%programfiles%\internet explorer\iexplore.exe",-32528

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{1F4DE370-D627-11D1-BA4F-00A0C91EEDBA}
[值]@
[类型]REG_SZ
[内容]computer search results folder

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{450D8FBA-AD25-11D0-98A8-0800361B1103}
[值]@
[类型]REG_SZ
[内容]空

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{450D8FBA-AD25-11D0-98A8-0800361B1103}
[值]REMOVAL MESSAGE
[类型]REG_SZ
[内容]@mydocs.dll,-900

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{645FF040-5081-101B-9F08-00AA002F954E}
[值]@
[类型]REG_SZ
[内容]recycle bin

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{E17D4FC0-5564-11D1-83F2-00A0C90DC849}
[值]@
[类型]REG_SZ
[内容]search results folder

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\CLASSICSTARTMENU
[值]{871C5380-42A0-1069-A2EA-08002B30309D}.DEFAULT
[类型]REG_SZ
[内容]1

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\CLASSICSTARTMENU
[值]{871C5380-42A0-1069-A2EA-08002B30309D}
[类型]REG_DWORD
[内容]0x00000000

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{20D04FE0-3AEA-1069-A2D8-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{450D8FBA-AD25-11D0-98A8-0800361B1103}
[类型]REG_DWORD
[内容]0x00000001

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{208D2C60-3AEA-1069-A2D7-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001

[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{871C5380-42A0-1069-A2EA-08002B30309D}
[类型]REG_DWORD
[内容]0x00000000

[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\CLASSICSTARTMENU
[值]{871C5380-42A0-1069-A2EA-08002B30309D}
[类型]REG_DWORD
[内容]0x00000000

[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\CLASSICSTARTMENU
[值]{208D2C60-3AEA-1069-A2D7-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001

[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{450D8FBA-AD25-11D0-98A8-0800361B1103}
[类型]REG_DWORD
[内容]0x00000000

[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{20D04FE0-3AEA-1069-A2D8-08002B30309D}
[类型]REG_DWORD
[内容]0x00000000

[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{208D2C60-3AEA-1069-A2D7-08002B30309D}
[类型]REG_DWORD
[内容]0x00000001

[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\HIDEDESKTOPICONS\NEWSTARTPANEL
[值]{871C5380-42A0-1069-A2EA-08002B30309D}
[类型]REG_DWORD
[内容]0x00000000
gototop
 

回复:啊~邪恶的7322

有问题啊 高手教教怎么解决啊!!
gototop
 

回复:啊~邪恶的7322

用这么夸张扫描System Repair Engineer日志么
gototop
 

回复 9F byxxdrls 的帖子

已经删 重启后扫描SREngLOG附上
gototop
 

回复: 啊~邪恶的7322(未解决)

SREngLOG日志

附件附件:

文件名:SREngLOG.log
下载次数:116
文件类型:application/octet-stream
文件大小:
上传时间:2010-2-9 14:13:06
描述:log

gototop
 

回复:啊~邪恶的7322(未解决)

正常了 下了N种工具修复,然后按照9楼的做了 谢谢
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT