IE中毒注册表修改
嘻现在流⾏的桌⾯两个IE或者说是双IE的原理差不多出来了，
那病毒先在：HKEY_CLASSES_ROOT\CLSID\创建⼀个注册项
然后再到这⾥：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Desktop\NameSpace
创建⼀个对应的项，改变权限，使得⽤户只有读取的权限，没有控制的权限。
完了之后，将正常的IE图标隐藏。
知道原理之后，解决的步骤应该是：
展开这⾥
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer \Desktop\NameSpace
到除了正常项以外的项，然后检查他们创建的注册表项的权限，将权限修改为完全控制，然后删除掉他们的项（删除之前，先导出备份⼀份），然后再回到这⾥：HKEY_CLASSES_ROOT\CLSID\搜索他们创建的类项：⽰例：
到之后删除掉，基本上桌⾯的虚假IE就可以删除或者是变成怪物了。
下⾯提供⼀些正常的系统注册表项，和测试的病毒创建的注册表项，供⼤家参考对⽐，出虚假的项。
桌⾯正常IE注册表导出:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\HideDesktopIcons]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\HideDesktopIcons\ClassicStartMenu] "{871C5380-42A0-1069-A2EA-08002B30309D}.default"="0"申请google账号注册
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\HideDesktopIcons\NewStartPanel] "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=dword:00000001
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"=dword:00000001
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"=dword:00000001
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000000
正常的IE桌⾯图标导出:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}]
@="Computer Search Results Folder"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace\{450D8FBA-AD25-11D0-98A8-0800361B1103}]
倦的组词和拼音@=""
神话的歌曲"Removal Message"="@mydocs.dll,-900"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E}]
@="Recycle Bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}]
@="Search Results Folder"
关联⼀下
吧:www.doczj/doc/63616d4afe4733687e21aa81.html /znhygsd/blog/item/48cab600fa8b338de850cd12.htm l Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}]
"InfoTip"=hex(2):40,00,73,00,68,00,64,00,6f,00,63,00,6c,00,63,00,2e,0 0,64,00,\
6c,00,6c,00,2c,00,2d,00,38,00,38,00,31,00,00,00
"LocalizedString"=hex(2):40,00,73,00,68,00,64,00,6f,00,63,00,6c,00,63 ,00,2e,00,\
64,00,6c,00,6c,00,2c,00,2d,00,38,00,38,00,30,00,00,00
[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Defau ltIcon]
@=hex(2):73,00,68,00,64,00,6f,00,63,00,6c,00,63,00,2e,00,64,00,6c,00,
6c,00,2c,\
00,2d,00,31,00,39,00,30,00,00,00
[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InPro cServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00, 74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00, 68,00,\
64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00 "ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell] @="OpenHomePage" [HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell \OpenHomePage]
@="打开主页(&H)"
"MUIVerb"="@shdoclc.dll,-10241"
[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell \OpenHomePage\Command]
@=hex(2):22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,
6d,00,20,\
00,46,00,69,00,6c,00,65,00,73,00,5c,00,49,00,6e,00,74,00,65,00,72,00,
6e,00,\
65,00,74,00,20,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,5c, 00,69,\
00,65,00,78,00,70,00,6c,00,6f,00,72,00,65,00,2e,00,65,00,78,00,65,00,
00,00
[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\Shell Folder]
"Attributes"=dword:00000024
"HideFolderVerbs"=""
"WantsParseDisplayName"=""
"HideOnDesktopPerUser"=""
explorer:
www.doczj/doc/63616d4afe4733687e21aa81.html /space/file/znhygsd/-4e0a-4f20-5206-4eab/Explo
病毒创建的:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace]
如懿传 剧情[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace\{11016101-E366-4D22-BC06-4ADA335C892B}]
@="IE History and Feeds Shell Data Source for Windows Search"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}]
@="Computer Search Results Folder"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace\{450D8FBA-AD25-11D0-98A8-0800361B1103}]
@=""
"Removal Message"="@mydocs.dll,-900"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E}]
@="Recycle Bin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore r\Desktop\NameSpace\{B1D521BD-BD50-D123-3576-72D12B55633D}]
@="Microsoft Office Excel 2003"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explore
r\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}]
@="Search Results Folder"
病毒创建的:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}]
@="IE History and Feeds Shell Data Source for Windows Search"
[HKEY_CLASSES_ROOT\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\InPro cServer32]
@="C:\\WINDOWS\\system32\\ieframe.dll" "ThreadingModel"="Both"
[HKEY_CLASSES_ROOT\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\Shell Folder] "Attributes"=dword:20180000
病毒创建的:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}]
@="Internet Explorer"
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}\Defau ltIcon]
@="C:\\Program Files\\Internet Explorer\\,-32528"
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}\Shell] @=""
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}\Shell \D]
@="删除(&D)"
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}\Shell \D\Command]
@=""
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}\Shell \Open]
@="打开主页(&H)"
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}\Shell \Open\Command]
@="C:\\Program Files\\Internet Explorer\\ %1
h%t%t%p%:%/%/%w%w%w%.%18%f%f%.%n%e%t%/%?%12%16%?%15%16"
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}\Shell \属性(&R)]
@=""
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}\Shell \属性(&R)\C
ommand] @=" Shell32.dll,Control_RunDLL Inetcpl.cpl"
[HKEY_CLASSES_ROOT\CLSID\{B1D521BD-BD50-D123-3576-72D12B55633D}\Shell Folder]
@=""
"Attributes"=dword:00000010
人生哲学名言加密的⽹址:h%t%t%p%:%/%/%w%w%w%.%18%f%f%.%n%e%t%/%?%12%16%?%15%16
版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。
发表评论