“www.wz567.com”这个网站劫持了我的浏览器
我的IE出现下列问题：
1.主页被锁定为恶意网站
2.系统启动时弹出对话框
3.链接栏被改名
4.浏览器或OE标题栏被修改

【回复“Coolfish”的帖子】



请您先下载HijackThis1.99.1（它是免费的）：

http://www.spywareinfo.com/~merijn/files/hijackthis.zip
将它解压到一个非临时性的文件夹（比如C:\Program Files\HijackThis\HijackThis.exe）。然后双击HijackThis.exe图标，选择Do a system scan and save a logfile，将产生的文本文件中的日志帖上来。如果一个帖子贴不下，可以将剩余的部分另开一帖。

建议您下载并使用HijackThis1.99.1

HijackThis下载地址请参考：
【必读】本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931

HijackThis的使用方法-----请参考--瑞星HijackThis专题
http://it.rising.com.cn/newSite/Channels/anti_virus/Antivirus_Faq/TopicExplorerPagePackage/hijackthis.htm


》》4.浏览器或OE标题栏被修改
开始--运行--regedit--找到
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
和
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
将在右边窗口中的“Window Title”主键值更改为“Microsoft Internet Explorer”

Logfile of HijackThis v1.99.1
Scan saved at AM 08:49:32, on 2005/12/20
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAM FILES\INVENTEC\DREYE\DREYE.EXE
C:\PROGRAM FILES\INVENTEC\DREYE\PEADICT\RTDICT.EXE
C:\PROGRAM FILES\INVENTEC\DREYE\PEADICT\ENGINE32.EXE
C:\PROGRAM FILES\INVENTEC\DREYE\PEADICT\DICT.EXE
C:\PROGRAM FILES\HIJACK\HIJACKTHIS\HIJACKTHIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSHOOK.DLL
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL
O3 - Toolbar: &Tom馱撿沭 - {5F72BDE9-B9C4-47ad-8474-05B7FF00CBD2} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\TOMBAR.DLL
O3 - Toolbar: 陲源辦陬 - {3EA85E14-887D-4E2F-91E2-3158CE58ED62} - C:\PROGRAM FILES\!SUNV\DFKC2003\IEBAND.DLL
O3 - Toolbar: 收音機(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: 奻厙翑忒 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRAM FILES\3721\ASSIST\ASBAR.DLL
O4 - HKLM\..\Run: [Gene USB Monitor] rem C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\Run: [Brasil] rem C:\WINDOWS\Brasil.pif
O4 - HKLM\..\Run: [instit] rem C:\WINDOWS\instit.bat
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] rem Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] rem C:\WINDOWS\SYSTEM\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] rem "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [HP Software Update] rem "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat
O4 - HKLM\..\Run: [cnyisou_com] http://www.wz567.com
O4 - HKLM\..\RunOnce: [ 3721AutoRepair] C:\WINDOWS\RUNDLL32.EXE C:\PROGRA~1\3721\ASSIST\repair.dll,Rundll32
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: 上網助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: 尋寶樂趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: Yahoo 1G電郵 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: 手機短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?coagent=tom_bar (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上網記錄 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修復瀏覽器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: 啃勀芞踱 - {6713E8D2-850A-101B-AFC0-4210102A8DA7} - http://www.26-3.com/star (file missing) (HKCU)
O9 - Extra button: 鍊汒芞狟婥 - {7713E8D2-850A-101B-AFC0-4210102A8DA7} - http://www.26-3.com/sms/index.htm (file missing) (HKCU)
O11 - Options group: [!CNS]  網絡實名
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = brownie
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 192.168.6.1

重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

运行Hijackthis，扫描结束后在下列选项前打上勾，然后选修复“Fix Checked”：

O4 - HKLM\..\Run: [Brasil] rem C:\WINDOWS\Brasil.pif
O4 - HKLM\..\Run: [instit] rem C:\WINDOWS\instit.bat
O4 - HKLM\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat
O4 - HKLM\..\Run: [cnyisou_com] http://www.wz567.com

显示隐藏文件

双击我的电脑--查看---文件夹选项--查看选项卡--单击选取"显示全部文件"--单击“确定”。

然后找到如下文件并删除（如果有的话）。

C:\WINDOWS\instit.bat
C:\WINDOWS\Brasil.pif
C:\$NtUninstallQ5926809$\整个目录