360独家报，看看是不是病毒

zmzcy

HC303

红伞，金山卫士不杀。

jayavira

样本名称：一键清理优化.exe

文件MD5：9d7a8f5305cb5bf88cc288400ffaafd0

鉴定结果：安全

MySince

to Avira
to MSE 2.0

HC303

毒霸云提示安全。

恋亿晓

上报NOD32

ssama

回复 1楼 zmzcy  的帖子
to avast! & Emsisoft


有恶意行为的说s.reg

1. Windows Registry Editor Version 5.00
   
2. //设置搜索提供商
   
3. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
   
4. "DefaultScope"="{A481937F-4D99-4B11-86E6-5B0F1007C557}"
   
5. "Version"=dword:00000001
   
6. "DownloadRetries"=dword:00000000[indent][HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}]
   
7. "DisplayName"="百度"
   
8. "URL"="http://www.baidu.com/s?ie=utf-8&tn=comguge999_dg&wd={searchTerms}"
   
9. "ShowSearchSuggestions"=dword:00000001
   
10. "SuggestionsURL_JSON"="http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie=utf-8&from=ie8"
    
11. "Codepage"=dword:0000fde9
    
12. "OSDFileURL"="http://www.ieaddons.com/cn/DownloadHandler.ashx?ResourceId=857"
    
13. "FaviconURL"="http://www.baidu.com/favicon.ico"
    
14. "SortIndex"=dword:00000001
    
15. 
    
16. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A74B9955-EBA2-4088-BB67-929511A48B49}]
    
17. "DisplayName"="Google"
    
18. "URL"="http://www.google.cn/search?hl=zh-CN&q={searchTerms}&btnG=Google+%E6%90%9C%E7%B4%A2&meta=&aq=f&oq="
    
19. "OSDFileURL"="http://www.ieaddons.com/cn/DownloadHandler.ashx?ResourceId=851"
    
20. "FaviconURL"="http://www.google.cn/favicon.ico"
    
21. "SortIndex"=dword:00000002
    
22. 
    
23. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{DD1ECE7C-8C7B-43EE-9C77-8F356BC3D293}]
    
24. "DisplayName"="淘宝闪电搜索"
    
25. "URL"="http://search8.taobao.com/browse/search_auction.htm?q={searchTerms}&pid=mm_10532670_0_0&search_type=auction&commend=all&at_topsearch=1"
    
26. "ShowSearchSuggestions"=dword:00000001
    
27. "SuggestionsURL"="http://search1.taobao.com/browse/search_visual.htm?n=15&q={searchTerms}"
    
28. "Codepage"=dword:000003a8
    
29. "OSDFileURL"="http://www.ieaddons.com/cn/DownloadHandler.ashx?ResourceId=872"
    
30. "FaviconURL"="http://www.taobao.com/favicon.ico"
    
31. "SortIndex"=dword:00000003
    

复制代码

一键清理优化.bat

1. cls
   
2. @echo off//清屏,不显示命令
   
3. //根据属性选择要删除的文件。强制删除只读文件。安静模式。删除全局通配符时，不要求确认
   
4. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\风行网络电影.*"
   
5. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\酷我音乐盒.*"
   
6. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 网络电视.*"
   
7. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\查查看2.0.*"
   
8. 
   
9. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\桌面\多特软件站.*"
   
10. del /a /f /q "%SystemDrive%\Documents and Settings\All Users\桌面\金山清理专家2009.*"
    
11. del /a /f /q "%SystemDrive%\Documents and Settings\All Users\桌面\金山网镖.*"
    
12. del /a /f /q "%SystemDrive%\Documents and Settings\All Users\桌面\迅雷看看-免费高清影视.*"
    
13. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\桌面\千千音乐.*"
    
14. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\桌面\多特软件站.*"
    
15. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\桌面\修复360安全卫士.*"
    
16. del /a /f /q "%SystemDrive%\Documents and Settings\All Users\桌面\风行游戏.*"
    
17. 
    
18. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\「开始」菜单\程序\PPS网络电视\多特知道 电脑答疑.*"
    
19. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\「开始」菜单\程序\PPS网络电视\下载软件最新版.*"
    
20. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\「开始」菜单\程序\酷狗\多特知道 电脑答疑.*"
    
21. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\「开始」菜单\程序\酷狗\下载软件最新版.*"
    
22. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\「开始」菜单\程序\Microsoft Office\访问完美者精品下载站.*"
    
23. 
    
24. del /a /f /q "D:\我的文档\收藏夹\爱词霸英语学习社区.*"
    
25. del /a /f /q "D:\我的文档\Favorites\QQ网址大全.*"
    
26. del /a /f /q "D:\我的文档\Favorites\爱词霸英语学习社区.*"
    
27. del /a /f /q "D:\我的文档\Favorites\链接\QQ网址大全.*"
    
28. del /a /f /q "D:\我的文档\Favorites\金狐电脑工作室-Jinhu Computer Studio.*"
    
29. del /a /f /q "D:\我的文档\Favorites\搜索王 - Search All.*"
    
30. md "%ProgramFiles%\速达浏览器"
    
31. copy "%temp%\一键清理优化\SUDA.EXE" "%ProgramFiles%/速达浏览器/" /y
    
32. del /a /f /q "%USERPROFILE%\收藏夹\爱词霸英语学习社区.*"
    
33. del /a /f /q "%USERPROFILE%\Favorites\QQ网址大全.*"
    
34. del /a /f /q "%USERPROFILE%\Favorites\爱词霸英语学习社区.*"
    
35. del /a /f /q "%USERPROFILE%\Favorites\链接\QQ网址大全.*"
    
36. del /a /f /q "%USERPROFILE%\Favorites\金狐电脑工作室-Jinhu Computer Studio.*"
    
37. del /a /f /q "%USERPROFILE%\Favorites\搜索王 - Search All.*"
    
38. 
    
39. del /a /f /q "%ProgramFiles%\FlashGet Network\FlashGet 3\绿色下载吧.*"
    
40. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\「开始」菜单\程序\快车 (FlashGet)\访问 自由分享绿色下载吧！.*"
    
41. 
    
42. del /a /f /q "%ProgramFiles%\StormII\绿色下载吧.*"
    
43. del /a /f /q "%SystemDrive%\Documents and Settings\Administrator\「开始」菜单\程序\暴风影音\访问 自由分享绿色下载吧！.*"
    
44. 
    
45. del /a /f /q "%SystemDrive%\WINDOWS\Tasks\SogouImeMgr.job"
    
46. //运行s.reg等
    
47. regedit /s "%temp%\一键清理优化\s.reg"
    
48. "%temp%\一键清理优化\shdoclc.exe"[/indent]exit

复制代码

XMonster

過金山網盾

匆匆九月魂

这些天360误报太厉害了，要不是自己亲身经历过，还真不相信它会误报误杀随便拦截。

hddu

删除"修复360安全卫士"不是毒？ 是啥？
360没有误报。360报对了。这是360自卫的行为。