被 NETZANY 駭到了

[頑固方糖]

請教各位前輩......在下有個朋友日前不知瀏覽哪個網站....
被改了網頁標題....還被植入了一堆亂七八糟的連結....
由於修改機碼無效...故此前來求助.....
煩請有經驗的高手解答指點迷津.......感激不盡.....
狀況: 進入REGEDIT.EXT 修改後 重新開機又會(復原)
真是束手無策...... 有請高手相助了
萬分感謝....萬分感謝....

[turboc806]

最初由 頑固方糖 發表
請教各位前輩......在下有個朋友日前不知瀏覽哪個網站....
被改了網頁標題....還被植入了一堆亂七八糟的連結....
由於修改機碼無效...故此前來求助.....
煩請有經驗的高手解答指點迷津.......感激不盡.....
狀況: 進入REGEDIT.EXT 修改後 重新開機又會(復原)
真是束手無策...... 有請高手相助了
萬分感謝....萬分感謝....

照以下步驟即可移除
1. Delete the file c:\windows\web\6349927604.exe or any other recently dated .exe files in this directory. Exe's shouldn't be needed in this directory.
2. Right-click Internet Explorer and go to Properties...>Delete Files under the General tab> check off "Delete all offline content" and hit OK
3. On this same IE tab change your Home page address to something different (msn.com,google.com, etc.) so IE doesn't open automatically to a Netzany page
4. Go to Start>Run.. and type "regedit" and hit OK
5. With "My Computer" highlighted within Registry Editor search for anything containing "netzany". Delete any entries specifically containing Netzany or any keys (the folders) that look to contain only netzany entries. If you are worried about deleting anything, hightlight the single entry or its key and then go to Registry>Export registry file... and save it someplace safe before proceeding. If you find later you deleted something that is needed you can restore the registry entry by simply opening the export file you created. Windows will return it to its original position
6. Follow Step 5 again but this time search for "6349927604"
7. If it's not already gone, delete the Netzany folder from your Windows Favorites list
8. Restart your PC before signing onto the internet again. Any files resident in memory and associated with Netzany could potentially put back what you just cleaned up if you do not reboot

[foxbrian]

這個站會在你的啟動那邊設定一個程式,開機會自動執行
你在開始-->執行-->msconfig-->啟動-->找找看有沒有怪怪的程式,把它的勾取消

我的情況是出現了"6349927604"這個執行檔躲在C:\windows\web這個資料夾裡
另外,記得在編輯器裡把所有有關NETZANY的機碼刪掉,以後開機首頁就不會自動
跳到這裡,我的最愛也不會多了NETZANY的資料夾...希望可以幫的上你!!

ps.上面的網友有提醒,還必需刪除Temporary Internet Files的檔案(離線內容也要)

[yunhan]

不好意思..上面都是英文，我看不懂
能不能用中文稍微說一下？
感激唷...

[dawn]

按下列的連結,並執行,即可~


http://tb.netzany.com/uninstall/uninstallf.exe

或我上傳解Netzany的程式

[dawn]

NETZANY綁架首頁之原因為：按了安全性警告！
如....
您是否要安裝並執行簽署在2002/5/22 AM 0213
由以下位置所發佈的netzany.......

這是騙人的陷阱，要注意閱讀安全性警告內容才不會首頁被綁！

[yunhan]

最初由 dawn 發表
NETZANY綁架首頁之原因為：按了安全性警告！
如....
您是否要安裝並執行簽署在2002/5/22 AM 0213
由以下位置所發佈的netzany.......

這是騙人的陷阱，要注意閱讀安全性警告內容才不會首頁被綁！

嗯嗯，像有那種視窗我都懶的看，都直接按確定...
想不到就是因為這樣才被綁架的阿！
還好以解，下次會小心...