[筆記] WinXP 電腦 IE首頁 被dh440.com & http://web.sogou.com/?12141 綁架、劫持的處理方法

工作上的需求，要幫業務弄一台XP的PC出來

手邊已經沒有什麼XP的安裝片了，於是上網下載了一個

系統家園Ghost XP SP3 繁體中文純淨版

媽咧個B咧，純淨個屁喔！

裡面裝了一堆亂七八糟有的沒的軟體，不過這些軟體好處理，就移除掉就好了

但是呢，IE首頁一直被綁架著很不爽

開啟IE後，會先讀取 dh440.com 然後會轉址到 http://web.sogou.com/?12141

這東西非常頑固！不管是手動清registry 、改IE設定、甚至重設IE都沒用

以往碰到的狀況，頂多就是重設IE就好，這次頭大了。

好，想說以毒攻毒吧！先下個 360安全衛士，不管是掃描、掃毒、主頁保護都跑過了，還是沒用！

又換個QQ電腦管家，也是一樣全功能都執行一遍，也是解決不了。

又下載了 adwcleaner portable 來試試看，雖說有掃到東西，但是首頁被綁架的情況依然沒有成功處理

最後又試了 malwarebyte 才總算把這個dh440.com 轉址 web.sogou.com 的首頁綁架解決！

因為用dh440.com 當關鍵字去GOOGLE，其實找不到什麼有用的幫助

就順便記錄一下，希望能幫到其他人！

malwarebyte 最後掃出來的LOG是這樣

我猜是那個2345explorer的問題

Malwarebytes

www.malwarebytes.com

-Log Details-

Scan Date: 2017/1/11

Scan Time: 上午 10:44:27

Logfile:

Administrator: Yes

-Software Information-

Version: 3.0.5.1299

Components Version: 1.0.43

Update Package Version: 1.0.974

License: Trial

-System Information-

OS: Windows XP Service Pack 3

CPU: x86

File System: NTFS

User: QKIEYVGMWMKCQVW\Administrator

-Scan Summary-

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 218347

Time Elapsed: 7 min, 8 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 9

PUM.Optional.DisableShowSearch, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|START_SHOWSEARCH, No Action By User, [19230], [293317],1.0.974

PUM.Optional.DisableShowHelp, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|START_SHOWHELP, No Action By User, [19226], [293313],1.0.974

PUM.Optional.NoSMHelp, HKU\S-1-5-21-839522115-1532298954-1801674531-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|NOSMHELP, No Action By User, [19245], [293358],1.0.974

PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|ANTIVIRUSDISABLENOTIFY, No Action By User, [19218], [293294],1.0.974

PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|FIREWALLDISABLENOTIFY, No Action By User, [19218], [293295],1.0.974

PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|UPDATESDISABLENOTIFY, No Action By User, [19218], [293296],1.0.974

PUM.Optional.DisableShowSearch, HKU\S-1-5-21-839522115-1532298954-1801674531-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|START_SHOWSEARCH, No Action By User, [19230], [293317],1.0.974

PUM.Optional.DisableShowHelp, HKU\S-1-5-21-839522115-1532298954-1801674531-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|START_SHOWHELP, No Action By User, [19226], [293313],1.0.974

PUM.Optional.NoSMHelp, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|NOSMHELP, No Action By User, [19245], [293358],1.0.974

Data Stream: 0

(No malicious items detected)

Folder: 3

PUP.Optional.Elex, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\APPLICATION DATA\2345Explorer\User Data\Default, No Action By User, [15], [308620],1.0.974

PUP.Optional.Elex, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\APPLICATION DATA\2345Explorer\User Data, No Action By User, [15], [308620],1.0.974

PUP.Optional.Elex, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\APPLICATION DATA\2345Explorer, No Action By User, [15], [308620],1.0.974

File: 2

PUP.Optional.Elex, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\APPLICATION DATA\2345Explorer\User Data\Default\Bookmarks, No Action By User, [15], [308620],1.0.974

PUP.Optional.Elex, C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\APPLICATION DATA\2345Explorer\User Data\Default\page_file.dat, No Action By User, [15], [308620],1.0.974

Physical Sector: 0

(No malicious items detected)