- 逆向行駛 - https://520.be -

簡易移除2345.com或hao123.com等等的綁架首頁bat檔案

Posted By 窮苦人家的小孩 On In 軟硬通吃 | No Comments

IE很會莫名其妙的被綁架，不虧是M＄ 🤖🤓🤖

首先服用此bat檔案 [1]

點此下載bat檔 [1]
MS DOS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
@Echo Off
Title Reg Converter v1.1 & Color 1A
REM ~ call :IsAdmin
call :RegExport
Exit
:RegExport
Set RegFile="%Temp%\~wvyqmkn.tmp"
If Exist %RegFile% (
Attrib -R -S -H %RegFile% &  Del /F /Q %RegFile%
If Exist %RegFile% cls & Echo Could not delete file %RegFile% & Pause
)
> %RegFile% Echo Windows Registry Editor Version 5.00
>> %RegFile% Echo.
>> %RegFile% Echo [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
>> %RegFile% Echo "Default_Page_URL"=hex(1):68,00,74,00,74,00,70,00,73,00,3a,00,2f,00,2f,00,77,\
>> %RegFile% Echo   00,77,00,77,00,2e,00,67,00,6f,00,6f,00,67,00,6c,00,65,00,2e,00,63,00,6f,00,\
>> %RegFile% Echo   6d,00,2e,00,74,00,77,00,00,00
>> %RegFile% Echo.
>> %RegFile% Echo [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main]
>> %RegFile% Echo "Start Page"=hex(1):68,00,74,00,74,00,70,00,73,00,3a,00,2f,00,2f,00,77,00,77,\
>> %RegFile% Echo   00,77,00,2e,00,67,00,6f,00,6f,00,67,00,6c,00,65,00,2e,00,63,00,6f,00,6d,00,\
>> %RegFile% Echo   2e,00,74,00,77,00,00,00
Start /Wait %systemroot%\Regedit.exe /S %RegFile%
Del %RegFile%
goto:eof
:IsAdmin
Reg.exe query "HKU\S-1-5-19\Environment"
If Not %ERRORLEVEL% EQU 0 (
Cls & Echo You must have administrator rights to continue ...
Pause & Exit
)
Cls
goto:eof

或是此reg檔案

Microsoft Registry
1
2
3
4
5
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.google.com.tw"
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.com.tw"

然後再服用AdwCleaner – 解除瀏覽器綁架工具 [2]