Solve www.54kk.com/baidu hijacking

　　EndurerOriginal version 2005.10.27

* Endurer Note: for the sake of security, "http: //" in the following section is replaced by "hxxp.

A colleague's Computer Browser was hijacked by a malicious website just now. Please help me with this.

My colleagues' computers use Windows ME (Win9x 4.90.3000) + IE 6.00 SP1 (6.00.2800.1106 ).

　　Symptoms:

1. A webpage is automatically opened after the instance is started, for example:

Although the address bar shows hxxp: // www.54kk.com, the content of the webpage is Baidu. If you enter a keyword, The baidu search result is displayed.

2. the IE homepage is changed to hxxp: // www.54kkk.com and cannot be modified.

3. The title bar of IE is suffixed with www.54kk.com.

　　Fix:

1. Use hijackthis scan (you can download hijackthis in the/tools/system analysis and repair folder of hxxp: // endurer.ys168.com) to find and fix the following items:

O4-HKLM/../run: [cnyisou_com] hxxp: // www.54kk.com

O6-hkcu/software/policies/Microsoft/Internet Explorer/restrictions present
O6-hkcu/software/policies/Microsoft/Internet Explorer/Control Panel present

2. download and use the rising registry Repair Tool to fix the IE title bar. Download the rising registry Repair Tool.

Of course, we can also manually fix the issue in the registry, but do we still need to use tools to fix the issue fast and secure?

3. For the sake of insurance, clear the temporary ie folder. For more information, see [System Recovery series] how to clear temporary ie folders

　　Question:

What is the relationship between Baidu and www.54kk.com?

Check that the IP address of www.54k.com is 202.108.250.218;

Find the user with the IP address 202.108.250.218, which is the Baidu company in Beijing.

This result is really amazing ........

The suspense is: when will the Baidu start to use the IP address 202.108.250.218?