2014年11月3日 星期一

電腦問題(0008) - 瀏覽器首頁被 Hao123 綁架了

問題 Question/Problem


有安裝快播 Qvod 的人當中應該有不少人有過這樣的經驗 (也有可能至今還沒解決),那就是幾乎所有瀏覽器 (包括 Internet Explorer、Google Chrome、Mozilla Firefox 跟 Apple Safari 在內) 的開啟首頁都被換成了 hao123.com 了。更糟糕的是,不管你在瀏覽器重設、Windows Register 內改回來您想要的首頁都沒用。
當然,這也跟您的作業系統和瀏覽器版本或許有關,而且從以前到現在 hao123 (或 Qvod) 綁架的方式也會有所改變。 所以對筆者沒有用的方法,不表示對您的電腦也一定沒用。不過請注意,這些方法僅提供分享,如果造成您的任何損失,請恕筆者無法負責。

If you ever installed QVOD, and since then the homepage of the browsers was changed to hao123.com, you may try the following solutions. But, please note that the methods provided here is merely for sharing, so please try any method at your own risk, I cannot take any responsibility for any damage or loss.


筆者的系統環境是: (the system environment of my computer)
Win8.1 64 bit
Internet Explorer 11
Apple Safari 5.1.7
Mozilla Firefox 32.0.2

以下先介紹筆者試過有效的方法,再介紹幾個筆者試過沒成功的方法。介紹沒成功的方法僅是因為想幫網友(系統環境與筆者相同者)節省些時間。

We will introduce the methods which are successful first, and then we will tell you some methods that didn't work for us later. However, please note that the reasons of not working may be various. So, if your system environment is different to mine, some of the methods not working for me may still have some chances to solve the problem of your computer.


解決方式 Solution

網路上可以找到很多聲稱可以解決的方法,筆者試過都沒有用。目前在批踢踢找到了一個方法是有用的,寫在這裡跟網友分享,同時也在此感謝這位作者 (Lupin) 的經驗分享。

Lupin 的系統環境是:Windows 7 64 bit
同樣都是因為安裝過 Qvod (快播) 之後,即使解除安裝了還是沒辦法把瀏覽器的首頁換回來。

Lupin 所分享的經驗如下:


1. 控制台→程式集→程式和功能→解除安裝或變更程式
把所有關於「快播」、「QVOD」或發行者是「深圳市驅動人生軟件技術有限公司」的程式全部解除安裝

Uninstall QVOD

2. 用檔案總管進到 C 槽,搜尋關鍵字「QVOD」,然後把找到的檔案與資料夾全部刪除
(註:如果您當初把 QVOD 安裝到 D槽,那請您也要搜尋 D 槽)

Use the keyword "qvod" to search through you hard drives. And then delete all files whose name contains "qvod".

3. 主要造成流覽器首頁被綁架的原兇是下面這個 QvodExtend_x64.dll 
而如何刪除它就是本篇要講的重點
C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.99.0\QvodExtend_x64.dll
(註 1:即使進入安全模式也無法直接刪除)
(註 2:C:\ProgramData\QvodPlayer\QvodExtend\5.0.99.0\QvodExtend_x64.dll)

The evil file is QvodExtend_x64.dll.  But, you will not be able to delete it directly in Windows 7/8.
The path of this file could be:  C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.99.0\ or C:\ProgramData\QvodPlayer\QvodExtend\5.0.99.0\ 
Please check the search results from the previous step for the correct path in your computer.
So, the following describes how to remove this file.

4. 在開始功能表的命令列那邊打入「cmd」,出現 cmd.exe 後對它按右鍵選擇「以系
統管理員身份執行

Open Command Prompt  (cmd.exe) with System Administrator.

5. 先回到 C:\ 的根目錄
(不論本來在哪個子目錄,只要一直輸入「cd..」就可以回到上一層目錄,然後依此一路回到 C:\ 的根目錄下)

Change directory to root directory (C:\).

6. 進入目標子目錄
以我自己為例是 C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.99.0\
看每個人狀況不同也許有些不同,總之就是進入 QvodExtend_x64.dll 所在的目錄
(進入子目錄的方法是「cd\」之後輸入子目錄名稱即可)
(註:筆者的子目錄與 Lupin 的不同,是在  C:\ProgramData\QvodPlayer\QvodExtend\5.0.99.0\)

Change directory to the directory (folder) at which QvodExtend_x64.dll is located.
In my case, the file is in the directory of C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.99.0\.

7. 在目標子目錄下輸入 Cacls QvodExtend_x64.dll /t /e /c /g Everyone:f
把 QvodExtend_x64.dll 的存取權限改成所有人皆可存取

In this directory, type in Cacls QvodExtend_x64.dll /t /e /c /g Everyone:f
With command, the file will be accessible by anyone.

8. 輸入 tasklist /m QvodExtend_x64.dll
這樣就知道有哪些程式正使用到 QvodExtend_x64.dll,並顯示出那個程式的 PID 號
碼。
其實主要是 explorer.exe 正在用它,而這就是 QvodExtend_x64.dll 無法被直接刪除的原因。
請記下 explorer.exe 的 PID 號碼(它是一組 4 碼的數字,每次開機所找到的數字都可能不同,以我這次為例是 3052 )
如果有其他程式也在使用它,就請一起記下那些程式的 PID 碼
(註:筆者的 PID 是 4988。當然,如 Lupin 所言,PID 是每次開機之後的數字都可能不同)

Type in tasklist /m QvodExtend_x64.dll
With this command, we can know which process is using the QvodExtend_x64.dll.
Since this file is locked by that process, so we will need to kill that process first, and then the QvodExtend_x64.dll will be unlocked and removed.
Please memorize the PID number. In my case, the PID was 3052.)

9. 請確定 C 槽內所有包含「QVOD」的檔案,除了暫時刪不掉的以外都已經刪除乾淨了
(不放心的話就多刪幾次)

Please make sure that all files with the name containing "qvod" have been deleted already.

10. 關閉其他所有應用程式,只留下 cmd 視窗

Close all other programs, except the command prompt window.

11. 在 cmd 視窗裡輸入 taskkill /f /PID 3052
這時就會發現你的桌面不見了,因為 explorer.exe 已經被關閉。但是請不用驚慌,到此我們已經快要可以把 QvodExtend_x64.dll 幹掉了
如果有其他正使用它的程式,就請全部都執行一次這個指令 (就是把後面那 4 碼的 PID
碼換掉即可)

In the command prompt window, type in taskkill /f /PID 3052
After this command, everything on the desktop will be gone (because "explorer.exe" has been closed), and only the command prompt window is still there. Please don't worry, because this is time for us to remove QvodExtend_x64.dll.

12. 刪除 QvodExtend_x64.dll
關閉所有正在使用 QvodExtend_x64.dll 的程式後,終於可以把這該死的流覽器首
頁綁架元兇刪除了
請輸入判它死刑的 del QvodExtend_x64.dll
然後按下 Enter,它就永遠從你的電腦消失了

Type in del QvodExtend_x64.dll
Then, it is removed from your computer.

13. 重新開機
因為 explorer.exe 關閉後桌面已經不見,所以請用
Ctrl+Alt+Del 來重新開機

Restart the computer.
Since you have only the command prompt window on your desktop, one way to restart the computer is Ctrl+Alt+Del.

14. 重開機後,請在 C 槽再搜尋一次包含「QVOD」關鍵字的所有檔案與資料夾,如果
還有一些殘渣就請全部刪除(此時應該沒有刪不掉的東西了)

You can search your computer again to make sure that all files with the name containing "qvod" have been removed.

15. 重新開啟你的流覽器,一切順利的話,恭喜!你的首頁終於從被綁架當中解脫了,
你可以再度重新設定自己喜歡的首頁。

Open the browser. Done.

如果以上方式對您沒用,而且您是使用 Chrome 的話:

1. 在 Chrome 的設定裡面,點 "顯示進階設定"。
2. 最下方有一個 "重設設定"。 重設設定之後,一些附加程式跟連結可能會需要重設。不過,筆者試過這樣的方式是可以重設開啟 Chrome 的首頁。

If the method described above didn't work for you, and the browser you are using the most is Google Chrome, you may try the following method.

1. In the Settings of Chrome, click "Display advance settings".
2. At the bottom of the Settings, click "Reset Settings" button. By this method, you can remove hoa123, but you may need to reset some other things manually, because the browser is nearly a new one for you.

如果以上方式對您沒用,而且您是使用 Firefox 的話:

有一個 "避免" 看到 hao123.com 出現在 Firefox 的首頁的方法,就是把 Firefox 的目錄跟 firefox.exe 的檔名都改掉。例如把目錄改為 SFirefox,把 firefox.exe 改為 sfirefox.exe 。從此要開啟 Firefox 就執行 sfirefox.exe 就好了。
不過,這只是"避免"讓您看到,不表示 hao123 已經被您刪除。所以,每次 Firefox 程式更新之後,同樣的動作還是要再做一次。

If the method described above didn't work for you, and the browser you are using the most is Mozilla Firefox, you may try the following method.

This method is not really "remove" the hao123 from your computer, but to prevent the hao123.com showing on your browser as the homepage.
The method is to rename the directory of Firefox and the file name of "firefox.exe" to something like "AFireFox" and "bfirefox.exe" (or any name you like, but please remember to update the shortcut on your desktop).  However, you will need to repeat this after every update of Firefox.



筆者沒有試過的方式 Methods not tried yet

從此網頁主的經驗來看,似乎可以安裝 360 衛士簡體版來修改。修改完之後,建議 360 衛士簡體版也移除。




筆者試過卻沒有成功的方式 Methods not working for me

再說明一次,因為 Qvod (或 hao123) 的版本不同,以及因為諸多系統環境的不同的緣故,這些方法並沒有幫筆者解決問題,但不表示一定在您的電腦行不通。如果以上方式無法解決,或許以下的方法不妨試試。

Although the following methods are not working for me, it may be still worth to try it, if your system environment is different to mine.

方法 1:用 regedit.exe 進入 Windows Registry 刪除以下子機碼
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\
並檢查下列三個機碼中的【Default_Page_URL】值和【Start Page】值是否被修改了,如果被修改了,請根據自己的需要改回。
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main

Use regedit.exe to edit Windows Registry. Delete the key:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\

Change the values of the following keys back to ones you like.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main


方法 2:下載 Microsoft Fit It 來自動修復
筆者下載後無法使用,因為版本不符。(該程式可能是給 Internet Explorer 7/8 用的)

Download Microsoft Fit It to repair it automatically.
I downloaded it, but it is not working on my computer, because the version of IE is not correct.

方法 3:用 regedit.exe 進入 Windows Registry 搜尋並刪除所以出現 hao123 和 qvod  的機碼都刪除。

Use regedit.exe to search the key workds "hoa123" and "qvod" in Windows Registry and remove those values.

沒有留言:

張貼留言