3721, CNNIC, POPO 免疫程序 activeX擾覽

[psac]

各位用IE或者用IE內核的可千萬要小心了，截至到2003年11月12號IE最新的累積安全更新程序 (KB824145)都沒有將這漏洞補上。

這可是遠端任意程式碼執行，而且可是微軟除95外所有操作系統，IE5.5-6所有版本＋所有更新都通殺。也就是說除非你只用網景的或者opera瀏覽器，基本上你都在危險中。

如果你不相信，先制作備份你的記事本程序notepad.exe（會被演示程序覆蓋）,開啟附近中的self-exec.html，你就知道了。

放心，絕對不是病毒，也不會有其他破壞作用。

相關連接
http://marc.theaimsgroup.com/?l=bugt...6547827922&w=2
http://www.malware.com/self-exec.zip



Q:
3721, CNNIC, POPO 免疫程序 v1.0

通過修改註冊表免疫 3721, CNNIC, POPO 的安裝提示視窗，不在系統中增加任何文件，也不用修改 Hosts 文件。如果你不想安裝 3721, CNNIC, POPO，又不喜歡它們的彈出視窗的話。

聲明
1、作者只是提供一個免費的工具給大家使用，不對使用此軟體造成的任何損失負責。
2、如果你要安裝使用 3721 網路實名或 CNNIC 通用網址等，請不要安裝本程序。

請幫忙測試一下，這是我一個下午做出來的，可能還有問題。如有問題，請提出。

只要知道相應的CLSID,你可以在IE中遮閉掉任何ActiveX使用，當然也就可以用來遮閉3721,CNNIC等惱人插件的自動安裝。而且不用更改hosts文件，也不用更改安全證書，不會彈出提示視窗，不影響正常上網，從此，一切安靜了

無意發現的這種遮閉3721,CNNIC等惱人插件的方法好像還沒人提過，也算是原創吧

相對應的CLSID分別是：
B83FC273-3522-4CC6-92EC-75CC8667A4 /3721
9A578C98-3C2F-4630-890B-FC04196EF420 /cnnic
00000566-0000-0010-8000-00AA006D2EA4 /Adodb.Stream 2.7
4B106874-DD36-11D0-8B44-00A024DD9EFF /Adodb.Stream 2.5

附件就是對應的REG文件，匯入註冊表就可以，簡簡單單的4行而已。

原理:
http://support.microsoft.com/support...NoWebContent=1

建議？
若您對此文章有任何建議，請在以下框格內輸入建議(最多 255 字)

自我幫助
Internet Explorer
Small Business Server
Windows XP

一般消息
聯絡台灣微軟
提供您多項技術支援服務內容，包含電話技術支援或其他線上技術支援

網路廣播支援(英文)
透過微軟產品專家提供您線上的技術解說與展示

到社群討論區張貼您的技術問題

頁面選項
傳送
列印


How to Stop an ActiveX Control from Running in Internet Explorer
適用於
This article was previously published under Q240797
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry

SUMMARY
This article describes how to stop an ActiveX control from running in Internet Explorer. You can do so by modifying the data value of the Compatibility Flags DWORD value for the Class identifier (CLSID) of the ActiveX control.
MORE INFORMATION
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

WARNING: Microsoft does not recommend "unkilling" (undoing the kill action on) an ActiveX control. If you do so, you may create security vulnerabilities. The kill bit is normally set for a reason that may be critical, and because of this, extreme care must be used when you unkill an ActiveX control. Also, because the following procedure is highly technical, you should not proceed unless you a very comfortable with the procedure, and you should read the whole procedure before you begin.

The CLSID for an ActiveX control is a globally unique identifier (GUID) for that control. You can prevent an ActiveX control from running in Internet Explorer by setting the "kill bit" so that the control is never called by Internet Explorer. The "kill bit" is a specific value for the Compatibility Flags DWORD value for the ActiveX control in the registry. Note that this is different than revoking the "safe for scripting" option in an ActiveX control. When the "safe for scripting" option is revoked, Internet Explorer still calls for the control and then prompts you with a warning message that the ActiveX control may be unsafe. Depending on the choice you make, the control may be run. However, after the "kill bit" is set for an ActiveX control, that control is not called by Internet Explorer at all. To set the "kill bit" so that an ActiveX control is never called by Internet Explorer:
Determine the CLSID for the ActiveX control that you want to disable. If you are not sure of the CLSID for the control, contact the manufacturer. If the control is installed, you may be able to determine its CLSID if you know its friendly name. To do this, examine the Default string value for the ProgID key for each of the CLSID keys in HKEY_CLASSES_ROOT\CLSID. You may need to remove as many ActiveX controls as possible, except for the one that you want to disable, in order to make it easier to identify the appropriate CLSID. For additional information about how to remove ActiveX controls, click the article number below to view the article in the Microsoft Knowledge Base:
154850 How to Remove an ActiveX Control in Windows

Use Registry Editor to view the data value of the Compatibility Flags DWORD value of the ActiveX object CLSID in the following registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\CLSID of the ActiveX control

where CLSID of the ActiveX Control is the class identifier of the appropriate ActiveX control.

NOTE: To determine which CLSID corresponds with the ActiveX control that you want to disable, you must first remove all of the ActiveX controls that are currently installed, install the control that you want to disable and then add the "Kill Bit" to its CLSID.
Change the value of the Compatibility Flags DWORD value to 00000400.
The information in this article applies to:
Microsoft Internet Explorer 5.5 for Windows NT 4.0 SP 1
Microsoft Internet Explorer 5.5 for Windows NT 4.0 SP 2
Microsoft Internet Explorer 5.01 for Windows NT 4.0 SP 1
Microsoft Internet Explorer 5.01 for Windows NT 4.0 SP 2
Microsoft Internet Explorer 5.0 for Windows NT 4.0
Microsoft Internet Explorer 4.01 for Windows NT 4.0 SP 1
Microsoft Internet Explorer 4.01 for Windows NT 4.0 SP 2
Microsoft Internet Explorer 4.0 for Windows NT 4.0
Microsoft Internet Explorer 5.5 for Windows Millennium Edition SP 1
Microsoft Internet Explorer 5.5 for Windows Millennium Edition SP 2
Microsoft Internet Explorer 5.5 for Windows 98 Second Edition SP 1
Microsoft Internet Explorer 5.5 for Windows 98 Second Edition SP 2
Microsoft Internet Explorer 5.01 for Windows 98 Second Edition SP 1
Microsoft Internet Explorer 5.01 for Windows 98 Second Edition SP 2
Microsoft Internet Explorer 5.0 for Windows 98 Second Edition
Microsoft Internet Explorer 5.5 for Windows 98 SP 1
Microsoft Internet Explorer 5.5 for Windows 98 SP 2
Microsoft Internet Explorer 5.01 for Windows 98 SP 1
Microsoft Internet Explorer 5.01 for Windows 98 SP 2
Microsoft Internet Explorer 5.0 for Windows 98
Microsoft Internet Explorer 4.01 for Windows 98 SP 1
Microsoft Internet Explorer 4.01 for Windows 98 SP 2
Microsoft Internet Explorer 5.5 for Windows 2000 SP 1
Microsoft Internet Explorer 5.5 for Windows 2000 SP 2
Microsoft Internet Explorer 5.01 for Windows 2000 SP 1
Microsoft Internet Explorer 5.01 for Windows 2000 SP 2
Microsoft Internet Explorer version 6 for Windows XP 64-Bit Edition
Microsoft Internet Explorer version 6 for Windows XP
Microsoft Internet Explorer version 6 for Windows 2000
Microsoft Internet Explorer version 6 for Windows NT 4.0
Microsoft Internet Explorer version 6 for Windows Millennium Edition
Microsoft Internet Explorer version 6 for Windows 98 Second Edition
Microsoft Internet Explorer version 6 for Windows 98

這是另一思路...直接做成註冊表文件不是更好？


程式碼:-----------------------------------------------

REGEDIT4

#B83FC273-3522-4CC6-92EC-75CC86678DA4 /3721
#9A578C98-3C2F-4630-890B-FC04196EF420 /cnnic

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9A578C98-3C2F-4630-890B-FC04196EF420}]
"Compatibility Flags"=dword:00000400


像這樣（從 ROR team 搞到的...）：


程式碼:==============================
REGEDIT4

#B83FC273-3522-4CC6-92EC-75CC86678DA4 /3721
#9A578C98-3C2F-4630-890B-FC04196EF420 /cnnic
#CF051549-EDE1-40F5-B440-BCD646CF2C25 /popo

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9A578C98-3C2F-4630-890B-FC04196EF420}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CF051549-EDE1-40F5-B440-BCD646CF2C25}]
"Compatibility Flags"=dword:00000400
==================================

從 "="
另儲存新檔*.reg文件，匯入註冊表即可。
POPO 的 CLSID ......再加一個................


REGEDIT4

;D27CDB6E-AE6D-11cf-96B8-444553540000 //FLASH
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
"Compatibility Flags"=dword:00000400

; 嫌FLASH太占資源的就關了吧
!

REGEDIT4

#B83FC273-3522-4CC6-92EC-75CC86678DA4 /3721
#9A578C98-3C2F-4630-890B-FC04196EF420 /CNNIC
#CF051549-EDE1-40F5-B440-BCD646CF2C25 /POPO
#4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686 /笢恅蚘
#BC207F7D-3E63-4ACA-99B5-FB5F8428200C /Baidu
#9BBC1154-218D-453C-97F6-A06582224D81 /Baidu


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9A578C98-3C2F-4630-890B-FC04196EF420}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CF051549-EDE1-40F5-B440-BCD646CF2C25}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CF051549-EDE1-40F5-B440-BCD646CF2C25}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BC207F7D-3E63-4ACA-99B5-FB5F8428200C}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9BBC1154-218D-453C-97F6-A06582224D81}]




立刻下來按上，不讓他們騷擾你或偶的電腦!
98的系統就不用煩了！

直接把ActiveX給Ban了，效果可以持續很長一段時間了
程式碼:---------------------------------------------------------------------REGEDIT4

#B83FC273-3522-4CC6-92EC-75CC86678DA4 /3721
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4}]
"Compatibility Flags"=dword:00000400


#9A578C98-3C2F-4630-890B-FC04196EF420 /CNNIC
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9A578C98-3C2F-4630-890B-FC04196EF420}]
"Compatibility Flags"=dword:00000400


#CF051549-EDE1-40F5-B440-BCD646CF2C25 /POPO
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CF051549-EDE1-40F5-B440-BCD646CF2C25}]
"Compatibility Flags"=dword:00000400


#9BBC1154-218D-453C-97F6-A06582224D81 /BaiDu
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9BBC1154-218D-453C-97F6-A06582224D81}]
"Compatibility Flags"=dword:00000400


#BC207F7D-3E63-4ACA-99B5-FB5F8428200C /BaiDu
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BC207F7D-3E63-4ACA-99B5-FB5F8428200C}]
"Compatibility Flags"=dword:00000400


#4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686 /ZhongWenYou
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686}]
"Compatibility Flags"=dword:00000400


#00000566-0000-0010-8000-00AA006D2EA4 /Adodb.Stream 2.7
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}]
"Compatibility Flags"=dword:00000400


#4B106874-DD36-11D0-8B44-00A024DD9EFF /Adodb.Stream 2.5
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4B106874-DD36-11D0-8B44-00A024DD9EFF}]
"Compatibility Flags"=dword:00000400--------------------------------------------------------------------------------

[psac]

本來我是用不信任站點的......................

不用再安裝證書了!


REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
@=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\3721.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\3721.net]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\cnnic.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\baidu.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\cnnic.cn]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\com.cn]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\com.cn\*.cnnic]
"*"=dword:00000004

[psac]

XP的寫法:加上網易泡泡的CLSID（yeah.net）
===========================================
Windows Registry Editor Version 5.00

#B83FC273-3522-4CC6-92EC-75CC86678DA4 /3721
#9A578C98-3C2F-4630-890B-FC04196EF420 /cnnic
#00000566-0000-0010-8000-00AA006D2EA4 /Adodb.Stream 2.7
#4B106874-DD36-11D0-8B44-00A024DD9EFF /Adodb.Stream 2.5
#CF051549-EDE1-40F5-B440-BCD646CF2C25 /popo

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4B106874-DD36-11D0-8B44-00A024DD9EFF}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9A578C98-3C2F-4630-890B-FC04196EF420}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CF051549-EDE1-40F5-B440-BCD646CF2C25}]
"Compatibility Flags"=dword:00000400

==================================
另一:
windows 98( 3721,CNNIC,POPO,中文郵,BaiDu 等免疫修正檔-BanActiveX,包括了佰度的。)
如下:


REGEDIT4


#B83FC273-3522-4CC6-92EC-75CC86678DA4 /3721
#9A578C98-3C2F-4630-890B-FC04196EF420 /CNNIC
#CF051549-EDE1-40F5-B440-BCD646CF2C25 /POPO
#4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686 /中文郵
#BC207F7D-3E63-4ACA-99B5-FB5F8428200C /Baidu
#9BBC1154-218D-453C-97F6-A06582224D81 /Baidu
#00000566-0000-0010-8000-00AA006D2EA4 /Adodb.Stream 2.7
#4B106874-DD36-11D0-8B44-00A024DD9EFF /Adodb.Stream 2.5


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B83FC273-3522-4CC6-92EC-75CC86678DA4}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9A578C98-3C2F-4630-890B-FC04196EF420}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CF051549-EDE1-40F5-B440-BCD646CF2C25}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4EDBBAEA-F509-49F6-94D1-ECEC4BE5B686}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BC207F7D-3E63-4ACA-99B5-FB5F8428200C}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9BBC1154-218D-453C-97F6-A06582224D81}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}]
"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4B106874-DD36-11D0-8B44-00A024DD9EFF}]
"Compatibility Flags"=dword:00000400