Excuse me, 372 1, is Yahoo Internet Assistant a rogue software?

Please leave my machine.

I always thought that my computer security was in place, but I still didn't know when rogue software was installed in the machine. For such a well-known domestic software enterprise, rogue software is said.

It doesn't seem appropriate. After all, people have good intentions, but I think of a joke. A kind man helped the blind cross the road, but the blind didn't want to cross the road at all. He was dragged over by others.

It's a pity that I feel so blind. That 372 1 helped me get on the Chinese website! ! ! And I was afraid that I wouldn't install the software, so I installed it for me without my knowledge.

I think the boss of 372 1 is right in front of me, and I will not hesitate to thank him with my fist.

This is just a software installation! Just uninstall. I thought so at first. Although I heard that 372 1 can't be uninstalled completely, I still can't help but open the add and remove program under the control panel-huh?

Wrong, there is really no unloading place.

It doesn't bother me. I am an old bird, but what happened next made me feel ashamed.

Open Task Manager and kill all suspicious processes. Rundll32.exe can't kill them. Fortunately, the ntsd command of XP can kill the process, and then find C:\WINDOWS\DOWNLO~ 1\ and.

C: \ Windows \ downlo ~1\ 3721\ directory, delete all files, and then press F5. I thought my eyes were spent. Why is the file still there? It will take some time if I delete them again.

Come back again. These are the two bugs.

c:\ WINDOWS \ DOWNLO ~ 1 \ 372 1 \ cnshake . dll

c:\ WINDOWS \ DOWNLO ~ 1 \ 372 1 \ cns min . dll

Forget it, first clear the registry, open the registry, find the above two dll files, find a lot of registry keys, and delete a word without hesitation. The results are as follows:

-

An error occurred while deleting the item.

-

Cannot delete {d157330a-9EF3-49F8-9A67-4141ac41add4}: There was an error deleting the item.

-

of course

-

I already want to smash things when I think of the documents I want tomorrow. I suppressed my anger, entered the safe mode, and spent a lot of effort to delete N files and dozens of registry keys. After restarting, I finally can't see the evil.

My heart is 372 1. I know there is another 372 1 in my machine. I also know that I can't afford to spend time on it, so work first is very important.

I thought of those non-computer majors during the break. Are they forced to accept 372 1 or modify the machine? Instant reloading, God knows when 372 1 will come again. All the time.

As we all know, domestic websites are full of deceptive advertisements. For example, a website has a MM video with you. Do you accept it? The interface is exactly the same as QQ. It's clicked. It must be a boring website.

Contact. Or, you have a new update, do you want to install it, and so on. ..

It is exasperating that these companies are still hypocritical and seem to have made great contributions to China's information industry. Who will punish them? I am a person who lives by technology, and I am good at dealing with such initiators.

I just want to say: hit his grandson.

You must first understand the truth behind 372 1.

This is an article about the Pacific computer network. I'm interested in reading it:

/pcedu/soft/wl/assist/0406/402500 . html

After learning to surf the Internet, I thought I was in a more convenient world. However, this free and convenient world is ruled by 372 1

For five years, he plundered and ruled the capital crazily.

Since the establishment of 1998, 372 1 has always cherished the dream of Microsoft's browser and tried to build a network standard in China. It took 372 1 five years to spread his real name to 90% of China netizens through various channels and means, and this is the abundant capital accumulated by 372/kloc-0 during its five-year rule of China Internet. 372 1 This plug-in is a Chinese Internet tool on the surface, but in fact it uses a simple virus principle to control netizens behind it.

Fool China netizens with simple techniques.

Such a 372 1 under the banner of "simple surfing" has even become synonymous with "garbage" in the eyes of programmers.

Go to any website where programmers gather and check the comments related to 372 1 news. More than 90% of them are attacks on 372 1, even insults. Some programmers even mark on their personal websites: "If you are a supporter of 372 1, don't install this program. I don't welcome and refuse its supporters to use this program! "

First of all, programmers are never active in the technology of 372 1. In the programmer's view, there is really no technology to match domain names with Chinese words through client software.

At first, the software of 372 1 was distributed in the form of client, mainly through cooperation with websites, but this way was easily rejected or deleted by users. Soon, 372 1 adopted the activex technical standard issued by Microsoft, and turned the client into a browser plug-in. It should be said that many softwares are developed with activex technology, such as flash animation playing plug-in and Microsoft media player plug-in. This way is understandable, but 372 1 did not respect the wishes of users when implementing this way, but inevitably popped up harassment dialogs on various websites and forced installation. Some programmers said, "No matter how the software is written, one thing is certain. Developers and strategists lack the minimum professional ethics. How many of the so-called 20 million users voluntarily installed it? How many are stepping on mines? " At the same time, in some early versions, there were cases that caused users to crash and were widely spread.

So 372 1 seems to be deliberately doing some work against programmers. In order to prevent uninstallation and deletion, various technical means are adopted in the software. A programmer said, "Now the plug-in of 372 1 is becoming more and more overbearing. I not only modified the registry, but also kept running in your system, pretending to be myself. After I deleted cmin*. Dll, I checked it with winhex and renamed it run! And if you use softice to tune the program, the dll of 372 1 will always make trouble! " 372 1 is painstakingly adding various skills, some of which are exactly the same as the Trojan virus. All the software of 372 1 has a back door on your computer, which is the way for 372 1 to enter the depths of your computer. 372 1 When I was spying on you, you didn't know.

From the programmer's point of view, it is an insult to bring disgrace to oneself of 372 1 and China Internet to rape users' will with some skills of software development!

However, 372 1 chose to insult the Internet in China and the netizens in China in order to ensure its own profit source and a shameless dream.

Underworld means to seize territory

However, 372 1 destroyed many netizens' basic right to use when they realized their dreams. Many unsuspecting netizens have been influenced by the dream of 372 1 after downloading the 372 1 plug-in unintentionally. The plug-in of 372 1 was also monitored when 90% of Internet users in China turned on their computers and started surfing the Internet.

Some netizens who know technology wrote in the comments on the forum: Some websites have not been very smooth these two days. At first, I thought it was a network problem, and other websites were normal, which ruled out the network reason. After removing the virus, I decompiled the only browser-related program in his computer-3721network real-name plug-in. When he saw the program code of 372 1, he said, "I was scared out in a cold sweat. It turns out that this program has a back door, and no one knows this back door. Other programs of 372 1 are accessed through this back door. In this program, I found a piece of code, which is the code to block those websites. Behind this code, there is a long list of familiar websites, some of which are blocked and some of which have not been enabled. This code is like a robot. After this code, if you add/

Then Sina. Com will be blocked and cannot be accessed.

372 1 In order to keep his online real-name business, he had to keep the promotion of other plug-ins. This is how 372 1 threatened and forced many websites to plug him in. But many websites dare to be angry and dare not speak. * * * website is one of the victims, besides him, there is a long list.

327 1 is like the underworld of China Internet. He knows all the information in your computer. He occupies the Internet belonging to netizens in China, dividing him into his own territory and firmly controlling it. Even portal giants such as Sina, Sohu, Netease and qq are afraid of the arrogance of 372 1 and dare to get angry in front of 372 1.

372 1 Who's in charge?

Looking through the laws of the Internet, there is no regulation on the practice of 372 1, and even no administrative department or legislator at any level is aware of this problem. 372 1 is using its own laws to do whatever it wants and make its own rules of the game. Everyone should bow down and pay tribute.

On the one hand, he secretly installed it for netizens, on the other hand, he cruelly forced other websites to plug him in, otherwise he would "block" uncooperative websites. After all, he already owns 90% of the shares. On the one hand, he made money by publicly selling online real names, and even threatened Peking University. If he doesn't buy this word, he sells it to others.

Three policies make money openly and operate China Internet generously. The principles of equality, freedom and openness advocated by the Internet have disappeared before the interests of 372 1. The department that was originally deployed from top to bottom was helpless and even unaware of him.

The Internet in China is still dominated by 372 1 ... Who will take care of it? Nobody cares, nobody dares to care.

372 1 Company has repeatedly challenged the endurance and endurance of netizens. Constantly improve the technology, so that netizens can't block the real-name client of the company network. In the face of angry condemnation and spontaneous blocking actions of netizens, 372 1 Company is obviously prepared to fight against these unruly netizens at all costs.

Recently, we found that 372 1 company further improved their "anti-"shielding technology. In this way, the network real-name client will "permanently" reside in the user's computer system, even if the user chooses to uninstall the client. Unless the user reinstalls his computer system, the program cannot be cleaned manually.

When users browse the web, the installation window pops up, which neither uses the agreement nor shows the publishing company of the program, which is a serious fraud. At the same time, the program will not establish a "legal" program installation directory in the user's computer, and the user can't find the installed program in his computer system by general means, which undoubtedly seriously endangers the user's computer security.

Regarding the behavior of 372 1, some legal experts believe that 372 1 Company has seriously violated the relevant provisions in the Administrative Measures for the Security Protection of Computer Information Networks International Networking promulgated and implemented by People's Republic of China (PRC) and the State Council 1997, as well as the relevant contents of the Consumer Protection Law of People's Republic of China (PRC).

Here, on behalf of those users who suffer from the real name "virus" of 372 1 network, we condemn this immoral behavior of 372 1 company. Moreover, it is hoped that the relevant state departments will take this incident seriously, standardize the market order and create a good market environment.

Some netizens think that 372 1 client software has some virus properties.

1 is protected at the device driver layer, and starts immediately when it is turned on, even in safe mode. The name of this device is cnsminkp, and the driver is located in windows system 32 drivers cnsminkp.sys.

Once 2 cnsminkp.sys is loaded, the driver cannot be uninstalled by command, that is, net stop cnsminkp cannot stop the driver. The filing date of cnsminkp.sys is February-15, 2004, which was released only a few days ago.

3 The driver constantly detects whether cnsminkp.sys exists and whether cnsminkp.sys exists. If not, it will immediately rebuild the two files, and constantly check the registry under the service and software to ensure that the parameters of cnsminkp service are consistent with their settings. If it is changed, it will be restored immediately. In addition, ensure that cnsmin.dll participates in the election.

This stubborn way is determined to leave cnsminkp.sys and cnsminkp.sys in memory and hard disk, which makes the system performance decline rapidly.

Does cnsminkp.sys mean cnsminkep or cnsminkelprotect? As long as you have cnsminkp.sys under windowssystem32drivers, you will be caught.

The following are some comments from netizens in Mu Zi Studio.

User comments:

372 1 is not completely useless. For most people who are not familiar with home computers, he can still start from an early age. But most people still don't like it. He's a Trojan horse!

User comments:

Now the 372 1 plug-in can't see the name of its own company, and it is becoming more and more hidden.

User comments:

Some functions of 372 1 are quite good, but this practice is unbearable.

User comments:

Knowing the principle of 372 1, it seems that people are always watching what you are doing. My heart is always awkward, let me reinstall! !

User comments:

Making such software is an insult to our programmers.

Introduction and download of KusTa Reg Angel V 1.0.0+ software;

KusTa Reg Angel v 1.0.0+ (dozens of registry restores, 372 1, Baidu, CNNIC, Netease Bubble, etc. 100).

It's really annoying that friends who often surf the Internet often encounter various dialogs (such as "372 1 real name of network" \ "Baidu search \" ...) asking you to authenticate a plug-in. This software is specially used to screen these annoying dialogs, and can screen 1 10 dialogs.

The immunity of ActiveX control only blocks the corresponding installation window, so it will not affect your normal browsing of web pages and using installed plug-ins; This version does not contain immune function, and the next version will be improved. It is recommended that you back up the registry before applying the exemption. This program has passed the test under Win 2K adv+IE 6.