PUA.Win32.SoftCNApp.CZ
2025年8月8日
:
HEUR:AdWare.Win32.Tahao.gen (KASPERSKY)
平台:
Windows
总体风险等级:
潜在破坏:
潜在分布:
感染次数:
信息暴露:
恶意软件类型:
Potentially Unwanted Application
有破坏性？:
没有
加密？:
In the Wild:
是的
概要
感染途徑: 从互联网下载、由其他恶意软件释放
该潜在不受欢迎应用（PUA）通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。
技术详细信息
文件大小: 9,262,984 bytes
报告日期: EXE
内存驻留: 没有
初始樣本接收日期: 2025年7月31日
Payload: 连接URL/IP地址, 释放文件, 修改系统注册表
Arrival Details
该潜在不受欢迎应用（PUA）通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。
Installation
该潜在不受欢迎应用程序（PUA）会添加以下文件夹：
- %AppDataLocal%\TTPlayer
- %Program Files%\TTPlayer
- %Program Files%\TTPlayer\AddIn
- %Program Files%\Baidu
(Note: %AppDataLocal% 是本地应用程序数据文件夹, 通常位于此路径 C:\Documents and Settings\{user name}\Local Settings\Application Data 在Windows 2000（32位）、XP及Server 2003（32位）系统上，或 C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% 是默认的程序安装文件夹, 通常位于此路径 C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)
它会释放以下文件：
- %User Temp%\nsn912A.tmp
- %User Temp%\nsn912B.tmp\System.dll
- %User Temp%\nsn912B.tmp\nsSkinEngine.dll
- %User Temp%\TTPlayer.exe
- %User Temp%\nsn912B.tmp\nsTTHelper.dll
- %User Temp%\BaiduASBarSilent.exe
- %User Temp%\BaiduBarSilent.exe
- %User Temp%\hao123inst.exe
- %User Temp%\nsn912B.tmp\inetc.dll
- %AppDataLocal%\TTPlayer\Light.png
- %AppDataLocal%\TTPlayer\ProgressShallow.png
- %AppDataLocal%\TTPlayer\ProgressSolid.png
- %AppDataLocal%\TTPlayer\backgroud.png
- %AppDataLocal%\TTPlayer\bottom.png
- %AppDataLocal%\TTPlayer\btn_agree.png
- %AppDataLocal%\TTPlayer\btn_cancel2.png
- %AppDataLocal%\TTPlayer\btn_changedir.png
- %AppDataLocal%\TTPlayer\cancel.png
- %AppDataLocal%\TTPlayer\close.png
- %AppDataLocal%\TTPlayer\cover.png
- %AppDataLocal%\TTPlayer\exclamation.png
- %AppDataLocal%\TTPlayer\finish.png
- %AppDataLocal%\TTPlayer\install.png
- %AppDataLocal%\TTPlayer\logo.png
- %AppDataLocal%\TTPlayer\minimize.png
- %AppDataLocal%\TTPlayer\multiselect.png
- %AppDataLocal%\TTPlayer\nav01.png
- %AppDataLocal%\TTPlayer\nav02.png
- %AppDataLocal%\TTPlayer\nav03.png
- %AppDataLocal%\TTPlayer\nav04.png
- %AppDataLocal%\TTPlayer\nav05.png
- %AppDataLocal%\TTPlayer\next.png
- %AppDataLocal%\TTPlayer\popup.png
- %AppDataLocal%\TTPlayer\prev.png
- %AppDataLocal%\TTPlayer\rotate1.png
- %AppDataLocal%\TTPlayer\rotate2.png
- %AppDataLocal%\TTPlayer\splitter.png
- %AppDataLocal%\TTPlayer\title.png
- %AppDataLocal%\TTPlayer\uninstall_face.png
- %AppDataLocal%\TTPlayer\uninstall_face01.png
- %AppDataLocal%\TTPlayer\Licence.txt
- %AppDataLocal%\TTPlayer\skin.txt
- %AppDataLocal%\TTPlayer\unskin.txt
- %AppDataLocal%\TTPlayer\app.ico
- %AppDataLocal%\TTPlayer\setup.ico
- %AppDataLocal%\TTPlayer\uninstall.ico
- %Program Files%\TTPlayer\autoupdate.ini
- %Program Files%\TTPlayer\FAQ.txt
- %Program Files%\TTPlayer\Update.txt
- %Program Files%\TTPlayer\updatebanner.bmp
- %Program Files%\TTPlayer\update.ico
- %Program Files%\TTPlayer\NetworkConfig.xml
- %Program Files%\TTPlayer\TTPlayer.exe
- %Program Files%\TTPlayer\ttpsvr.exe
- %Program Files%\TTPlayer\bdupdate.exe
- %Program Files%\TTPlayer\bdaucommon.dll
- %Program Files%\TTPlayer\ttpres.dll
- %Program Files%\TTPlayer\ttpcomm.dll
- %Program Files%\TTPlayer\BaiduMusicCtrl.dll
- %Program Files%\TTPlayer\MHttp.dll
- %Program Files%\TTPlayer\MLocalData.dll
- %Program Files%\TTPlayer\MNet.dll
- %Program Files%\TTPlayer\mp3PRO.dll
- %Program Files%\TTPlayer\msvcp100.dll
- %Program Files%\TTPlayer\msvcr100.dll
- %Program Files%\TTPlayer\MUpDownload.dll
- %Program Files%\TTPlayer\netacc.dll
- %Program Files%\TTPlayer\tak_deco_lib.dll
- %Program Files%\TTPlayer\AddIn\ttp_aac.dll
- %Program Files%\TTPlayer\AddIn\ttp_ac3dts.dll
- %Program Files%\TTPlayer\AddIn\ttp_ape.dll
- %Program Files%\TTPlayer\AddIn\ttp_asf.dll
- %Program Files%\TTPlayer\AddIn\ttp_clienc.dll
- %Program Files%\TTPlayer\AddIn\ttp_enc.dll
- %Program Files%\TTPlayer\AddIn\ttp_flac.dll
- %Program Files%\TTPlayer\AddIn\ttp_lrcsh.dll
- %Program Files%\TTPlayer\AddIn\ttp_mod.dll
- %Program Files%\TTPlayer\AddIn\ttp_mpc.dll
- %Program Files%\TTPlayer\AddIn\ttp_ogg.dll
- %Program Files%\TTPlayer\AddIn\ttp_rm.dll
- %Program Files%\TTPlayer\AddIn\ttp_tak.dll
- %Program Files%\TTPlayer\Skin\Let's Seven.skn
- %Program Files%\TTPlayer\Skin\PurpleMyth.skn
- %Program Files%\TTPlayer\Skin\TTP Classic.skn
- %Program Files%\TTPlayer\Skin\Thebes.skn
- %Program Files%\TTPlayer\Skin\WMP10.skn
- %Program Files%\TTPlayer\Skin\Winamp Modern.skn
- %Program Files%\TTPlayer\Skin\orange.skn
- %Program Files%\Baidu\bdsyn\1.0.5.0\BaiduApkCtrl.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\Uninst.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\apkprocess.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\autoupdate.ini
- %Program Files%\Baidu\bdsyn\1.0.5.0\bdaucommon.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\bdupdate.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\AdbWinApi.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\AdbWinUsbApi.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ApkMgr.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\aapt.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\dummyInstall.txt
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdaemon.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdev32.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdev64_amd.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdev64_ia.exe
- %Program Files%\TTPlayer\Uninst.exe
- %AppDataLocal%\TTPlayer\ThirdPartConfig.xml
- %Desktop%\千千靜聽百度音樂版.lnk
- %Application Data%\Microsoft\Internet Explorer\Quick Launch\千千靜聽（百度音樂版）.lnk
- %User Temp%\bdg139.tmp
- %Application Data%\Mozilla\Firefox\Profiles\dxxbjsgn.default\prefs2.js
- %Application Data%\baidu\hao123\hao123.1.0.0.1096.exe
- %Common Programs%\千千靜聽（百度音樂版）\千千靜聽（百度音樂版）.lnk
- %Common Programs%\千千靜聽（百度音樂版）\卸載千千靜聽（百度音樂版）.lnk
- %User Temp%\nsc243.tmp
- %Program Files%\Baidu\AddressBar.dll
- %User Temp%\nsx61A.tmp
- %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll
- %Desktop%\hao123.lnk
- %Common Programs%\台灣hao123桌面版\hao123.lnk
- %Common Programs%\台灣hao123桌面版\解除安裝hao123.lnk
- %Application Data%\Microsoft\Internet Explorer\Quick Launch\hao123.lnk
- %Program Files%\Baidu\conf.xml
- %Program Files%\Baidu\ASBarBroker.exe
- %All Users Profile%\Baidu\ttplayercht\AutoUpdate\updatelog\autoupdate_20250806104407_2320.log
- %Program Files%\Baidu\BaiduUpdate\bdupdate.exe
- %Program Files%\Baidu\BaiduUpdate\bdaucommon.dll
- %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll
- sers\dyituser_732\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\hao123.lnk
- %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe
- \AppData\Local\Temp\BaiduBarSilent.execreate
- %Program Files%\Baidu\Toolbar\BaiduBarX.dll
- %Program Files%\Baidu\Toolbar\BarBroker.exe
- %Program Files%\Baidu\Toolbar\rc.dll
- %Common Programs%\百度工具栏\屏蔽列表.url
- %Common Programs%\百度工具栏\伴侣导航.url
- %Common Programs%\百度工具栏\帮助指南.url
- %Common Programs%\百度工具栏\广告拦截.url
- %Common Programs%\百度工具栏\垃圾清理.url
- %Common Programs%\百度工具栏\修复功能.url
- %Common Programs%\百度工具栏\隐私保护.url
- %Common Programs%\百度工具栏\个性化首页.url
- %Common Programs%\百度工具栏\自定义按钮.url
- %Common Programs%\百度工具栏\卸载百度工具栏.lnk
- %Common Programs%\Startup\千千靜聽（百度音樂版）.lnk
- %AppDataLocal%\TTPlayer\feedback
- %Program Files%\TTPlayer\dummyInstall.txt
(Note: %User Temp% 是当前用户的临时文件夹,通常位于此路径 C:\Documents and Settings\{user name}\Local Settings\Temp 在Windows 2000（32位）、XP及Server 2003（32位）系统上，或 C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% 是本地应用程序数据文件夹, 通常位于此路径 C:\Documents and Settings\{user name}\Local Settings\Application Data 在Windows 2000（32位）、XP及Server 2003（32位）系统上，或 C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% 是默认的程序安装文件夹, 通常位于此路径 C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Desktop% 此处指当前用户的桌面目录，通常位于 C:\Documents and Settings\{User Name}\Desktop 在Windows 2000（32位）、XP及Server 2003（32位）系统上，或 C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% 是当前用户的 Application Data 文件夹，通常路径为：C:\Documents and Settings\{user name}\Application Data 在Windows 2000（32位）、XP及Server 2003（32位）系统上，或 C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Common Programs% 该文件夹包含所有用户的公用程序组，通常位于 C:\Documents and Settings\All Users\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %All Users Profile% 是常规用户配置文件文件夹，通常位于 C:\Documents and Settings\All Users 在Windows 2000（32位）、XP及Server 2003（32位）系统上，或 C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )
它会添加以下进程：
- %User Temp%\BaiduBarSilent.exe -TN=44059078_cb
- %User Temp%\BaiduASBarSilent.exe -TN=44059078_adr
- %User Temp%\hao123inst.exe tn=44059078_2_hao_pg
- %Program Files%\TTPlayer\bdupdate.exe" --installgau
- %User Temp%\hao123inst.exenew processfirst_exec_from_inst
- %User Temp%\BaiduBarSilent.exenew process"%Program Files%\Baidu\Toolbar\BarBroker.exe" -RegServer
(Note: %User Temp% 是当前用户的临时文件夹,通常位于此路径 C:\Documents and Settings\{user name}\Local Settings\Temp 在Windows 2000（32位）、XP及Server 2003（32位）系统上，或 C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% 是默认的程序安装文件夹, 通常位于此路径 C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)
其他系统修改
此潜在不受欢迎程序添加了以下注册表项：
HKEY_CURRENT_USER\Software\Baidu\
TTPlayer
oemid = 44059078
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Baidu.ApkCtrl.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Baidu.ApkCtrl.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Baidu.ApkCtrl
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Baidu.ApkCtrl\CurVer
其他信息
该潜在不受欢迎应用程序（PUA）会添加以下注册表项:
HKEY_CURRENT_USER\Software\Baid
HKEY_CURRENT_USER\Software\Baidu\
TTPlayer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Baidu.ApkCtrl.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Baidu.ApkCtrl.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Baidu.ApkCtrl
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Baidu.ApkCtrl\CurVer
它连接到以下可疑的网址：
- http://{BLOCKED}anmini.baidu.com/app/passport/passport_phoenix.html
- http://{BLOCKED}k.qianqian.com/poprecommend/pop.php?ver=7.1.0&ci=18646d5527585a5c264444141c464808425e5353011d01&oemid=44059078
- http://{BLOCKED}k.qianqian.com/packs.html?id=44059078&ver=458752&cht=0&shownum=3
- http://{BLOCKED}nt.baidu.com/hao123/desk/tw/update-tw?ver=1096.0.0.2.1:ggMAAAAAAQAAAEe450wAAKgA++WbO-FSMUeHn0uJgfsmQgIAAAAjuudMAGATADdVvqXR8GZMlhMQgRmocuUCAAAA87jnTABwWwB2oQGMmH0wSI1Lr98OvrdFAgAAAN2550wA4AIApWb+EsP7y0aj+4XZCo92qQIAAAAA&ver4=MAA=&ver5=OGMyNzQ5ZDA3OTE0OTg4ZWQ4MzAyNTg1ZTk2NWJlNzMA
- http://{BLOCKED}anqian.com/dll/ttp_ver.asp?ver=7.1.0.0718&id=44059078&ci=18646d5527585a5c264444141c464808425e5353011d01&skn=5454506C617965725F3630&ska=5454706C61796572&fst=1&hp=0&lrc=0&TTPSvr=1
- http://{BLOCKED}nc.qianqian.com/dll/ttp_ver.asp?ver=7.1.0.0718&id=44059078&ci=18646d5527585a5c264444141c464808425e5353011d01&skn=5454506C617965725F3630&ska=5454706C61796572&fst=1&hp=0&lrc=0&TTPSvr=1
- http://{BLOCKED}t.qianqian.com/dll/ttp_ver.asp?ver=7.1.0.0718&id=44059078&ci=18646d5527585a5c264444141c464808425e5353011d01&skn=5454506C617965725F3630&ska=5454706C61796572&fst=1&hp=0&lrc=0&TTPSvr=1
- http://{BLOCKED}t2.qianqian.com/dll/ttp_ver.asp?ver=7.1.0.0718&id=44059078&ci=18646d5527585a5c264444141c464808425e5353011d01&skn=5454506C617965725F3630&ska=5454706C61796572&fst=1&hp=0&lrc=0&TTPSvr=1
解决方案
最小扫描引擎: 9.800
SSAPI样式文件: 2.861.00
SSAPI样式发布日期: 2025年8月7日
Step 1
在进行任何扫描之前，Windows 7、Windows 8、Windows 8.1 和 Windows 10 用户必须先执行以下操作： 禁用 系统还原 以便对电脑进行全面扫描。
Step 2
注意：在此恶意软件/间谍软件/灰色软件执行期间，并非所有文件、文件夹和注册表键值和项都会安装到您的计算机上。这可能是由于不完整的安装或其他操作系统条件所致。如果您没有找到相同的文件/文件夹/注册表信息，请继续进行下一步操作。
Step 3
删除此注册表项
[ 更多 ]
Important: 编辑 Windows Registry 操作不当可能导致系统出现无法恢复的故障。请务必仅在您熟悉相关步骤的情况下执行；如有疑问，可寻求系统管理员的协助。否则，请查看下方链接。 Microsoft article 修改计算机注册表前请务必先进行此操作.
- In HKEY_CURRENT_USER\Software\Baidu
- In HKEY_CURRENT_USER\Software\Baidu\TTPlayer
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Baidu.ApkCtrl.1
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Baidu.ApkCtrl.1\CLSID
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Baidu.ApkCtrl
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Baidu.ApkCtrl\CurVer
要删除此恶意软件/灰色软件创建的注册表项：
- 打开注册表编辑器。 为此，请执行以下操作:
» 对于 Windows 7 和 Server 2008 (R2) 用户，请点击 Start button, type regedit in the Search输入字段，然后按下Enter.
» 对于 Windows 8、8.1、10 及 Server 2012 (R2) 用户，请右键单击屏幕左下角，点击 Run, type regedit 在提供的文本框中，然后点击 Enter. - 在注册表编辑器窗口的左侧面板中，双击以下项目：
HKEY_CURRENT_USER>Software>Baidu - 仍在左侧面板中，找到并删除以下注册表项：
HKEY_CURRENT_USER>Software>Baidu>TTPlayer - 关闭注册表编辑器。
Step 4
删除此注册表值
[ 更多 ]
Important: 编辑 Windows Registry 操作不当可能导致系统出现无法恢复的故障。请务必仅在您熟悉相关步骤的情况下执行；如有疑问，可寻求系统管理员的协助。否则，请查看下方链接。 Microsoft article 修改计算机注册表前请务必先进行此操作.
- In HKEY_CURRENT_USER\Software\Baidu\TTPlayer
- oemid = 44059078
- oemid = 44059078
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Baidu.ApkCtrl.1
- = BaiduApkCtrl Class
- = BaiduApkCtrl Class
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Baidu.ApkCtrl.1\CLSID
- = {CLSID}
- = {CLSID}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Baidu.ApkCtrl
- = aiduApkCtrl Class
- = aiduApkCtrl Class
- In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Baidu.ApkCtrl\CurVer
- = Baidu.ApkCtrl.1
- = Baidu.ApkCtrl.1
要删除此恶意软件创建的注册表值：
- 打开注册表编辑器。 为此，请执行以下操作:
» 对于 Windows 7 和 Windows Server 2008 (R2) 用户，请点击 Start button, type regedit in the Search输入字段，然后按下Enter.
» 对于 Windows 8、Windows 8.1、10 及 Windows Server 2012 (R2) 用户，请右键单击屏幕左下角，点击 Run, type regedit 在提供的文本框中，然后点击 Enter. - 在注册表编辑器窗口的左侧面板中，双击以下项目：
HKEY_CURRENT_USER>Software>Baidu>TTPlayer - 在右侧面板中，找到并删除以下条目：
oemid = 44059078 - 在注册表编辑器窗口的左侧面板中，双击以下项目：
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Baidu.ApkCtrl.1 - 在右侧面板中，找到并删除以下条目：
= BaiduApkCtrl Class - 在注册表编辑器窗口的左侧面板中，双击以下项目：
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Baidu.ApkCtrl.1>CLSID - 在右侧面板中，找到并删除以下条目：
= {CLSID} - 在注册表编辑器窗口的左侧面板中，双击以下项目：
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Baidu.ApkCtrl - 在右侧面板中，找到并删除以下条目：
= aiduApkCtrl Class - 在注册表编辑器窗口的左侧面板中，双击以下项目：
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Baidu.ApkCtrl>CurVer - 在右侧面板中，找到并删除以下条目：
= Baidu.ApkCtrl.1 - 关闭注册表编辑器。
Step 5
搜索并删除此文件夹
[ 更多 ]
请确保勾选搜索隐藏文件和文件夹;/i>选项 复选框（位于“更多高级选项”中），以便将全部隐藏文件夹纳入搜索结果。 - %AppDataLocal%\TTPlayer
- %Program Files%\TTPlayer
- %Program Files%\TTPlayer\AddIn
- %Program Files%\Baidu
要删除恶意软件/灰色软件文件夹：
- 右键单击“开始”按钮，然后点击 Search... or Find..., 根据您运行的 Windows 版本选择相应操作。
- 在“名称”输入框中键入：
- %AppDataLocal%\TTPlayer
- %Program Files%\TTPlayer
- %Program Files%\TTPlayer\AddIn
- %Program Files%\Baidu
- 在Look In 下拉列表，选择 My Computer，然后按Enter键。
- 定位到该文件夹后，选中并按 Shift+Delete 组合键将其永久删除。
Step 6
搜索并删除此文件
[ 更多 ]
某些文件可能被隐藏，请务必勾选 搜索隐藏的文件和文件夹 勾选框 "更多进阶选项" 选项，以在搜索结果中包含所有隐藏的文件和文件夹。 - %User Temp%\nsn912A.tmp
- %User Temp%\nsn912B.tmp\System.dll
- %User Temp%\nsn912B.tmp\nsSkinEngine.dll
- %User Temp%\TTPlayer.exe
- %User Temp%\nsn912B.tmp\nsTTHelper.dll
- %User Temp%\BaiduASBarSilent.exe
- %User Temp%\BaiduBarSilent.exe
- %User Temp%\hao123inst.exe
- %User Temp%\nsn912B.tmp\inetc.dll
- %AppDataLocal%\TTPlayer\Light.png
- %AppDataLocal%\TTPlayer\ProgressShallow.png
- %AppDataLocal%\TTPlayer\ProgressSolid.png
- %AppDataLocal%\TTPlayer\backgroud.png
- %AppDataLocal%\TTPlayer\bottom.png
- %AppDataLocal%\TTPlayer\btn_agree.png
- %AppDataLocal%\TTPlayer\btn_cancel2.png
- %AppDataLocal%\TTPlayer\btn_changedir.png
- %AppDataLocal%\TTPlayer\cancel.png
- %AppDataLocal%\TTPlayer\close.png
- %AppDataLocal%\TTPlayer\cover.png
- %AppDataLocal%\TTPlayer\exclamation.png
- %AppDataLocal%\TTPlayer\finish.png
- %AppDataLocal%\TTPlayer\install.png
- %AppDataLocal%\TTPlayer\logo.png
- %AppDataLocal%\TTPlayer\minimize.png
- %AppDataLocal%\TTPlayer\multiselect.png
- %AppDataLocal%\TTPlayer\nav01.png
- %AppDataLocal%\TTPlayer\nav02.png
- %AppDataLocal%\TTPlayer\nav03.png
- %AppDataLocal%\TTPlayer\nav04.png
- %AppDataLocal%\TTPlayer\nav05.png
- %AppDataLocal%\TTPlayer\next.png
- %AppDataLocal%\TTPlayer\popup.png
- %AppDataLocal%\TTPlayer\prev.png
- %AppDataLocal%\TTPlayer\rotate1.png
- %AppDataLocal%\TTPlayer\rotate2.png
- %AppDataLocal%\TTPlayer\splitter.png
- %AppDataLocal%\TTPlayer\title.png
- %AppDataLocal%\TTPlayer\uninstall_face.png
- %AppDataLocal%\TTPlayer\uninstall_face01.png
- %AppDataLocal%\TTPlayer\Licence.txt
- %AppDataLocal%\TTPlayer\skin.txt
- %AppDataLocal%\TTPlayer\unskin.txt
- %AppDataLocal%\TTPlayer\app.ico
- %AppDataLocal%\TTPlayer\setup.ico
- %AppDataLocal%\TTPlayer\uninstall.ico
- %Program Files%\TTPlayer\autoupdate.ini
- %Program Files%\TTPlayer\FAQ.txt
- %Program Files%\TTPlayer\Update.txt
- %Program Files%\TTPlayer\updatebanner.bmp
- %Program Files%\TTPlayer\update.ico
- %Program Files%\TTPlayer\NetworkConfig.xml
- %Program Files%\TTPlayer\TTPlayer.exe
- %Program Files%\TTPlayer\ttpsvr.exe
- %Program Files%\TTPlayer\bdupdate.exe
- %Program Files%\TTPlayer\bdaucommon.dll
- %Program Files%\TTPlayer\ttpres.dll
- %Program Files%\TTPlayer\ttpcomm.dll
- %Program Files%\TTPlayer\BaiduMusicCtrl.dll
- %Program Files%\TTPlayer\MHttp.dll
- %Program Files%\TTPlayer\MLocalData.dll
- %Program Files%\TTPlayer\MNet.dll
- %Program Files%\TTPlayer\mp3PRO.dll
- %Program Files%\TTPlayer\msvcp100.dll
- %Program Files%\TTPlayer\msvcr100.dll
- %Program Files%\TTPlayer\MUpDownload.dll
- %Program Files%\TTPlayer\netacc.dll
- %Program Files%\TTPlayer\tak_deco_lib.dll
- %Program Files%\TTPlayer\AddIn\ttp_aac.dll
- %Program Files%\TTPlayer\AddIn\ttp_ac3dts.dll
- %Program Files%\TTPlayer\AddIn\ttp_ape.dll
- %Program Files%\TTPlayer\AddIn\ttp_asf.dll
- %Program Files%\TTPlayer\AddIn\ttp_clienc.dll
- %Program Files%\TTPlayer\AddIn\ttp_enc.dll
- %Program Files%\TTPlayer\AddIn\ttp_flac.dll
- %Program Files%\TTPlayer\AddIn\ttp_lrcsh.dll
- %Program Files%\TTPlayer\AddIn\ttp_mod.dll
- %Program Files%\TTPlayer\AddIn\ttp_mpc.dll
- %Program Files%\TTPlayer\AddIn\ttp_ogg.dll
- %Program Files%\TTPlayer\AddIn\ttp_rm.dll
- %Program Files%\TTPlayer\AddIn\ttp_tak.dll
- %Program Files%\TTPlayer\Skin\Let's Seven.skn
- %Program Files%\TTPlayer\Skin\PurpleMyth.skn
- %Program Files%\TTPlayer\Skin\TTP Classic.skn
- %Program Files%\TTPlayer\Skin\Thebes.skn
- %Program Files%\TTPlayer\Skin\WMP10.skn
- %Program Files%\TTPlayer\Skin\Winamp Modern.skn
- %Program Files%\TTPlayer\Skin\orange.skn
- %Program Files%\Baidu\bdsyn\1.0.5.0\BaiduApkCtrl.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\Uninst.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\apkprocess.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\autoupdate.ini
- %Program Files%\Baidu\bdsyn\1.0.5.0\bdaucommon.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\bdupdate.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\AdbWinApi.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\AdbWinUsbApi.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ApkMgr.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\aapt.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\dummyInstall.txt
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdaemon.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdev32.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdev64_amd.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdev64_ia.exe
- %Program Files%\TTPlayer\Uninst.exe
- %AppDataLocal%\TTPlayer\ThirdPartConfig.xml
- %Desktop%\千千靜聽百度音樂版.lnk
- %Application Data%\Microsoft\Internet Explorer\Quick Launch\千千靜聽（百度音樂版）.lnk
- %User Temp%\bdg139.tmp
- %Application Data%\Mozilla\Firefox\Profiles\dxxbjsgn.default\prefs2.js
- %Application Data%\baidu\hao123\hao123.1.0.0.1096.exe
- %Common Programs%\千千靜聽（百度音樂版）\千千靜聽（百度音樂版）.lnk
- %Common Programs%\千千靜聽（百度音樂版）\卸載千千靜聽（百度音樂版）.lnk
- %User Temp%\nsc243.tmp
- %Program Files%\Baidu\AddressBar.dll
- %User Temp%\nsx61A.tmp
- %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll
- %Desktop%\hao123.lnk
- %Common Programs%\台灣hao123桌面版\hao123.lnk
- %Common Programs%\台灣hao123桌面版\解除安裝hao123.lnk
- %Application Data%\Microsoft\Internet Explorer\Quick Launch\hao123.lnk
- %Program Files%\Baidu\conf.xml
- %Program Files%\Baidu\ASBarBroker.exe
- %All Users Profile%\Baidu\ttplayercht\AutoUpdate\updatelog\autoupdate_20250806104407_2320.log
- %Program Files%\Baidu\BaiduUpdate\bdupdate.exe
- %Program Files%\Baidu\BaiduUpdate\bdaucommon.dll
- %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll
- sers\dyituser_732\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\hao123.lnk
- %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe
- \AppData\Local\Temp\BaiduBarSilent.execreate
- %Program Files%\Baidu\Toolbar\BaiduBarX.dll
- %Program Files%\Baidu\Toolbar\BarBroker.exe
- %Program Files%\Baidu\Toolbar\rc.dll
- %Common Programs%\百度工具栏\屏蔽列表.url
- %Common Programs%\百度工具栏\伴侣导航.url
- %Common Programs%\百度工具栏\帮助指南.url
- %Common Programs%\百度工具栏\广告拦截.url
- %Common Programs%\百度工具栏\垃圾清理.url
- %Common Programs%\百度工具栏\修复功能.url
- %Common Programs%\百度工具栏\隐私保护.url
- %Common Programs%\百度工具栏\个性化首页.url
- %Common Programs%\百度工具栏\自定义按钮.url
- %Common Programs%\百度工具栏\卸载百度工具栏.lnk
- %Common Programs%\Startup\千千靜聽（百度音樂版）.lnk
- %AppDataLocal%\TTPlayer\feedback
- %Program Files%\TTPlayer\dummyInstall.txt
要手动从受感染系统中删除恶意软件/灰色软件文件：
•适用于 Windows 7、Windows Server 2008 (R2)、Windows 8、Windows 8.1、Windows 10 及 Windows Server 2012 (R2)：
- 打开 Windows 资源管理器窗口。
- 对于 Windows 7 和 Server 2008 (R2) 用户：点击Start>Computer.
- 对于 Windows 8、8.1、10 及 Server 2012 (R2) 用户： 右键单击 屏幕左下角，然后点击File Explorer.
- 在搜索计算机/此电脑输入框中，键入：
- %User Temp%\nsn912A.tmp
- %User Temp%\nsn912B.tmp\System.dll
- %User Temp%\nsn912B.tmp\nsSkinEngine.dll
- %User Temp%\TTPlayer.exe
- %User Temp%\nsn912B.tmp\nsTTHelper.dll
- %User Temp%\BaiduASBarSilent.exe
- %User Temp%\BaiduBarSilent.exe
- %User Temp%\hao123inst.exe
- %User Temp%\nsn912B.tmp\inetc.dll
- %AppDataLocal%\TTPlayer\Light.png
- %AppDataLocal%\TTPlayer\ProgressShallow.png
- %AppDataLocal%\TTPlayer\ProgressSolid.png
- %AppDataLocal%\TTPlayer\backgroud.png
- %AppDataLocal%\TTPlayer\bottom.png
- %AppDataLocal%\TTPlayer\btn_agree.png
- %AppDataLocal%\TTPlayer\btn_cancel2.png
- %AppDataLocal%\TTPlayer\btn_changedir.png
- %AppDataLocal%\TTPlayer\cancel.png
- %AppDataLocal%\TTPlayer\close.png
- %AppDataLocal%\TTPlayer\cover.png
- %AppDataLocal%\TTPlayer\exclamation.png
- %AppDataLocal%\TTPlayer\finish.png
- %AppDataLocal%\TTPlayer\install.png
- %AppDataLocal%\TTPlayer\logo.png
- %AppDataLocal%\TTPlayer\minimize.png
- %AppDataLocal%\TTPlayer\multiselect.png
- %AppDataLocal%\TTPlayer\nav01.png
- %AppDataLocal%\TTPlayer\nav02.png
- %AppDataLocal%\TTPlayer\nav03.png
- %AppDataLocal%\TTPlayer\nav04.png
- %AppDataLocal%\TTPlayer\nav05.png
- %AppDataLocal%\TTPlayer\next.png
- %AppDataLocal%\TTPlayer\popup.png
- %AppDataLocal%\TTPlayer\prev.png
- %AppDataLocal%\TTPlayer\rotate1.png
- %AppDataLocal%\TTPlayer\rotate2.png
- %AppDataLocal%\TTPlayer\splitter.png
- %AppDataLocal%\TTPlayer\title.png
- %AppDataLocal%\TTPlayer\uninstall_face.png
- %AppDataLocal%\TTPlayer\uninstall_face01.png
- %AppDataLocal%\TTPlayer\Licence.txt
- %AppDataLocal%\TTPlayer\skin.txt
- %AppDataLocal%\TTPlayer\unskin.txt
- %AppDataLocal%\TTPlayer\app.ico
- %AppDataLocal%\TTPlayer\setup.ico
- %AppDataLocal%\TTPlayer\uninstall.ico
- %Program Files%\TTPlayer\autoupdate.ini
- %Program Files%\TTPlayer\FAQ.txt
- %Program Files%\TTPlayer\Update.txt
- %Program Files%\TTPlayer\updatebanner.bmp
- %Program Files%\TTPlayer\update.ico
- %Program Files%\TTPlayer\NetworkConfig.xml
- %Program Files%\TTPlayer\TTPlayer.exe
- %Program Files%\TTPlayer\ttpsvr.exe
- %Program Files%\TTPlayer\bdupdate.exe
- %Program Files%\TTPlayer\bdaucommon.dll
- %Program Files%\TTPlayer\ttpres.dll
- %Program Files%\TTPlayer\ttpcomm.dll
- %Program Files%\TTPlayer\BaiduMusicCtrl.dll
- %Program Files%\TTPlayer\MHttp.dll
- %Program Files%\TTPlayer\MLocalData.dll
- %Program Files%\TTPlayer\MNet.dll
- %Program Files%\TTPlayer\mp3PRO.dll
- %Program Files%\TTPlayer\msvcp100.dll
- %Program Files%\TTPlayer\msvcr100.dll
- %Program Files%\TTPlayer\MUpDownload.dll
- %Program Files%\TTPlayer\netacc.dll
- %Program Files%\TTPlayer\tak_deco_lib.dll
- %Program Files%\TTPlayer\AddIn\ttp_aac.dll
- %Program Files%\TTPlayer\AddIn\ttp_ac3dts.dll
- %Program Files%\TTPlayer\AddIn\ttp_ape.dll
- %Program Files%\TTPlayer\AddIn\ttp_asf.dll
- %Program Files%\TTPlayer\AddIn\ttp_clienc.dll
- %Program Files%\TTPlayer\AddIn\ttp_enc.dll
- %Program Files%\TTPlayer\AddIn\ttp_flac.dll
- %Program Files%\TTPlayer\AddIn\ttp_lrcsh.dll
- %Program Files%\TTPlayer\AddIn\ttp_mod.dll
- %Program Files%\TTPlayer\AddIn\ttp_mpc.dll
- %Program Files%\TTPlayer\AddIn\ttp_ogg.dll
- %Program Files%\TTPlayer\AddIn\ttp_rm.dll
- %Program Files%\TTPlayer\AddIn\ttp_tak.dll
- %Program Files%\TTPlayer\Skin\Let's Seven.skn
- %Program Files%\TTPlayer\Skin\PurpleMyth.skn
- %Program Files%\TTPlayer\Skin\TTP Classic.skn
- %Program Files%\TTPlayer\Skin\Thebes.skn
- %Program Files%\TTPlayer\Skin\WMP10.skn
- %Program Files%\TTPlayer\Skin\Winamp Modern.skn
- %Program Files%\TTPlayer\Skin\orange.skn
- %Program Files%\Baidu\bdsyn\1.0.5.0\BaiduApkCtrl.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\Uninst.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\apkprocess.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\autoupdate.ini
- %Program Files%\Baidu\bdsyn\1.0.5.0\bdaucommon.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\bdupdate.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\AdbWinApi.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\AdbWinUsbApi.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ApkMgr.dll
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\aapt.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\dummyInstall.txt
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdaemon.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdev32.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdev64_amd.exe
- %Program Files%\Baidu\bdsyn\1.0.5.0\APKMgr\ttpdev64_ia.exe
- %Program Files%\TTPlayer\Uninst.exe
- %AppDataLocal%\TTPlayer\ThirdPartConfig.xml
- %Desktop%\千千靜聽百度音樂版.lnk
- %Application Data%\Microsoft\Internet Explorer\Quick Launch\千千靜聽（百度音樂版）.lnk
- %User Temp%\bdg139.tmp
- %Application Data%\Mozilla\Firefox\Profiles\dxxbjsgn.default\prefs2.js
- %Application Data%\baidu\hao123\hao123.1.0.0.1096.exe
- %Common Programs%\千千靜聽（百度音樂版）\千千靜聽（百度音樂版）.lnk
- %Common Programs%\千千靜聽（百度音樂版）\卸載千千靜聽（百度音樂版）.lnk
- %User Temp%\nsc243.tmp
- %Program Files%\Baidu\AddressBar.dll
- %User Temp%\nsx61A.tmp
- %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll
- %Desktop%\hao123.lnk
- %Common Programs%\台灣hao123桌面版\hao123.lnk
- %Common Programs%\台灣hao123桌面版\解除安裝hao123.lnk
- %Application Data%\Microsoft\Internet Explorer\Quick Launch\hao123.lnk
- %Program Files%\Baidu\conf.xml
- %Program Files%\Baidu\ASBarBroker.exe
- %All Users Profile%\Baidu\ttplayercht\AutoUpdate\updatelog\autoupdate_20250806104407_2320.log
- %Program Files%\Baidu\BaiduUpdate\bdupdate.exe
- %Program Files%\Baidu\BaiduUpdate\bdaucommon.dll
- %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll
- sers\dyituser_732\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\hao123.lnk
- %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe
- \AppData\Local\Temp\BaiduBarSilent.execreate
- %Program Files%\Baidu\Toolbar\BaiduBarX.dll
- %Program Files%\Baidu\Toolbar\BarBroker.exe
- %Program Files%\Baidu\Toolbar\rc.dll
- %Common Programs%\百度工具栏\屏蔽列表.url
- %Common Programs%\百度工具栏\伴侣导航.url
- %Common Programs%\百度工具栏\帮助指南.url
- %Common Programs%\百度工具栏\广告拦截.url
- %Common Programs%\百度工具栏\垃圾清理.url
- %Common Programs%\百度工具栏\修复功能.url
- %Common Programs%\百度工具栏\隐私保护.url
- %Common Programs%\百度工具栏\个性化首页.url
- %Common Programs%\百度工具栏\自定义按钮.url
- %Common Programs%\百度工具栏\卸载百度工具栏.lnk
- %Common Programs%\Startup\千千靜聽（百度音樂版）.lnk
- %AppDataLocal%\TTPlayer\feedback
- %Program Files%\TTPlayer\dummyInstall.txt
- 定位到该文件后，选中并按 SHIFT+DELETE 将其删除。
*Note:阅读以下微软官方页面 若上述步骤在 Windows 7 和 Windows Server 2008 (R2) 系统上无效：
Step 7
使用您的亚信安全产品扫描电脑，删除被检测为以下名称的文件 PUA.Win32.SoftCNApp.CZ. 若亚信安全产品已将检测到的文件清除、删除或隔离，则无需再执行任何额外步骤；您也可选择直接删除隔离区中的文件。更多信息请访问以下亚信安全支持页面：