比较牛,搞了半天搞不定,请出了google,下面是symantec的解决方法:
http://securityresponse.symantec.com/avcenter/venc/data/trojan.startpage.m.html
删除方法:
1.禁用系统还原
2.删除注册表中的信息
3.Click Start > Run.
Type regedit
Click OK.
Type regedit
Click OK.
4.展开HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
删除键值:"sp" = "rundll32 %temp%/se.dll,DllInstall"
5.展开HKEY_CLASSES_ROOT/PROTOCOLS/Filter/text/html
HKEY_CLASSES_ROOT/PROTOCOLS/Filter/text/plain
HKEY_CLASSES_ROOT/PROTOCOLS/Filter/text/plain
删除键值:"CLSID" = "{2862736E-7B27-418A-A4E8-F13FB2E8C945}"
6.删除HKEY_CLASSES_ROOT/CLSID/{2862736E-7B27-418A-A4E8-F13FB2E8C945}
HKEY_CLASSES_ROOT/CLSID/{5607D0D5-3205-45F2-A125-63666696DDA0}
HKEY_CLASSES_ROOT/CLSID/{5607D0D5-3205-45F2-A125-63666696DDA0}
7.删除相关文件
8.修复IE属性设置,包含首页和搜索页等,最好用工具,手工修改请查看
http://support.microsoft.com/kb/320159/zh-cn
Technical Details
When Trojan.StartPage.M is executed, it performs the following actions:
Drops the file %Temp%/se.dll.
Note: %Temp% is a variable that refers to the Windows temporary folder. By default, this is C:/Windows/TEMP (Windows 95/98/Me/XP) or C:/WINNT/Temp (Windows NT/2000).
Registers itself as a Browser Helper Object by creating and populating the following registry subkeys:
HKEY_CLASSES_ROOT/CLSID/{2862736E-7B27-418A-A4E8-F13FB2E8C945}
HKEY_CLASSES_ROOT/CLSID/{5607D0D5-3205-45F2-A125-63666696DDA0}
Adds the value:
"CLSID" = "{2862736E-7B27-418A-A4E8-F13FB2E8C945}"
to the registry subkeys:
HKEY_CLASSES_ROOT/PROTOCOLS/Filter/text/html
HKEY_CLASSES_ROOT/PROTOCOLS/Filter/text/plain
to register itself as a protocol filter. This enables the Trojan to modify content displayed in Internet Explorer.
Adds the value:
"sp" = "rundll32 %temp%/se.dll,DllInstall"
to the registry subkey:
HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run