Trojan.StartPage 生成%temp%/se.dll的清除方法

比较牛，搞了半天搞不定，请出了google，下面是symantec的解决方法：
http://securityresponse.symantec.com/avcenter/venc/data/trojan.startpage.m.html

删除方法：

1.禁用系统还原

2.删除注册表中的信息

3.Click Start > Run.
Type regedit
Click OK.

4.展开HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run

删除键值："sp" = "rundll32 %temp%/se.dll,DllInstall"

 

5.展开HKEY_CLASSES_ROOT/PROTOCOLS/Filter/text/html
HKEY_CLASSES_ROOT/PROTOCOLS/Filter/text/plain

删除键值："CLSID" = "{2862736E-7B27-418A-A4E8-F13FB2E8C945}"

 

6.删除HKEY_CLASSES_ROOT/CLSID/{2862736E-7B27-418A-A4E8-F13FB2E8C945}
HKEY_CLASSES_ROOT/CLSID/{5607D0D5-3205-45F2-A125-63666696DDA0}

 

7.删除相关文件

 

8.修复IE属性设置，包含首页和搜索页等，最好用工具，手工修改请查看

http://support.microsoft.com/kb/320159/zh-cn

http://support.microsoft.com/kb/323869/

 




Technical Details

When Trojan.StartPage.M is executed, it performs the following actions:


Drops the file %Temp%/se.dll.

Note: %Temp% is a variable that refers to the Windows temporary folder. By default, this is C:/Windows/TEMP (Windows 95/98/Me/XP) or C:/WINNT/Temp (Windows NT/2000).


Registers itself as a Browser Helper Object by creating and populating the following registry subkeys:

HKEY_CLASSES_ROOT/CLSID/{2862736E-7B27-418A-A4E8-F13FB2E8C945}
HKEY_CLASSES_ROOT/CLSID/{5607D0D5-3205-45F2-A125-63666696DDA0}


Adds the value:

"CLSID" = "{2862736E-7B27-418A-A4E8-F13FB2E8C945}"

to the registry subkeys:

HKEY_CLASSES_ROOT/PROTOCOLS/Filter/text/html
HKEY_CLASSES_ROOT/PROTOCOLS/Filter/text/plain

to register itself as a protocol filter. This enables the Trojan to modify content displayed in Internet Explorer.


Adds the value:

"sp" = "rundll32 %temp%/se.dll,DllInstall"

to the registry subkey:

HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run