清理助手扫出的，请高手看看

shxzj

清理助手扫出的,提示为system木马

位置：

C:\WINDOWS\system32\ie.exe

Palkia

IObit　　０

卡巴　０

瑞星　０

Palkia

解压后获得４个ｉｃｏ文件，安全的

１个ｒｅｇ文件，改主页，添加收藏。。

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.852456.com/"

[HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
@=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,\
  00,69,00,6c,00,65,00,73,00,5c,00,49,00,6e,00,74,00,65,00,72,00,6e,00,65,00,\
  74,00,20,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,5c,00,69,00,65,\
  00,78,00,70,00,6c,00,6f,00,72,00,65,00,2e,00,65,00,78,00,65,00,20,00,68,00,\
  74,00,74,00,70,00,3a,00,2f,00,2f,00,77,00,77,00,77,00,2e,00,38,00,35,00,32,00,34,\
  00,35,00,36,00,2e,00,63,00,6f,00,6d,00,2f,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{6096E38F-5AC1-4391-8EC4-75DFA92FB32F}]
"CLSID"="{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"
"Default Visible"="Yes"
"ButtonText"="游戏下载"
"Exec"="http://www.yxjidi.com/?from=gj"
"HotIcon"="%windir%\\system32\\djxyjd.ICO"
"Icon"="%windir%\\system32\\djxyjd.ICO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{6096E38F-5AC1-4391-8EC4-75DFA92FB33F}]
"CLSID"="{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"
"Default Visible"="Yes"
"ButtonText"="网址大全"
"Exec"="http://www.852456.com/?from=gj"
"HotIcon"="%windir%\\system32\\852456.ICO"
"Icon"="%windir%\\system32\\852456.ICO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{6096E38F-5AC1-4391-8EC4-75DFA92FB34F}]
"CLSID"="{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"
"Default Visible"="Yes"
"ButtonText"="淘宝网"
"Exec"="http://www.852456.com/upimg/taobao.html?gj"
"HotIcon"="%windir%\\system32\\taobao.ICO"
"Icon"="%windir%\\system32\\taobao.ICO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{6096E38F-5AC1-4391-8EC4-75DFA92FB34F}]
"CLSID"="{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"
"Default Visible"="Yes"
"ButtonText"="爱电影"
"Exec"="http://www.2m2m2m.cn/?gj"
"HotIcon"="%windir%\\system32\\dy.ICO"
"Icon"="%windir%\\system32\\dy.ICO"

schumi小粉

2009-08-21 17:58:00    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\ie\ie.exe
文件路径:C:\WINDOWS\regedit.exe
命令行:/s 852456.reg
触发规则:所有程序规则->A02…禁止运行的高危程序（黑名单）->%windir%\*


2009-08-21 17:58:00    运行应用程序      操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\ie\ie.exe
文件路径:C:\WINDOWS\regedit.exe
命令行:/s 852456.reg
触发规则:所有程序规则->A02…禁止运行的高危程序（黑名单）->%windir%\*

星空下的吻

卡巴 miss

shxzj

噢，明白了，谢谢以上朋友