关注恶意软件：

名称：“万能劫持器”的木马程序（Trojan.Win32.StartPage.alnf）

大小：397 KB

是否加壳：否

创建文件：

C:\Program Files\Commonn\gaokaoshiti.doc
C:\Program Files\Commonn\ppt564.exe
C:\Program Files\Commonn\淘宝.ico
C:\Documents and Settings\All Users\桌面\高考试题.doc
C:\Program Files\Internet Explorer\SIGNUP\iexplore.exe
C:\Program Files\Common Files\System\Config.xml
C:\Program Files\Common Files\System\360se_s.ini
C:\Documents and Settings\Administrator\Application Data\360se\360se_s.ini
C:\WINDOWS\sCommon.reg

修改注册表：

HKLM\SOFTWARE\MICROSOFT\Windows Script Host\Settings\Enabled = 0x1
HKLM\SOFTWARE\Classes\InternetShortcut\IsShortcut
HKLM\SOFTWARE\Classes\.ie\(Default) = "ie"
HKLM\SOFTWARE\Classes\.tao\(Default) = "tao"
HKLM\SOFTWARE\Classes\.360\(Default) = "360"
HKLM\SOFTWARE\Classes\.360js\(Default) = "360js"
HKLM\SOFTWARE\Classes\.max\(Default) = "max"
HKLM\SOFTWARE\Classes\.sogou\(Default) = "sogou"
HKLM\SOFTWARE\Classes\.qqtt\(Default) = "qqtt"
HKLM\SOFTWARE\Classes\.qqb\(Default) = "qqb"
HKLM\SOFTWARE\Classes\.world\(Default) = "world"
HKLM\SOFTWARE\Classes\.fox\(Default) = "fox"
HKLM\SOFTWARE\Classes\.tang\(Default) = "tang"
HKLM\SOFTWARE\Classes\.worldjs\(Default) = "worldjs"
HKLM\SOFTWARE\Classes\.gb\(Default) = "gb"
HKLM\SOFTWARE\Classes\.opera\(Default) = "opera"
HKLM\SOFTWARE\Classes\.115\(Default) = "115"
HKLM\SOFTWARE\Classes\.114\(Default) = "114"
HKLM\SOFTWARE\Classes\.155\(Default) = "155"
HKLM\SOFTWARE\Classes\.mayi\(Default) = "mayi"
HKLM\SOFTWARE\Classes\.saayaa\(Default) = "saayaa"
HKLM\SOFTWARE\Classes\ie\DefaultIcon\(Default) = "C:\Program Files\Internet Explorer\iexplore.exe"
HKLM\SOFTWARE\Classes\ie\Shell\Open\Command\(Default) = "C:\Program Files\Internet Explorer\iexplore.exe "http://www.atudou.com/?ie""
HKLM\SOFTWARE\Classes\tao\DefaultIcon\(Default) = "C:\Program Files\Commonn\淘宝.ico"
HKLM\SOFTWARE\Classes\tao\Shell\Open\Command\(Default) = "C:\Program Files\Internet Explorer\iexplore.exe "http://www.taobao.com/go/chn/channel/onsale.php?pid=mm_10030262_0_0&eventid=1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\36Osafe.exe\(Default) = "C:\WINDOWS\sCommon.reg"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\36Osafe.exe\Path = "C:\WINDOWS"
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{450D8FBA-AD25-11D0-98A8-0800361B1103} = 0x0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{20D04FE0-3AEA-1069-A2D8-08002B30309D} = 0x0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{208D2C60-3AEA-1069-A2D7-08002B30309D} = 0x0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{871C5380-42A0-1069-A2EA-08002B30309D} = 0x1
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu\{871C5380-42A0-1069-A2EA-08002B30309D = 0x1
HKLM\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\(Default) = "Internet Explorer"
HKLM\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\DefaultIcon\(Default) = "c:\Program Files\Internet Explorer\IEXPLORE.EXE"
HKLM\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)\Command\(Default) = ""c:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.yayouku.com/?1122"
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktopCleanupWizard = 0x1
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon = 0x1
HKLM\SOFTWARE\Classes\CLSID\{1FC674B4-80EA-48B4-BF43-EDA49682432D}\Shell\Internet Explorer\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://www.yayouku.com/?1122"
HKLM\SOFTWARE\Classes\CLSID\{1FC674B4-80EA-48B4-BF43-EDA49682432D}\Shell\淘宝-购物(&H)\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_10030262_0_0"
HKLM\SOFTWARE\Classes\CLSID\{E3156F3C-CDE1-4F1C-A207-4C5D5EEB836C}\Shell\Internet Explorer\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://www.yayouku.com/?1122"
HKLM\SOFTWARE\Classes\CLSID\{E3156F3C-CDE1-4F1C-A207-4C5D5EEB836C}\Shell\淘宝-购物(&H)\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_10030262_0_0"
HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93250894D8E}\shell\Open\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://www.yayouku.com/?1122"
HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93250894D8E}\shell\淘宝-购物(&H)\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_10030262_0_0"
HKCR\CLSID\{9227D36E-2FA6-4B82-813C-E265B490226D}\shell\OpenHomePage\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://www.yayouku.com/?1122"
HKCR\CLSID\{9227D36E-2FA6-4B82-813C-E265B490226D}\shell\淘宝-购物(&H)\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_10030262_0_0"
HKCU\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://www.yayouku.com/?1122"
HKCR\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\淘宝-购物(&H)\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_10030262_0_0"
HKCR\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\OpenHomePage\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://www.yayouku.com/?1122"
HKCR\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shell\淘宝-购物(&H)\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_10030262_0_0"
HKCR\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\打开主页(&H)\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://www.yayouku.com/?1122"
HKCR\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\淘宝-购物(&H)\Command\(Default) = "C:\progra~1\Intern~1\iexplore.exe http://pindao.huoban.taobao.com/channel/channelCode.htm?pid=mm_10030262_0_0"
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.yayouku.com/?1122"
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.yayouku.com/?1122"
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.yayouku.com/?1122"

行为描述：

该木马会将自身伪装成高考试题，诱骗用户下载和运行。木马执行时，会释放“高考试题.doc”并在前台显示。在后台悄悄的修改用户注册表设置，修改浏览器默认首页、隐藏桌面IE图标、创建新的IE快捷方式并且无法删除。

值得注意的是，该木马程序不仅会劫持IE浏览器，还能够劫持目前几乎全部主流和非主流浏览器，其中包括Firefox、Opera、360安全浏览器、傲游浏览器、世界之窗、搜狗浏览器、115浏览器等。对这些浏览器进行有针对的查询，修改设置，劫持用户的互联网访问并进行恶意推广。

目前，卡巴斯基所有产品均可以对其查杀。

专家预防建议:

建立良好的安全习惯，不打开可疑邮件和可疑网站。

不要随意接收聊天工具上传送的文件以及打开发过来的网站链接。

使用移动介质时最好使用鼠标右键打开使用，必要时先要进行扫描。

现在有很多利用系统漏洞传播的病毒，所以给系统打全补丁也很关键。

安装专业的防毒软件升级到最新版本，并开启实时监控功能。

为本机管理员账号设置较为复杂的密码，预防病毒通过密码猜测进行传播，最好是数字与字母组合的密码。

不要从不可靠的渠道下载软件，因为这些软件很可能是带有病毒的。