/HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Search "SearchAssistant" = res://%43%3a%5c%6c%69%6f%6d%2e%64%6c%6c/%73%70%2e%68%74%6d%6c /HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\CmdMapping "NextId" = /HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\CmdMapping "{c95fe080-8f5d-11d2-a20b-00aa003c157b}" =

Trojan/StartPage.Liom

病毒类型：木马

危害等级：*

影响平台：Win9X/2000/XP/NT/Me

Trojan/StartPage.Liom修改IE默认页和搜索页，是个dll控件，该控件程序中没有卸载代码，导致注册后无法卸载。该控件插入ie进程，每次打开则显示自己资源中的html广告程序。

传播过程及特征：

1.创建文件：

%SystemDir%\\config\\software, 6115328字节

2.修改注册表：

病毒通过修改下列注册表键值，改变IE默认主页等信息：

/HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main

"Search Page" = res://%43%3a%5c%6c%69%6f%6d%2e%64%6c%6c/%73%70%2e%68%74%6d%6c

/HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main

"Start Page" = about:blank

/HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main

"HOMEOldSP" = about:blank

/HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main

"Search Bar" = res://%43%3a%5c%6c%69%6f%6d%2e%64%6c%6c/%73%70%2e%68%74%6d%6c

/HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main

"Use Search Asst" = no

/HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main

"Use Custom Search URL" =