這種病毒怎麽清除? 特洛伊木馬（Trojan horse）
完整的木馬程序壹般由兩個部份組成：壹個是服務器程序，壹個是控制器程序。“中了木馬”就是指安裝了木馬的服務器程序，若妳的電腦被安裝了服務器程序，則擁有控制器程序的人就可以通過網絡控制妳的電腦、為所欲為，這時妳電腦上的各種文件、程序，以及在妳電腦上使用的帳號、密碼就無安全可言了。
木馬程序不能算是壹種病毒，但越來越多的新版的殺毒軟件，已開始可以查殺壹些木馬了，所以也有不少人稱木馬程序為黑客病毒。
特洛伊木馬是如何啟動的
1. 在Win.ini中啟動
在Win.ini的[windows]字段中有啟動命令"load＝"和"run＝"，在壹般情況下 "＝"後面是空白的，如果有後跟程序，比方說是這個樣子：
run=c:\windows\file.exe
load=c:\windows\file.exe
要小心了，這個file.exe很可能是木馬哦。
2.在System.ini中啟動
System.ini位於Windows的安裝目錄下，其[boot]字段的shell=Explorer.exe是木馬喜歡的隱藏加載之所，木馬通常的做法是將該何變為這樣:shell=Explorer.exefile.exe。註意這裏的file.exe就是木馬服務端程序!
另外，在System.中的[386Enh]字段，要註意檢查在此段內的"driver＝路徑\程序名"這裏也有可能被木馬所利用。再有，在System.ini中的[mic]、[drivers]、[drivers32]這3個字段，這些段也是起到加載驅動程序的作用，但也是增添木馬程序的好場所，現在妳該知道也要註意這裏嘍。
3.利用註冊表加載運行
如下所示註冊表位置都是木馬喜好的藏身加載之所，趕快檢查壹下，有什麽程序在其下。
4.在Autoexec.bat和Config.sys中加載運行
請大家註意，在C盤根目錄下的這兩個文件也可以啟動木馬。但這種加載方式壹般都需要控制端用戶與服務端建立連接後，將己添加木馬啟動命令的同名文件上傳到服務端覆蓋這兩個文件才行，而且采用這種方式不是很隱蔽。容易被發現，所以在Autoexec.bat和Confings中加載木馬程序的並不多見，但也不能因此而掉以輕心。
5.在Winstart.bat中啟動
Winstart.bat是壹個特殊性絲毫不亞於Autoexec.bat的批處理文件，也是壹個能自動被Windows加載運行的文件。它多數情況下為應用程序及Windows自動生成，在執行了Windows自動生成，在執行了Win.com並加截了多數驅動程序之後
開始執行 (這壹點可通過啟動時按F8鍵再選擇逐步跟蹤啟動過程的啟動方式可得知)。由於Autoexec.bat的功能可以由Witart.bat代替完成，因此木馬完全可以像在Autoexec.bat中那樣被加載運行，危險由此而來。
6.啟動組
木馬們如果隱藏在啟動組雖然不是十分隱蔽，但這裏的確是自動加載運行的好場所，因此還是有木馬喜歡在這裏駐留的。啟動組對應的文件夾為C:\Windows\start menu\programs\startup,在註冊表中的位置:HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Explorer\shell
Folders Startup="c:\windows\start menu\programs\startup"。要註意經常檢查啟動組哦!
7.*.INI
即應用程序的啟動配置文件，控制端利用這些文件能啟動程序的特點，將制作好的帶有木馬啟動命令的同名文件上傳到服務端覆蓋這同名文件，這樣就可以達到啟動木馬的目的了。只啟動壹次的方式:在winint.ini.中(用於安裝較多)。
8.修改文件關聯
修改文件關聯是木馬們常用手段 (主要是國產木馬，老外的木馬大都沒有這個功能)，比方說正常情況下TXT文件的打開方式為Notepad.EXE文件，但壹旦中了文件關聯木馬，則txt文件打開方式就會被修改為用木馬程序打開，如著名的國產木馬冰河就是這樣幹的. "冰河"就是通過修改HKEY_CLASSES_ROOT\txtfile\whell\open\command下的鍵值，將“C:\WINDOWS\NOTEPAD.EXE本應用Notepad打開，如著名的國產HKEY壹CLASSES壹ROOT\txt鬧e\shell\open\commandT的鍵值，將 "C:\WINDOWS\NOTEPAD.EXE%l"改為 "C:\WINDOWS\SYSTEM\SYSEXPLR.EXE%l"，這樣，壹旦妳雙擊壹個TXT文件，原本應用Notepad打開該文件，現在卻變成啟動木馬程序了，好狠毒哦!請大家註意，不僅僅是TXT文件，其他諸如HTM、EXE、ZIP.COM等都是木馬的目標，要小心摟。
對付這類木馬，只能經常檢查HKEY_C\shell\open\command主鍵，查看其鍵值是否正常。
9.捆綁文件
實現這種觸發條件首先要控制端和服務端已通過木馬建立連接，然後控制端用戶用工具軟件將木馬文件和某壹應用程序捆綁在壹起，然後上傳到服務端覆蓋源文件，這樣即使木馬被刪除了，只要運行捆綁了木馬的應用程序，木馬義會安裝上去。綁定到某壹應用程序中，如綁定到系統文件，那麽每壹次Windows啟動均會啟動木馬。
10.反彈端口型木馬的主動連接方式
反彈端口型木馬我們已經在前面說過了，由於它與壹般的木馬相反，其服務端 (被控制端)主動與客戶端 (控制端)建立連接，並且監聽端口壹般開在80，所以如果沒有合適的工具、豐富的經驗真的很難防範。這類木馬的典型代表就是網絡神偷"。由於這類木馬仍然要在註冊表中建立鍵值註冊表的變化就不難查到它們。同時，最新的天網防火墻(如我們在第三點中所講的那樣)，因此只要留意也可在網絡神偷服務端進行主動連接時發現它。
WORM_NUGACHE.G(威金)和TROJ_CLAGGE.B 特洛伊木馬（Trojan horse）
的解決方案:
WORM_NUGACHE.G(威金)
病毒碼發布日期: Dec 8, 2006
解決方案:
Note: To fully remove all associated malware, perform the clean solution for TROJ_DLOADER.IBZ.
Terminating the Malware Program
This procedure terminates the running malware process.
Open Windows Task Manager.
On Windows 98 and ME, pressCTRL+ALT+DELETE
On Windows NT, 2000, XP, and Server 2003, pressCTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the process:
MSTC.EXE
Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.
On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.
Editing the Registry
This malware modifies the computer's registry. Users affected by this malware may need to modify or delete specific registry keys or entries. For detailed information regarding registry editing, please refer to the following articles from Microsoft:
HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows ME
HOW TO: Backup, Edit, and Restore the Registry in Windows NT 4.0
HOW TO: Backup, Edit, and Restore the Registry in Windows 2000
HOW TO: Back Up, Edit, and Restore the Registry in Windows XP and Server 2003
Removing Autostart Entries from the Registry
Removing autostart entries from the registry prevents the malware from executing at startup.
If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
Microsoft Domain Controller = "%System%\mstc.exe"
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP and Server 2003.)
Removing Added Key from the Registry
Still in Registry Editor, in the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE
In the left panel, locate and delete the following key:
GNU
Close Registry Editor.
Important Windows ME/XP Cleaning Instructions
Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.
Users running other Windows versions can proceed with the succeeding solution set(s).
Running Trend Micro Antivirus
If you are currently running in safe mode, please restart your computer normally before performing the following solution.
Scan your computer with Trend Micro antivirus and delete files detected as WORM_NUGACHE.G. To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner.
Applying Patch
This malware exploits known vulnerability in Windows. Download and install the fix patch supplied by Microsoft. Refrain from using this product until the appropriate patch has been installed. Trend Micro advises users to download critical patches upon release by vendors.
TROJ_CLAGGE.B 特洛伊木馬（Trojan horse）
病毒碼發布日期: Sep 18, 2006
解決方案:
Identifying the Malware Program
To remove this malware, first identify the malware program.
Scan your computer with your Trend Micro antivirus product.
NOTE the path and file name of all files detected as TROJ_CLAGGE.B.
Trend Micro customers need to download the latest virus pattern file before scanning their computer. Other users can use Housecall, the Trend Micro online virus scanner.
Editing the Registry
This malware modifies the computer's registry. Users affected by this malware may need to modify or delete specific registry keys or entries. For detailed information regarding registry editing, please refer to the following articles from Microsoft:
HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows ME
HOW TO: Backup, Edit, and Restore the Registry in Windows NT 4.0
HOW TO: Backup, Edit, and Restore the Registry in Windows 2000
HOW TO: Back Up, Edit, and Restore the Registry in Windows XP and Server 2003
Removing Malware Entry from the Registry
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>
SharedAccess>Parameters>FiREWaLLpolicy>StAnDaRDPrOFiLe>
AUtHorizedapplications>List
In the right panel, locate and delete the entry:
{Malware path and file name} ="{Malware path and file name}:*:ENABLED:0"
Close Registry Editor.
Important Windows ME/XP Cleaning Instructions
Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.
Users running other Windows versions can proceed with the succeeding solution set(s).
Running Trend Micro Antivirus
If you are currently running in safe mode, please restart your computer normally before performing the following solution.
Scan your computer with Trend Micro antivirus and delete files detected as TROJ_CLAGGE.B and TROJ_KEYLOG.CO. To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner