McAfee > Theat Center > Virus Detail Page

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

This is a trojan that modifies the Internet Explorer search and start page settings.

A Registry key is added to hook system startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\
  CurrentVersion\Run "dllhelp" = %WinDir%\dllhelp.exe

This trojan expects to be run from the Windows directory, which would imply that this trojan is dropped or installed by another trojan.

The following registry changes will be made to modify the Internet Explorer settings:

• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\ Main "Search Bar" = http://your-searcher.com/sp.htm
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use Search Asst" = no
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl "(Default)" = http://your-searcher.com/index.htm
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Search Page" = http://your-searcher.com/index.htm
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Start Page" = http://your-searcher.com/index.htm
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl "provider" = gogl
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search "SearchAssistant" = http://your-searcher.com/sp.htm

The following shortcut will be added to the Favorites list:

• FREE HIDDEN CAMS WORLD.url
• FREE SPY CAM.url
• FREE WEB CAMS CHATS.url
• GET THIS 4 FREE.url

The trojan may modify the HOSTS file but the modifications are not harmful.

Symptoms

• Modified default start page and search page in Internet Explorer.
• File and registry changes listed above.
• Additional links in the Favorites list.
• Modified HOSTS file.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Characteristics

Characteristics -

This is a trojan that modifies the Internet Explorer search and start page settings.

A Registry key is added to hook system startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\
  CurrentVersion\Run "dllhelp" = %WinDir%\dllhelp.exe

This trojan expects to be run from the Windows directory, which would imply that this trojan is dropped or installed by another trojan.

The following registry changes will be made to modify the Internet Explorer settings:

• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\ Main "Search Bar" = http://your-searcher.com/sp.htm
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use Search Asst" = no
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl "(Default)" = http://your-searcher.com/index.htm
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Search Page" = http://your-searcher.com/index.htm
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Start Page" = http://your-searcher.com/index.htm
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl "provider" = gogl
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search "SearchAssistant" = http://your-searcher.com/sp.htm

The following shortcut will be added to the Favorites list:

• FREE HIDDEN CAMS WORLD.url
• FREE SPY CAM.url
• FREE WEB CAMS CHATS.url
• GET THIS 4 FREE.url

The trojan may modify the HOSTS file but the modifications are not harmful.

Symptoms

Symptoms -

• Modified default start page and search page in Internet Explorer.
• File and registry changes listed above.
• Additional links in the Favorites list.
• Modified HOSTS file.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

Removal -

Removal -

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A