Content
StartPage-FX
- Type
- Trojan
- SubType
- StartPage
- Discovery Date
- 01/26/2005
- Length
- Varies
- Minimum DAT
- 4416 (12/22/2004)
- Updated DAT
- 4614 (10/27/2005)
- Minimum Engine
- 5.1.00
- Description Added
- 12/22/2004
- Description Modified
- 01/27/2005 3:47 AM (PT)
Tab Navigation
Characteristics
When executed this trojan modifies the Internet Explorer search and start page settings to http://realsearch.cc
It also adds a new link in the Favourites list: Free Hardcore Porn\Animal Sex.url
It may also attempt to install 2 gambling games called Everest Poker and Imperial Casino. Both were removed with Add/Remove within Control Panel.
The following registry keys are modified:
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer "SearchUrl" http://realsearch.cc
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Bar" http://realsearch.cc
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Page" http://realsearch.cc
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Search "SearchAssistant" http://realsearch.cc
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchUrl "SearchUrl" http://realsearch.cc
The following files may be dropped in the system directory of the Windows folder:
- adtmka.exe
- asfstk.dll
- dhcpst.dll
- dmsnavar.dll
- etL32p3.dll
- favico.dat
- fg32NVFP60.dll
- G32ptpxn.exe
- k32rtBAME.dll
- MSRter.exe
- ocSCxt.exe
- shxngAPI.dll
- sntTLAbcat.dll
- upsteM2.exe
- wuclient.exe
- x32emxspro.dll
- xpsp2fw.exe
Symptoms
Modified default start page and search page in Internet Explorer, registry changes listed above and one additional link in the Favorites list.
Method of Infection
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.
Removal
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Variants
Variants
N/A
All Information
Overview -
This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
Aliases
- AVP - Trojan-Downloader.Win32.Agent.fw
- Norton - Download.Trojan
- Panda - Trj/Startpage.QP
Characteristics
Characteristics -
When executed this trojan modifies the Internet Explorer search and start page settings to http://realsearch.cc
It also adds a new link in the Favourites list: Free Hardcore Porn\Animal Sex.url
It may also attempt to install 2 gambling games called Everest Poker and Imperial Casino. Both were removed with Add/Remove within Control Panel.
The following registry keys are modified:
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer "SearchUrl" http://realsearch.cc
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Bar" http://realsearch.cc
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Page" http://realsearch.cc
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Search "SearchAssistant" http://realsearch.cc
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchUrl "SearchUrl" http://realsearch.cc
The following files may be dropped in the system directory of the Windows folder:
- adtmka.exe
- asfstk.dll
- dhcpst.dll
- dmsnavar.dll
- etL32p3.dll
- favico.dat
- fg32NVFP60.dll
- G32ptpxn.exe
- k32rtBAME.dll
- MSRter.exe
- ocSCxt.exe
- shxngAPI.dll
- sntTLAbcat.dll
- upsteM2.exe
- wuclient.exe
- x32emxspro.dll
- xpsp2fw.exe
Symptoms
Symptoms -
Modified default start page and search page in Internet Explorer, registry changes listed above and one additional link in the Favorites list.
Method of Infection
Method of Infection -
Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.
Removal -
Removal -
AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.
Additional Windows ME/XP removal considerations
Variants
Variants -
N/A
