Content

StartPage-FY

Type
Trojan
SubType
StartPage
Discovery Date
01/12/2005
Length
varies
Minimum DAT
4417 (12/29/2004)
Updated DAT
5243 (03/03/2008)
Minimum Engine
5.1.00
Description Added
12/29/2004
Description Modified
01/27/2005 2:21 AM (PT)
Risk Assessment
Corporate User
Low
Home User
Low

Tab Navigation

Characteristics

When executed this trojan modifies the Internet Explorer search and start page settings to  http://lookfor.cc/sp.php?pin=10001 - although this may be hidden and the display might only be "about:blank" . 

The following shortcuts will be added to the Favourites list:

  • %WinDir%\Favorites\Only sex website.url
  • %WinDir%\Favorites\Search the web.url
  • %WinDir%\Favorites\Seven days of free porn.url
  • %WinDir%\Favorites\Sites about\Ab scissor.url
  • %WinDir%\Favorites\Sites about\Broadband comparison.url
  • %WinDir%\Favorites\Sites about\Credit counseling.url
  • %WinDir%\Favorites\Sites about\Credit report.url
  • %WinDir%\Favorites\Sites about\Crm software.url
  • %WinDir%\Favorites\Sites about\Debt credit card.url
  • %WinDir%\Favorites\Sites about\Escorts.url
  • %WinDir%\Favorites\Sites about\Fha.url
  • %WinDir%\Favorites\Sites about\Health insurance.url
  • %WinDir%\Favorites\Sites about\Help desk software.url
  • %WinDir%\Favorites\Sites about\Insurance home.url
  • %WinDir%\Favorites\Sites about\Loan for debt consolidation.url 
  • %WinDir%\Favorites\Sites about\Loan for people with bad credit.url
  • %WinDir%\Favorites\Sites about\Marketing email.url
  • %WinDir%\Favorites\Sites about\Mortgage insurance.url
  • %WinDir%\Favorites\Sites about\Mortgage life insurance.url
  • %WinDir%\Favorites\Sites about\Nevada corporations.url
  • %WinDir%\Favorites\Sites about\Online Betting Site.url
  • %WinDir%\Favorites\Sites about\Online gambling casino.url
  • %WinDir%\Favorites\Sites about\Online instant loan.url
  • %WinDir%\Favorites\Sites about\Order phentermine.url
  • %WinDir%\Favorites\Sites about\Payroll advance.url
  • %WinDir%\Favorites\Sites about\Personal loans online.url
  • %WinDir%\Favorites\Sites about\Personal loans with bad credit.url
  • %WinDir%\Favorites\Sites about\Prescription Drugs Rx Online.url
  • %WinDir%\Favorites\Sites about\Refinancing my mortgage.url
  • %WinDir%\Favorites\Sites about\Tahoe vacation rental.url
  • %WinDir%\Favorites\Sites about\Unsecured bad credit loans.url
  • %WinDir%\Favorites\Sites about\Videos.url
  • %WinDir%\Favorites\Sites about\What is hydrocodone.url

The following files may be dropped in the %WinDir% folder:

  • alzoja.dat
  • curkc.dat
  • sysbp.exe
  • tnomar.dat
  • yigso.dll
  • yigsou.dat
  • zbmmyx.dat
  • iezo.exe


A new folder called "Sites about" is created under %WinDir%\Favorites\

The following registry keys are modified:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Default_Page_URL" 
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Default_Search_URL"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Search Page"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Start Page" 
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search "SearchAssistant"
     

Symptoms

Modified default start page and search page in Internet Explorer, registry changes listed above and additional links in the Favorites list.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

Removal

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants

    N/A

All Information

Overview -

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Aliases

  • AVP - Trojan-Downloader.Win32.WinShow.ap
  • Norton - Adware.Iefeats
  • Panda - Adware/SearchAid
  • Sophos - Troj/StartPa-FY
  • Trend - TROJ_STARTPGE.FY

Characteristics

Characteristics -

When executed this trojan modifies the Internet Explorer search and start page settings to  http://lookfor.cc/sp.php?pin=10001 - although this may be hidden and the display might only be "about:blank" . 

The following shortcuts will be added to the Favourites list:

  • %WinDir%\Favorites\Only sex website.url
  • %WinDir%\Favorites\Search the web.url
  • %WinDir%\Favorites\Seven days of free porn.url
  • %WinDir%\Favorites\Sites about\Ab scissor.url
  • %WinDir%\Favorites\Sites about\Broadband comparison.url
  • %WinDir%\Favorites\Sites about\Credit counseling.url
  • %WinDir%\Favorites\Sites about\Credit report.url
  • %WinDir%\Favorites\Sites about\Crm software.url
  • %WinDir%\Favorites\Sites about\Debt credit card.url
  • %WinDir%\Favorites\Sites about\Escorts.url
  • %WinDir%\Favorites\Sites about\Fha.url
  • %WinDir%\Favorites\Sites about\Health insurance.url
  • %WinDir%\Favorites\Sites about\Help desk software.url
  • %WinDir%\Favorites\Sites about\Insurance home.url
  • %WinDir%\Favorites\Sites about\Loan for debt consolidation.url 
  • %WinDir%\Favorites\Sites about\Loan for people with bad credit.url
  • %WinDir%\Favorites\Sites about\Marketing email.url
  • %WinDir%\Favorites\Sites about\Mortgage insurance.url
  • %WinDir%\Favorites\Sites about\Mortgage life insurance.url
  • %WinDir%\Favorites\Sites about\Nevada corporations.url
  • %WinDir%\Favorites\Sites about\Online Betting Site.url
  • %WinDir%\Favorites\Sites about\Online gambling casino.url
  • %WinDir%\Favorites\Sites about\Online instant loan.url
  • %WinDir%\Favorites\Sites about\Order phentermine.url
  • %WinDir%\Favorites\Sites about\Payroll advance.url
  • %WinDir%\Favorites\Sites about\Personal loans online.url
  • %WinDir%\Favorites\Sites about\Personal loans with bad credit.url
  • %WinDir%\Favorites\Sites about\Prescription Drugs Rx Online.url
  • %WinDir%\Favorites\Sites about\Refinancing my mortgage.url
  • %WinDir%\Favorites\Sites about\Tahoe vacation rental.url
  • %WinDir%\Favorites\Sites about\Unsecured bad credit loans.url
  • %WinDir%\Favorites\Sites about\Videos.url
  • %WinDir%\Favorites\Sites about\What is hydrocodone.url

The following files may be dropped in the %WinDir% folder:

  • alzoja.dat
  • curkc.dat
  • sysbp.exe
  • tnomar.dat
  • yigso.dll
  • yigsou.dat
  • zbmmyx.dat
  • iezo.exe


A new folder called "Sites about" is created under %WinDir%\Favorites\

The following registry keys are modified:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Default_Page_URL" 
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Default_Search_URL"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Search Page"
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Start Page" 
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search "SearchAssistant"
     

Symptoms

Symptoms -

Modified default start page and search page in Internet Explorer, registry changes listed above and additional links in the Favorites list.

Method of Infection

Method of Infection -

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

Removal -

Removal -

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.

Additional Windows ME/XP removal considerations

Variants

Variants -

    N/A