StartPage-IR

This page shows details and results of our analysis on the malware StartPage-IR

Download Current DAT: 6618

Threat Detail

Malware Type: Trojan

Malware Sub-type: StartPage

Discovery Date: 2006-01-30

Next Steps:

Overview
Characteristics
Symptoms
Method of Infection

Overview

This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Minimum DAT

4685 (2006-01-30)

Updated DAT

4686 (2006-01-31)

Minimum Engine

5.1.00

File Length

N/A

Description Added

2006-01-30

Description Modified

2006-02-01

Malware Proliferation

Characteristics

When executed this trojan modifies the Internet Explorer start page to
"http://get-access.host.sk/hvplace/rel1.php?id=rule5book".

The following changes are made to the registry.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "ResourceCont"="[folder where the file is saved]\filename.exe"

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
"Start Page"="http://get-access.host.sk/hvplace/rel1.php?id=rule5book"

Displays popup messages as shown below and opens porn sites without user interaction. If the user were to click on the popup messages the user is redirected to www.razespyware.net or www.thespyguard.com .

Symptoms

Modified default start page in Internet Explorer.
Popup messages.
Opens porn sites.

Method of Infection

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.