StartPage-JH

Trojan characteristics are as follows:

• Modifies start page and favorites menu.
• Adds run key registry entry to get executed on each reboot.

Symptoms are as follows:

Modification in user's default start page and favorites menu in Internet Explorer.

Presence of following cookies in "%Documents and Settings%\<USER name>Cookies" folder

• <USER name>@kuro.9966[2].txt
• <USER name>@www.18hi[1].txt

Upon execution trojan copies itself to %windows%\sytem32 folder as PYJJKIME.exe.

File:    PYJJKIME.exe
Hash: 50c6415e17eba7cf1c39a8ac941a06b1

Following files created in %windows%\sytem32 folder:

• pyjjkq.dll
• AppCheck.dll
• pyjjkdll.dll
• ResIeDll.dll
• TAPIEver.ini
• AppEventTmp.exe

Modifies user's default registry value to "http:// www.ok56.com" to modify user's default start page.

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main "Start Page" = http://www.ok56.com

Following registry entries are added in order to get executed on each reboot.

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "PYJJIME" by PYJJKIME.exe.
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Microsoft TAP" by AppEventTmp.exe.

A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.