StartPage-JN

This page shows details and results of our analysis on the malware StartPage-JN

Download Current DAT: 6617

Threat Detail

Malware Type: Trojan

Malware Sub-type: StartPage

Discovery Date: 2006-08-08

Next Steps:

Overview
Characteristics
Symptoms
Method of Infection
Removal

Overview

StartPage-JN trojan automatically opens Microsoft Internet Explorer windows to visit pages under www.71791.com. It can also change the Start and Search pages of Internet Explorer.

Minimum DAT

4825 (2006-08-09)

Updated DAT

4940 (2007-01-16)

Minimum Engine

5.1.00

File Length

7,993 bytes

Description Added

2006-08-08

Description Modified

2006-08-08

Malware Proliferation

Characteristics

StartPage-JN writes malicious a payload into the process memory of EXPLORER.EXE and terminates itself. This thread of EXPLORER.EXE is responsible for automatically opening the following web pages using Internet Explorer:

http://www.71791.com/
http://www.71791.com/news
http://www.71791.com/goodvip
http://www.71791.com/mm
http://www.71791.com/mp3

Some of the above links contain JavaScripts to display content from other websites such as:

http://u.7town.com/movie/760_90[REMOVED]
http://u.7town.com/movie/full[REMOVED]
http://s41.cnzz.com/stat.php?[REMOVED]
http://as1.kuaigao.com/JS/[REMOVED]
http://www.dobig.net/pop[REMOVED]
http://ac.yeeyoo.com/js/[REMOVED]
http://code.qihoo.com/ad_bcast/[REMOVED]

This Trojan may also modify the registry to set Internet Explorers Start Page and Local Page to http://vod.mmdy.org. It may also configure Windows to activate the trojan when Windows reboots, using the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{340121DC-1BEF-1A77-0106-060207060704} registry key. A file named winpub.reg is required to perform these registry changes. This file was unavailable at the time of writing this document.

Symptoms

Internet Explorer automatically opening to show web pages as mentioned above and the presence of aforementioned registry entries and the modified start page.

Method of Infection

Trojans do not self-replicate. They spread manually, often under the premise that the executable is something beneficial.

Trojans may also be received as a result of poor security practices, or un-patched machines and vulnerable systems. Distribution channels include IRC, peer-to-peer networks, email, newsgroups postings, etc.

Removal

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

1. Please go to the Microsoft Recovery Console and restore a clean MBR.

On windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.

On Windows Vista and 7:

Insert the Windows CD into the CD-ROM drive and restart the computer.
Click on "Repair Your Computer"
When the System Recovery Options dialog comes up, choose the Command Prompt.
Issue 'bootrec /fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.