1/27: StartPage-FX Trojan Modifies IE Settings
January 27, 2005

StartPage-FX is a Trojan that when executed, modifies the Internet Explorer search and start page settings to http://realsearch.cc

It also adds a new link in the Favorites list: Free Hardcore Porn\Animal Sex.url

It may also attempt to install 2 gambling games called Everest Poker and Imperial Casino. Both were removed with Add/Remove within Control Panel.

The following registry keys are modified:

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer "SearchUrl" http://realsearch.cc
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Bar" http://realsearch.cc
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Page" http://realsearch.cc
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Search "SearchAssistant" http://realsearch.cc
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchUrl "SearchUrl" http://realsearch.cc

More information can be found at McAfee page.