The Web    Google
1/27: StartPage-FX Trojan Modifies IE Settings

1/27: StartPage-FX Trojan Modifies IE Settings
January 27, 2005

StartPage-FX is a Trojan that when executed, modifies the Internet Explorer search and start page settings to

It also adds a new link in the Favorites list: Free Hardcore Porn\Animal Sex.url

It may also attempt to install 2 gambling games called Everest Poker and Imperial Casino. Both were removed with Add/Remove within Control Panel.

The following registry keys are modified:

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer "SearchUrl"
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Bar"
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Page"
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Search "SearchAssistant"
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchUrl "SearchUrl"

More information can be found at McAfee page.

  • 2/24: Agobot-QE a Backdoor Trojan & Worm
  • 9/23: Backdoor-CHP Lets Data Through
  • Vericept Adds Fraud, Identity Theft Protection
  • Macromedia, RealNetworks Release Patches
  • 5/17: Mytob-CH a Mass-Mailing Worm
  • Feds Hit Alleged Spammers in Sting
  • AntiOnline Spotlight: Network Security Made Easy?
  • A case study in security incident forensics and response.
  • 1/26: Patco-A Worm Replaces Doc Files
  • House Passes Federal Anti-Spam Bill
  • 5/3: SymbOS/Locknut-C Infects Handsets
  • Compare Security Camera Products