 1/27: StartPage-FX Trojan Modifies IE Settings |
 |
|
|
|
|
|
1/27: StartPage-FX Trojan Modifies IE Settings
January 27, 2005
StartPage-FX is a Trojan that when executed, modifies the Internet Explorer search and start page settings to http://realsearch.cc
It also adds a new link in the Favorites list: Free Hardcore Porn\Animal Sex.url
It may also attempt to install 2 gambling games called Everest Poker and Imperial Casino. Both were removed with Add/Remove within Control Panel.
The following registry keys are modified:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer "SearchUrl" http://realsearch.cc
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Bar" http://realsearch.cc
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main "Search Page" http://realsearch.cc
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Search "SearchAssistant" http://realsearch.cc
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchUrl "SearchUrl" http://realsearch.cc
More information can be found at McAfee page.
|
|
|
|
|
2/24: Agobot-QE a Backdoor Trojan & Worm
9/23: Backdoor-CHP Lets Data Through
Vericept Adds Fraud, Identity Theft Protection
Macromedia, RealNetworks Release Patches
5/17: Mytob-CH a Mass-Mailing Worm
Feds Hit Alleged Spammers in Sting
AntiOnline Spotlight: Network Security Made Easy?
A case study in security incident forensics and response.
1/26: Patco-A Worm Replaces Doc Files
House Passes Federal Anti-Spam Bill
5/3: SymbOS/Locknut-C Infects Handsets
Compare Security Camera Products
 |
