Trojan.Win32.Startpage

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Detection and Removal ·
· Research ·

Overview
Category:	Homepage Hijacker: Any software that changes your browser's home page to some other site. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower. Homepage Hijacker: Any software that changes your browser's home page to some other site. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower.
Variants:	Trojan.Win32.StartPage.aa Trojan.Win32.StartPage.ae Trojan.Win32.StartPage.am Trojan.Win32.StartPage.aq Trojan.Win32.StartPage.au Trojan.Win32.StartPage.be Trojan.Win32.StartPage.bf Trojan.Win32.StartPage.bg Trojan.Win32.StartPage.bj Trojan.Win32.StartPage.bs Trojan.Win32.StartPage.bx Trojan.Win32.StartPage.cb Trojan.Win32.StartPage.cd Trojan.Win32.StartPage.cl Trojan.Win32.StartPage.cr Trojan.Win32.StartPage.cy Trojan.Win32.StartPage.cz Trojan.Win32.StartPage.da Trojan.Win32.StartPage.dj Trojan.Win32.StartPage.ea Trojan.Win32.StartPage.ej Trojan.Win32.StartPage.es Trojan.Win32.StartPage.f Trojan.Win32.StartPage.fh Trojan.Win32.StartPage.fo Trojan.Win32.StartPage.ft Trojan.Win32.StartPage.fx Trojan.Win32.StartPage.gf Trojan.Win32.StartPage.he Trojan.Win32.StartPage.hi Trojan.Win32.StartPage.ho Trojan.Win32.StartPage.ht Trojan.Win32.StartPage.ig Trojan.Win32.StartPage.iy Trojan.Win32.StartPage.jl Trojan.Win32.StartPage.jo Trojan.Win32.StartPage.jr Trojan.Win32.StartPage.jx Trojan.Win32.StartPage.ku Trojan.Win32.StartPage.mc Trojan.Win32.StartPage.s Trojan.Win32.StartPage.u Trojan.Win32.Startpage.w Trojan.Win32.StartPage.y
Similar Pests:	Homepage Hijacker · Homepage Hijacker
Origins
Programming Language:	Delphi Compressed with UPX
Date of Origin:	Variants from January, 2000 to March, 2005
Distribution
Prevalence:	Trojan.Win32.StartPage.be: 0.3% Trojan.Win32.StartPage.cd: 16.4% Trojan.Win32.StartPage.fx: 0.1% Trojan.Win32.StartPage.he: 17.6% Trojan.Win32.StartPage.hi: 0.1% Trojan.Win32.StartPage.ht: 0.7% Trojan.Win32.StartPage.ku: 0.9% Trojan.Win32.StartPage.y: 0.2% More Info
Clot Factor:	Trojan.Win32.StartPage.be: 1 The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.
Growth:	Trojan.Win32.StartPage.cd: Insufficient data to report growth Trojan.Win32.StartPage.he: Insufficient data to report growth Trojan.Win32.StartPage.y: Insufficient data to report growth
Operation
Storage Required:	Trojan.Win32.StartPage.aa: at least 501 KB Trojan.Win32.StartPage.am: at least 9 KB Trojan.Win32.StartPage.aq: at least 45 KB Trojan.Win32.StartPage.au: at least 17 KB Trojan.Win32.StartPage.be: at least 25 KB Trojan.Win32.StartPage.bf: at least 73 KB Trojan.Win32.StartPage.bg: at least 9 KB Trojan.Win32.StartPage.bj: at least 189 KB Trojan.Win32.StartPage.bx: at least 9 KB Trojan.Win32.StartPage.cb: at least 17 KB Trojan.Win32.StartPage.cl: at least 9 KB Trojan.Win32.StartPage.cr: at least 13 KB Trojan.Win32.StartPage.cy: at least 13 KB Trojan.Win32.StartPage.cz: at least 29 KB Trojan.Win32.StartPage.da: at least 17 KB Trojan.Win32.StartPage.dj: at least 73 KB Trojan.Win32.StartPage.ea: at least 13 KB Trojan.Win32.StartPage.ej: at least 13 KB Trojan.Win32.StartPage.es: at least 9 KB Trojan.Win32.StartPage.f: at least 49 KB Trojan.Win32.StartPage.fh: at least 17 KB Trojan.Win32.StartPage.fo: at least 41 KB Trojan.Win32.StartPage.ft: at least 9 KB Trojan.Win32.StartPage.gf: at least 5 KB Trojan.Win32.StartPage.he: at least 145 KB Trojan.Win32.StartPage.hi: at least 17 KB Trojan.Win32.StartPage.ho: at least 9 KB Trojan.Win32.StartPage.ht: at least 17 KB Trojan.Win32.StartPage.ig: at least 9 KB Trojan.Win32.StartPage.iy: at least 9 KB Trojan.Win32.StartPage.jl: at least 41 KB Trojan.Win32.StartPage.jo: at least 13 KB Trojan.Win32.StartPage.jr: at least 29 KB Trojan.Win32.StartPage.jx: at least 53 KB Trojan.Win32.StartPage.ku: at least 269 KB Trojan.Win32.StartPage.mc: at least 9 KB Trojan.Win32.StartPage.s: at least 13 KB Trojan.Win32.Startpage.w: at least 33 KB Trojan.Win32.StartPage.y: at least 173 KB
Browser Performance:	Likely to slow performance of Internet Explorer.
Detection and Removal
Automatic Removal:	PestPatrol detects this. PestPatrol removes this.
Manual Removal:	Follow these steps to remove Trojan.Win32.Startpage from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.
	Stop Running Processes: Kill these running processes with Task Manager: 776a6dbd854c9200f16a9005278e156c.exe 82d32133964bbc152c6a4ad8a189a5fa.exe bootconf.exe c:\in\iefeatures.exe csrss.exe hrtcm.exe programfilesdir+\internet explorer\ieengine.exe rundll32.exe sndbdrv3104.exe startupfolder+\winlogin.exe svchost.exe systemroot+\system\iefeatures.exe systemroot+\system\soundmx.exe systemroot+\system32\winmm64.exe systemroot+\system32\winproc32.exe trojan.win32.startpage.am.exe trojan.win32.startpage.bj.exe trojan.win32.startpage.cr.exe trojan.win32.startpage.cy.exe trojan.win32.startpage.cz.exe trojan.win32.startpage.da.exe trojan.win32.startpage.dj.exe trojan.win32.startpage.ea.exe trojan.win32.startpage.es_(4).exe trojan.win32.startpage.f.exe trojan.win32.startpage.fh.exe trojan.win32.startpage.ft.exe trojan.win32.startpage.iy.exe trojan.win32.startpage.s.exe trojan.win32.startpage.w.exe trojan.win32.startpage.y.exe winlogon.exe ziphelp.exe
	Remove AutoRun Reference: Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\ieengine, delete it and reboot the machine immediately. If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\spywareguard, delete it and reboot the machine immediately. If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\svchost, delete it and reboot the machine immediately. If you find the value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\windows internet protocol, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\iefeatures, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\soundmx, delete it and reboot the machine immediately.
	Unregister DLLs: Unregister these DLLs with Regsvr32, then reboot: cpan.dll dehpj.dll hknqtwz].dll ieservice.dll profilepath+\applic~1\setup\setup.dll surferbar.dll trojan.win32.startpage.bg.dll trojan.win32.startpage.bx.dll trojan.win32.startpage.hi.dll trojan.win32.startpage.ho.dll trojan.win32.startpage.ig.dll
	Clean Registry: Remove these registry items (if present) with RegEdit: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\ieengine HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\spywareguard HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\svchost HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\windows internet protocol HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\iefeatures HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\soundmx
	Remove Files: Remove these files (if present) with Windows Explorer: -1438154624.dl_ 776a6dbd854c9200f16a9005278e156c.exe 82d32133964bbc152c6a4ad8a189a5fa.exe bootconf.exe c:\in\iefeatures.exe cpan.dll csrss.exe dehpj.dll hknqtwz].dll hrtcm.exe ieservice.dll profilepath+\applic~1\setup\setup.dll programfilesdir+\internet explorer\ieengine.exe programfilesdir+\internet explorer\signup\presario.htm rundll32.exe sndbdrv3104.exe start-es.dl1 startpjr.pee startupfolder+\winlogin.exe surferbar.dll svchost.exe systemroot+\system\iefeatures.exe systemroot+\system\soundmx.exe systemroot+\system32\winmm64.exe systemroot+\system32\winproc32.exe trojan.win32.startpage.am.exe trojan.win32.startpage.bg.dll trojan.win32.startpage.bj.exe trojan.win32.startpage.bx.dll trojan.win32.startpage.cr.exe trojan.win32.startpage.cy.exe trojan.win32.startpage.cz.exe trojan.win32.startpage.da.exe trojan.win32.startpage.dj.exe trojan.win32.startpage.ea.exe trojan.win32.startpage.es_(4).exe trojan.win32.startpage.f.exe trojan.win32.startpage.fh.exe trojan.win32.startpage.ft.exe trojan.win32.startpage.hi.dll trojan.win32.startpage.ho.dll trojan.win32.startpage.ig.dll trojan.win32.startpage.iy.exe trojan.win32.startpage.s.exe trojan.win32.startpage.w.exe trojan.win32.startpage.y.exe winlogon.exe ziphelp.exe
	Restore Settings: After following the instructions above, you will still need to restore your original settings and prevent this from happening again. Here''s how.
Research
File Analyses:	Trojan.Win32.StartPage.aa: surferbar.dll Trojan.Win32.StartPage.am: trojan.win32.startpage.am.exe Trojan.Win32.StartPage.aq: rundll32.exe Trojan.Win32.StartPage.au: -1438154624.dl_ · start-es.dl1 Trojan.Win32.StartPage.be: 776a6dbd854c9200f16a9005278e156c.exe Trojan.Win32.StartPage.bf: csrss.exe Trojan.Win32.StartPage.bg: trojan.win32.startpage.bg.dll Trojan.Win32.StartPage.bj: trojan.win32.startpage.bj.exe Trojan.Win32.StartPage.bx: Trojan.Win32.StartPage.bx.dll Trojan.Win32.StartPage.cb: 82d32133964bbc152c6a4ad8a189a5fa.exe Trojan.Win32.StartPage.cl: cpan.dll Trojan.Win32.StartPage.cr: Trojan.Win32.StartPage.cr.exe Trojan.Win32.StartPage.cy: Trojan.Win32.StartPage.cy.exe Trojan.Win32.StartPage.cz: trojan.win32.startpage.cz.exe Trojan.Win32.StartPage.da: Trojan.Win32.StartPage.da.exe Trojan.Win32.StartPage.dj: trojan.win32.startpage.dj.exe Trojan.Win32.StartPage.ea: Trojan.Win32.StartPage.ea.exe Trojan.Win32.StartPage.ej: svchost.exe Trojan.Win32.StartPage.es: trojan.win32.startpage.es_(4).exe Trojan.Win32.StartPage.f: trojan.win32.startpage.f.exe Trojan.Win32.StartPage.fh: Trojan.Win32.StartPage.fh.exe Trojan.Win32.StartPage.fo: dehpj.dll Trojan.Win32.StartPage.ft: Trojan.Win32.StartPage.ft.exe Trojan.Win32.StartPage.gf: sndbdrv3104.exe Trojan.Win32.Startpage.he: ieengine.exe · winlogin.exe Trojan.Win32.StartPage.hi: Trojan.Win32.StartPage.hi.dll Trojan.Win32.StartPage.ho: Trojan.Win32.StartPage.ho.dll Trojan.Win32.StartPage.ht: winmm64.exe Trojan.Win32.StartPage.ig: Trojan.Win32.StartPage.ig.dll Trojan.Win32.StartPage.iy: Trojan.Win32.StartPage.iy.exe Trojan.Win32.StartPage.jl: hrtcm.exe Trojan.Win32.StartPage.jo: ziphelp.exe Trojan.Win32.StartPage.jr: startpjr.pee Trojan.Win32.StartPage.jx: hknqtwz].dll Trojan.Win32.StartPage.ku: ieservice.dll · setup.dll Trojan.Win32.StartPage.mc: winlogon.exe Trojan.Win32.StartPage.s: trojan.win32.startpage.s.exe Trojan.Win32.Startpage.w: trojan.win32.startpage.w.exe Trojan.Win32.StartPage.y: bootconf.exe · soundmx.exe · Trojan.Win32.StartPage.y.exe
More Info:	AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
Research By:	PestPatrol's Pest Research Center
Last Revised:	April 05, 2005

Trojan.Win32.Startpage

· Overview · · Origins · · Distribution · · Operation · · Detection and Removal · · Research ·

Overview

Category:

Variants:

Similar Pests:

Origins

Programming Language:

Date of Origin:

Distribution

Prevalence:

Clot Factor:

Growth:

Operation

Storage Required:

Browser Performance:

Detection and Removal

Automatic Removal:

Manual Removal:

Research

File Analyses:

More Info:

Research By:

Last Revised:

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Detection and Removal ·
· Research ·