Troj/Bizten-L is a startpage Trojan.
Troj/Bizten-L copies itself to the Windows folder with the filename
JUSHED32.EXE and may set the following registry entry so as to run itself on
system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\jushed32
Troj/Bizten-L may not set this registry entry if it determines that processes
relating to any of the following are running:
hijackthis
regedit
msconfig
cwshredder
Troj/Bizten-L attempts to delete the following file:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogon.exe
Troj/Bizten-L tries to set the following registry values:
HKLM\Software\Microsoft\Internet Explorer\Main\Search Bar
HKLM\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\Software\Microsoft\Internet Explorer\Main\Search Page
HKLM\Software\Microsoft\Internet Explorer\Main\SearchURL
HKLM\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKLM\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKLM\Software\Microsoft\Internet Explorer\TypedURLs\url1
HKCU\Software\Microsoft\Internet Explorer\Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Main\SearchURL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url1