Troj/Paymite-B is a Start Page Trojan.
Troj/Paymite-B is a Start Page Trojan.
In order to run automatically, the Trojan will set the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PayTime
<System>\paytime.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PayTime
<System>\paytime.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PayTime
<System>\paytime.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PayTime
<System>\paytime.exe
Troj/Paymite-B changes settings for Microsoft Internet Explorer, including the Start Page, by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet Explorer\Main\
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
Troj/Paymite-B may attempt to run the following files, if they exist:
<Windows>\tool2.exe
<System>\tibs.exe
<System>\paydial.exe
<System>\newdial.exe