Troj/StartPage-A changes browser settings for Microsoft Internet Explorer by settings the following registry entries: HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\Main\Use Search Asst
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\SearchURL\(Default)
HKCU\Software\Microsoft\Internet Explorer\SearchURL\provider
HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant
Bookmarks are created in the Favorites folder with the filenames: FREE HIDDEN CAMS WORLD FREE SPY CAM FREE WEB CAMS CHATS GET THIS 4 FREE The Trojan is installed to the Windows folder as SVCHOST.EXE and the following registry entry is created, so that SVCHOST.EXE is run automatically on startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ svchost = %WINDOWS%\SVCHOST.EXE