Troj/StartPa-BN changes the Internet Explorer start, home and search pages
by modifying the following registry entries:
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Search
HKCU\Software\Microsoft\Internet Explorer\SearchURL
HKCU\Software\Microsoft\Internet Explorer\Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes\home
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes\www
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes\mosaic
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes\Search
HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKLM\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKLM\Software\Microsoft\Internet Explorer\Main\Search Page
HKLM\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKLM\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\Software\Microsoft\Internet Explorer\Main\Use Search Assistant
The Trojan creates several DLL files in the Windows System folder for its own
use.
Troj/StartPa-BN may also download and execute files from a URL specified by
the author.