Troj/StartPa-HS is a Trojan for the Windows platform.
When first run Troj/StartPa-HS copies itself to:
<Windows>\n0tepad.exe
<System>\n0tepad.exe
<Windows>\system\n0tepad.exe
<Windows>\system\Rund1132.exe
and creates the file <Windows>\system\windll.dll.
The following registry entry is created to run Rund1132.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Rund1132.exe
<System>\Rund1132.exe
The following registry entry is set or modified, so that n0tepad.exe is run when files with extensions of TXT are opened/launched:
HKCR\txtfile\shell\open\command
(default)
N0TEPAD.EXE %1
Troj/StartPa-HS changes the Start Page for Microsoft Internet Explorer by setting the registry entry:
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page