Troj/Startp-DC is a Trojan for the Windows platform.
Troj/Startp-DC includes functionality to:
- run automatically
- copy itself to the <System> folder
- steal confidential information
When first run Troj/Startp-DC copies itself to:
<Startup>\cssrs.exe
<System>\cssrs.exe
The following registry entries are created to run cssrs.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmen
<System>\cssrs.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Microsoft service
<System>\cssrs.exe
Troj/Startp-DC changes settings for Microsoft Internet Explorer by modifying values under:
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page