Antivirus and Security Software from Sophos

Sophos blogs

Troj/IEStart-K

Aliases
  • TrojanClicker.VBS.Krepper
  • VBS_KREPPER.A
  • VBS/IEstart.gen.e
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Protection available since 24 August 2004 15:09:00 (GMT)
Detected by All Sophos products
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

Please follow the instructions for removing Trojans.

You should also change your Internet Explorer settings using Tools|Internet options|General to remove any modifications made by the Trojan.

More Information

Troj/IEStart-K launches Microsoft Internet Explorer every 1 hour and attempts to display a search page associated with www.searchwww.com.

Related components of this Trojan may change settings for Microsoft Internet Explorer by setting the following regsitry entries:

HKCU\Software\Microsoft\Internet Explorer\Main\
Search Page = http://www.searchwww.com/
HKCU\Software\Microsoft\Internet Explorer\Main\
Start Page = http://www.searchwww.com/
HKCU\Software\Microsoft\Internet Explorer\MenuExt\
Shorten URL = http://www.cjb.net/menuext.html
HKLM\Software\Microsoft\Internet Explorer\Search\
SearchAssistant = http://www.searchwww.com/bar.html

Troj/IEStart-K is typically installed as search.vbs along with a file named search.inf.

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer