Troj/StartPa-BN

Please follow the instructions for removing Trojans.

You should also change your Internet Explorer settings using Tools|Internet options|General to remove any modifications made by the Trojan.

Troj/StartPa-BN changes the Internet Explorer start, home and search pages
by modifying the following registry entries:

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Search
HKCU\Software\Microsoft\Internet Explorer\SearchURL
HKCU\Software\Microsoft\Internet Explorer\Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes\home
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes\www
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes\mosaic
HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes\Search
HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant
HKLM\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKLM\Software\Microsoft\Internet Explorer\Main\Search Page
HKLM\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKLM\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\Software\Microsoft\Internet Explorer\Main\Use Search Assistant

The Trojan creates several DLL files in the Windows System folder for its own
use.

Troj/StartPa-BN may also download and execute files from a URL specified by
the author.