Troj/StartPa-GH

Please follow the instructions for removing Trojans.

You should also change your Internet Explorer settings using Tools|Internet options|General to remove any modifications made by the Trojan.

Windows NT/2000/XP

In Windows NT/2000/XP you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

and remove any reference to any file you deleted.

Close the registry editor.

Troj/StartPa-GH is a StartPage Trojan.

Troj/StartPa-GH copies itself to the Windows folder with the filename WIN32.EXE
and sets a registry value at the following location in order to run itself on system startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Troj/StartPa-GH sets the following registry entry in order to change the StartPage
in Internet Explorer:

HKCU\Software\Microsoft\Internet Explorer\Main\
Start Page = "http://martfinder.com/index.htm"

Troj/StartPa-GH sometimes appends this value with "?aff=" and a value read from
the file WIN32.DAT in the same folder as it.

Troj/StartPa-GH sets the following registry entry to instruct Internet Explorer to use a personalised stylesheet:

HKCU\Software\Microsoft\Internet Explorer\Styles\Use My Stylesheet = "1"

Troj/StartPa-GH then sets the following registry entry to point to the file
WIN32.BMP in the same folder as it:

HKCU\Software\Microsoft\Internet Explorer\Styles\User Stylesheet