high
Summary
Summary
Action- More Information
| Detected by | All Sophos products |
|---|---|
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
You should also change your Internet Explorer settings using Tools|Internet options|General to remove any modifications made by the Trojan.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Updates
and delete it if it exists.
Close the registry editor.
More Information
Troj/Startpg-G is a simple Trojan that changes the start page and search settings
of Microsoft Internet Explorer by adding or modifying the following set of registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ SafeSites\auto.search.msn.com
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ SafeSites\auto.search.psn.cn
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ SafeSites\ie.search.psn.cn
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ SafeSites\search.msn.com
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ SafeSites\search.psn.cn HKCU\Software\Microsoft\Internet Explorer\
Main\Search Bar
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\SearchUrl\SearchURL
HKLM\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
HKLM\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKLM\Software\Microsoft\Internet Explorer\Main\Search Page
HKLM\Software\Microsoft\Internet Explorer\Search\Search Assistant
In order to run automatically when Windows starts up the Trojan copies itself to the file msupdate.exe in the Windows system folder and adds the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Updates
|
