Troj/StartPa-HP

Please follow the instructions for removing Trojans.

Troj/StartPa-HP is a Trojan for the Windows platform.

When first run Troj/StartPa-HP copies itself to:

<Windows>\n0tepad.exe
<System>\ccsvit.exe
<System>\n0tepad.exe

and creates the file <System>\windll.dll.

The following registry entry is created to run ccsvit.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ccsvit.exe
<System>\ccsvit.exe

The following registry entry is set or modified, so that n0tepad.exe is run when files with extensions of TXT are opened/launched:

HKCR\txtfile\shell\open\command
(default)
N0TEPAD.EXE <binary string>

Troj/StartPa-HP changes the Start Page for Microsoft Internet Explorer by setting the registry entry:

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page