Troj/StartPa-YR

Aliases	Trojan.Win32.StartPage.yr StartPage.c
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	July 2005 (3.95)
Protection available since	25 May 2005 00:58:09 (GMT)
Detected by	All Sophos products

Troj/StartPa-YR is a Trojan for the Windows platform.

Troj/StartPa-YR will change the user's start page to a predefined URL.

Troj/StartPa-YR will create or modify the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
PayTime
<Windows system folder>\paytime.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PayTime
<Windows system folder>\paytime.exe

HKCU\Software\Microsoft\Internet Explorer\Main
Default_Page_URL
<predefined url>

HKCU\Software\Microsoft\Internet Explorer\Main
Local Page
<predefined url>

HKCU\Software\Microsoft\Internet Explorer\Main
Start Page
<predefined url>

HKLM\Software\Microsoft\Internet Explorer\Main
Default_Page_URL
<predefined url>

HKLM\Software\Microsoft\Internet Explorer\Main
Local Page
<predefined url>

HKLM\Software\Microsoft\Internet Explorer\Main
Start Page
<predefined url>

Get reports about the latest virus and spyware threats delivered to your computer