VBS/StartPage [Threat Name] go to Threat

VBS/StartPage.NDS [Threat Variant Name]

Category trojan
Detection created Jun 21, 2011
Detection database version 6226
Aliases Trojan:VBS/Startpage.AD (Microsoft)
  VBS/StartPage (AVG)
Short description

VBS/StartPage.NDS is a trojan that changes the home page of certain web browsers.

Installation

The trojan does not create any copies of itself.


The following Registry entries are set:

  • [HKEY_CURRENT_USER\­SOFTWARE\­Microsoft\­Internet Explorer\­Main]
    • "Start Page" = "http://www.aramaturk.org"
  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Microsoft\­Internet Explorer\­Main]
    • "Start Page" = "http://www.aramaturk.org"
  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Microsoft\­Windows\­CurrentVersion\­URL\­Prefixes]
    • "mirc" = "http://www.aramaturk.org"
  • [HKEY_LOCAL_MACHINE\­Software\­Policies\­Microsoft\­Internet Explorer\­Control Panel]
    • "HomePage" = 1
  • [HKEY_CURRENT_USER\­Software\­Policies\­Microsoft\­Internet Explorer\­Control Panel]
    • "HomePage" = 1
Other information

The program code of the malware is usually embedded in HTML pages.

Please enable Javascript to ensure correct displaying of this content and refresh this page.