Trojan/StartPage.Search

病毒长度：32,768 字节

病毒类型：木马

危害等级：*

影响平台：Win9X/2000/XP/NT/Me

Trojan/StartPage.Search修改IE默认页和搜索页，使用户打开指定的广告网页，通过垃圾邮件进行传播。

传播过程及特征：

1.在系统的启动目录下添加文件start.exe

2.修改注册表：

[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main]

"Counter" = %数字%

[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main]

"Search Bar" = http://www.secret-crush.com/search/search.php

[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main]

"Use Custom Search URL" = 1

[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\SearchUrl]

"Search Page" = http://www.secret-crush.com/%s

[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main]

"Search Page" = http://www.secret-crush.com/search/search.php

[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main]

"Start Page" = http://www.secret-crush.com/search/

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Search]

"CustomizeSearch" = http://www.secret-crush.com/search/search.php

[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Search]

"SearchAssistant" = http://www.secret-crush.com/search/search.php

3.更改IE选项默认页设置为指定的站点。

4.通过垃圾邮件进行传播，作为文件open.exe被发送给大量用户。