Trojan.StartPage.C is a variant of Trojan.StartPage.
It changes the Internet Explorer home page to www.okww.net.
Copies itself to one of the following locations:
%System%\uewxdir.exe
%System%\handlesys.exe
Adds the value: "HandleSystem"="%System%\handlesys.exe"
to the registry keys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Changes the value to: "(Default)"="%System%\uewxdir.exe "%1""
to the registry keys HKEY_CLASSES_ROOT\txtfile\shell\open\command
so that the Trojan runs when you open a text file.
Adds the value: "Start Page"="http:/ /www.okww.net/"
to the registry key: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
For manual removal, please delete all values in the registry keys described above.
Removal: handlesys.exe is removed by RegRun.
Read more... Removal instructions...
Recommended software:
UnHackMe - easy removal Rootkits/Adware/Spyware.
http://www.unhackme.com
RegRun Security Suite - removal and protection.
http://www.regrun.com
RegRun Reanimator - free removal tool.
greatis.com/reanimator
RegRun - User's Choice
Vista Programs - full info...
What is hidden in MSDN?
.NET Secrets Revealed
Why software developers prefer Win32.FreeTechSecrets.com?
All Unix Manuals in Alphabetical Order
C# controls for .NET in 3 simple steps.
Constantly updated. Last update:
May 12 2008
Interesting information about Vista programs...
Need consultation?
Would you like to add your opinion?