Trojan:Win32/Startpage.UY is a trojan that modifies the home page and search settings for Internet Explorer, Google Chrome, Mozilla Firefox and Opera.
You may inadvertently download and run the trojan, thinking it was a legitimate program or file.
Installation
When run, the trojan sets the default start page and search engine in Google Chrome, Internet Explorer, Mozilla Firefox and Opera to http://ecostartpage.com.
After it has performed its payload, the trojan drops the following file which deletes its copy:
%TEMP%\suicide.exe
Note: %TEMP% refers to a variable location that is determined by the malware by querying the operating system. The default location for the All Users Profile folder for Windows 2000, XP, and 2003 is "C:\DOCUME~1\<user>\LOCALS~1\Temp". For Windows Vista, 7 and 8, the default location is "C:\Users\<user name>\AppData\Local\Temp".
Payload
Modifies Internet Explorer settings
Trojan:Win32/Startpage.UY sets the start page and default search engine in Internet Explorer by modifying the following registry entries:
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Sets value: "Start Page"
With data: "http://ecostartpage.com"
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{GUID}
Sets value: "URL"
With data: "http://ecostartpage.com/index.php?q={searchTerms}"
Modifies Google Chrome settings
If you have Google Chrome installed, the trojan sets the start page and default search engine by modifying the default preferences file as follows:
"homepage": "http://ecostartpage.com",
"session": {"restore_on_startup": 4,
"restore_on_startup_migrated": true,
"urls_to_restore_on_startup": [ "http://ecostartpage.com" ]},
The default preferences file is stored in "%APPDATA%\Google\Chrome\User Data\Default\Preferences".
Modifies Mozilla Firefox settings
If you have Mozilla Firefox installed, the trojan creates a default settings folder, as "%APPDATA%\Mozilla\Firefox\Profiles\<eight random characters>.default". It places a preferences file, "prefs.js", into the folder with the following settings:
- user_pref("browser.startup.homepage", "http://ecostartpage.com")
- user_pref("browser.search.selectedEngine", "EcoStartPage")
Note: %APPDATA% refers to a variable location that is determined by the malware by querying the operating system. The default location for the Application Data folder for Windows 2000, XP, and 2003 is "C:\Documents and Settings\<user>\Application Data". For Windows Vista, 7, and 8, the default location is "C:\Users\<user>\AppData\Roaming".
The trojan sets the default search engine by adding the file "EcoStartPage.xml" to the default settings folder, under the "searchplugins" folder.
Modifies Opera settings
If you have Opera installed, the trojn sets the start page by modifying the file "%APPDATA%\Opera\Opera\operaprefs.ini" as follows:
[User Prefs]
Home URL= http://ecostartpage.com
Analysis by Alden Pornasdoro
