Ikinci Sorunun Cevabi Ise
These trojans often set the following registry entries to point to a site of the trojan writer's choice, redirecting the user every time the default search or homepage is accessed.
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer
Values:
Search
SearchAssistant
CustomizeSearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
Values:
Search Page
Default_Search_URL
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
Values:
Search
SearchURL
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search
Values
SearchAssistant
CustomizeSearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Values:
Search Page
Default_Search_URL
Search Bar
Default_Page_URL
Start Page
Additionally, these trojans may attempt to modify the hosts file to redirect auto.search.msn.com or other mapped sites to point to a different location. The hosts file is located in the %System%\DRIVERS\ETC directory in Windows 2000 or Windows XP or in case of Windows 9x it can be found in %Windows%\hosts.
Note: '%System%' and '%Windows%' are variable locations. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.
Some members of this increasingly large family of trojans may also drop a file that the trojan then sets as a Personal Cascading Style Sheet. The Personal Cascading Style Sheet may be detected as JS.CSSPopup. For more specific information please visit the CSSPopup description elsewhere in our encyclopedia. The following registry entries may be modified so that this style sheet is applied to every document opened by Internet Explorer:
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Styles
Values:
User Stylesheet = <filename and location of style sheet dropped by the trojan>
Use My Stylesheet = 0x1
and
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles
Values:
User Stylesheet = <filename and location of style sheet dropped by the trojan>
Use My Stylesheet = 0x1
Additional Instructions for Recovering from a Startpage Infection
Some recent variants of Win32.Startpage exist as a DLL, possibly called "ctrlpan.dll" or "MSCONFD.DLL". This DLL will be loaded through one of
the following registry values:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Control = "rundll32.exe %System%\ctrlpan.dll,Restore ControlPanel"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs = "ctrlpan.dll"
The actual DLL file name may vary.
Startpage changes a user's default Internet Explorer homepage and/or default search page by making changes to the registry. While CA Antivirus solutions will remove a Startpage infection, they will not restore a user's individual Internet Explorer settings to their pre-infection state (as Internet Explorer settings may vary from user to user).
In order to restore Internet Explorer's default settings for the Home and Search pages, please use the following procedure:
Select Tools | Internet Options... from the Internet Explorer menu.
Select the Programs tab.
Click the Reset Web Settings... button. The Reset Web Settings dialog appears.
Ensure that the Also reset my home page box is checked.
Click Yes. This will reset Internet Explorer's default home page and search page.
Click Ok.
Note: This will restore Internet Explorer's home page and search page to their default settings (for example www.msn.com). It may not restore settings to their pre-infection state. However, it will ensure that all registry entries modified by the trojan are redirected away from the site that the trojan's writer wished the user to visit.
To disable a Personal Cascading Stylesheet set by the trojan in Internet Explorer:
Select Tools | Internet Options... from the Internet Explorer menu.
Click the Accessibility... button. The Accessibility dialog appears.
Uncheck the Format documents using my style sheet option under User style sheet.
Click Ok.
Click Ok.