TROJ_STARTP.SMHD

October 18, 2012

ALIASES:

Trojan:Win32/Startpage.XC (Microsoft); Trojan.Gen (Symantec); Trojan-Dropper.Win32.Agent.gnxe, Trojan-Dropper.Win32.Agent.gnxe (Kaspersky); Trojan.Win32.Generic.pak!cobra (Sunbelt)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

TECHNICAL DETAILS

File Size:

40,960 bytes

File Type:

EXE

Memory Resident:

Initial Samples Received Date:

18 Oct 2012

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan deletes the following files:

%User Temp%\tt.reg

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\
shellex

HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\
shellex\ContextMenuHandlers

HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\
shellex\ContextMenuHandlers\ieframe

HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}

HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\
InProcServer32

HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\
Instance

HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\
Instance\InitPropertyBag

HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\
shellex

HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\
shellex\ContextMenuHandlers

HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\
shellex\ContextMenuHandlers\{1f4de370-ba4f-11d1-d627-00a0c91eedba}

HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\
shellex\MayChangeDefaultMenu

HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}

HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\
DefaultIcon

HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\
Shell

HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\
Shell\Open(&O)

HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\
Shell\Open(&O)\Command

HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\
Shell\ÊôÐÔ(&R)

HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\
Shell\ÊôÐÔ(&R)\Command

HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\
ShellFolder

HKEY_CURRENT_USER\SOFTWARE\Classes\
CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}

HKEY_CURRENT_USER\SOFTWARE\Classes\
CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\DefaultIcon

HKEY_CURRENT_USER\SOFTWARE\Classes\
CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell

HKEY_CURRENT_USER\SOFTWARE\Classes\
CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\
Open(&O)

HKEY_CURRENT_USER\SOFTWARE\Classes\
CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\
Open(&O)\Command

HKEY_CURRENT_USER\SOFTWARE\Classes\
CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\
ÊôÐÔ(&R)

HKEY_CURRENT_USER\SOFTWARE\Classes\
CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\
ÊôÐÔ(&R)\Command

HKEY_CURRENT_USER\SOFTWARE\Classes\
CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ShellFolder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Desktop\NameSpace\{C42EB5A1-0EED-E549-91B0-775852013521}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Toolbar\WebBrowser
ITBar7Layout = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}
InfoTip = "ÌØÂô"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\InProcServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance
CLSID = "{3f454f0e-42ae-4d7c-8ea3-328250d6e272}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\
InitPropertyBag
CLSID = "{13709620-C279-11CE-A49E-444553540000}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\
InitPropertyBag
command = "´ò¿ª(&O)"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\
InitPropertyBag
method = "ShellExecute"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\
InitPropertyBag
Param1 = "http://%77%77%77%2e%68%61%6f%6c%32%33%2e%63%63"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\
InitPropertyBag
Param2 = "%ProgramFiles%\Internet Explorer\iexplore.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ShellFolder
Attributes = "a"

HKEY_CURRENT_USER\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\
ShellFolder
Attributes = "a"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Toolbar\WebBrowser
ITBarLayout = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}
LocalizedString = "Internet Explorer"

(Note: The default value data of the said registry entry is {random values}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32
ThreadingModel = "Apartment"

(Note: The default value data of the said registry entry is Apartment.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder
Attributes = "0"

(Note: The default value data of the said registry entry is 20180000.)

This report is generated via an automated analysis system.

SOLUTION

Minimum Scan Engine:

9.200

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}
- shellex

In HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shellex
- ContextMenuHandlers

In HKEY_CLASSES_ROOT\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\shellex\ContextMenuHandlers
- ieframe

In HKEY_CLASSES_ROOT\CLSID
- {1f4de370-ba4f-11d1-d627-00a0c91eedba}

In HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}
- InProcServer32

In HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}
- Instance

In HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance
- InitPropertyBag

In HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}
- shellex

In HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\shellex
- ContextMenuHandlers

In HKEY_CLASSES_ROOT\CLSID\shellex\ContextMenuHandlers
- {1f4de370-ba4f-11d1-d627-00a0c91eedba}

In HKEY_CLASSES_ROOT\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\shellex
- MayChangeDefaultMenu

In HKEY_CLASSES_ROOT\CLSID
- {C42EB5A1-0EED-E549-91B0-775852013521}

In HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}
- DefaultIcon

In HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}
- Shell

In HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell
- Open(&O)

In HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)
- Command

In HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell
- ÊôÐÔ(&R)

In HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\ÊôÐÔ(&R)
- Command

In HKEY_CLASSES_ROOT\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}
- ShellFolder

In HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID
- {C42EB5A1-0EED-E549-91B0-775852013521}

In HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}
- DefaultIcon

In HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}
- Shell

In HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell
- Open(&O)

In HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\Open(&O)
- Command

In HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell
- ÊôÐÔ(&R)

In HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\Shell\ÊôÐÔ(&R)
- Command

In HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}
- ShellFolder

In HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
- {C42EB5A1-0EED-E549-91B0-775852013521}

To delete the registry key this malware/grayware created:

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}
Still in the left panel, locate and delete the key:
shellex
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}>shellex
Still in the left panel, locate and delete the key:
ContextMenuHandlers
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}>shellex>ContextMenuHandlers
Still in the left panel, locate and delete the key:
ieframe
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID
Still in the left panel, locate and delete the key:
{1f4de370-ba4f-11d1-d627-00a0c91eedba}
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}
Still in the left panel, locate and delete the key:
InProcServer32
Again Still in the left panel, locate and delete the key:
Instance
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>Instance
Still in the left panel, locate and delete the key:
InitPropertyBag
Again Still in the left panel, locate and delete the key:
shellex
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>shellex
Still in the left panel, locate and delete the key:
ContextMenuHandlers
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>shellex>ContextMenuHandlers
Still in the left panel, locate and delete the key:
{1f4de370-ba4f-11d1-d627-00a0c91eedba}
Again Still in the left panel, locate and delete the key:
MayChangeDefaultMenu
Again Still in the left panel, locate and delete the key:
{C42EB5A1-0EED-E549-91B0-775852013521}
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}
Still in the left panel, locate and delete the key:
DefaultIcon
Again Still in the left panel, locate and delete the key:
Shell
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell
Still in the left panel, locate and delete the key:
Open(&O)
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell>Open(&O)
Still in the left panel, locate and delete the key:
Command
Again Still in the left panel, locate and delete the key:
ÊôÐÔ(&R)
In the left panel, double-click the following:
HKEY_CLASSES_ROOT>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell>ÊôÐÔ(&R)
Still in the left panel, locate and delete the key:
Command
Again Still in the left panel, locate and delete the key:
ShellFolder
In the left panel, double-click the following:
HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID
Still in the left panel, locate and delete the key:
{C42EB5A1-0EED-E549-91B0-775852013521}
In the left panel, double-click the following:
HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}
Still in the left panel, locate and delete the key:
DefaultIcon
Again Still in the left panel, locate and delete the key:
Shell
In the left panel, double-click the following:
HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell
Still in the left panel, locate and delete the key:
Open(&O)
In the left panel, double-click the following:
HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell>Open(&O)
Still in the left panel, locate and delete the key:
Command
Again Still in the left panel, locate and delete the key:
ÊôÐÔ(&R)
In the left panel, double-click the following:
HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell>ÊôÐÔ(&R)
Still in the left panel, locate and delete the key:
Command
Again Still in the left panel, locate and delete the key:
ShellFolder
In the left panel, double-click the following:
HKEY_CURRENT_USER>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Desktop>NameSpace
Still in the left panel, locate and delete the key:
{C42EB5A1-0EED-E549-91B0-775852013521}
Close Registry Editor.

Step 3

Delete this registry value

[ Learn More ]

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
- ITBar7Layout = "{random values}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}
- InfoTip = "ÌØÂô"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\InProcServer32
- ThreadingModel = "Apartment"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance
- CLSID = "{3f454f0e-42ae-4d7c-8ea3-328250d6e272}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\InitPropertyBag
- CLSID = "{13709620-C279-11CE-A49E-444553540000}"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\InitPropertyBag
- command = "´ò¿ª(&O)"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\InitPropertyBag
- method = "ShellExecute"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\InitPropertyBag
- Param1 = "http://%77%77%77%2e%68%61%6f%6c%32%33%2e%63%63"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-ba4f-11d1-d627-00a0c91eedba}\Instance\InitPropertyBag
- Param2 = "%ProgramFiles%\Internet Explorer\iexplore.exe"

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ShellFolder
- Attributes = "a"

In HKEY_CURRENT_USER\CLSID\{C42EB5A1-0EED-E549-91B0-775852013521}\ShellFolder
- Attributes = "a"

To delete the registry value this malware/grayware created:

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Toolbar>WebBrowser
In the right panel, locate and delete the entry:
ITBar7Layout = "{random values}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}
In the right panel, locate and delete the entry:
InfoTip = "ÌØÂô"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>InProcServer32
In the right panel, locate and delete the entry:
ThreadingModel = "Apartment"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>Instance
In the right panel, locate and delete the entry:
CLSID = "{3f454f0e-42ae-4d7c-8ea3-328250d6e272}"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>Instance>InitPropertyBag
In the right panel, locate and delete the entry:
CLSID = "{13709620-C279-11CE-A49E-444553540000}"
Again In the right panel, locate and delete the entry:
command = "´ò¿ª(&O)"
Again In the right panel, locate and delete the entry:
method = "ShellExecute"
Again In the right panel, locate and delete the entry:
Param1 = "http://%77%77%77%2e%68%61%6f%6c%32%33%2e%63%63"
Again In the right panel, locate and delete the entry:
Param2 = "%ProgramFiles%\Internet Explorer\iexplore.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>ShellFolder
In the right panel, locate and delete the entry:
Attributes = "a"
In the left panel, double-click the following:
HKEY_CURRENT_USER>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>ShellFolder
In the right panel, locate and delete the entry:
Attributes = "a"
Close Registry Editor.

Step 4

Restore this modified registry value

[ Learn More ]

In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
- From: ITBarLayout = "{random values}"
  To: ITBarLayout = ""{random values}""

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}
- From: LocalizedString = "Internet Explorer"
  To: LocalizedString = ""{random values}""

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\InProcServer32
- From: ThreadingModel = "Apartment"
  To: ThreadingModel = ""Apartment""

In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder
- From: Attributes = "0"
  To: Attributes = ""20180000""

Step 5

Scan your computer with your Trend Micro product to delete files detected as TROJ_STARTP.SMHD. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 6

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

%User Temp%\tt.reg

Did this description help? Tell us how we did.

TROJ_STARTP.SMHD

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Kaynaklar

Destek

Trend Hakında

TROJ_STARTP.SMHD

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Kaynaklar

Destek

Trend Hakında

Amerika Kıtası

Orta Doğu ve Afrika

Avrupa

Asya ve Pasifik