From
http://vil.mcafee.com/dispVirus.asp?virus_k=98882&
Quote:
This trojan alters the default startup and search pages for your web browser. The Windows Scripting Host must be installed for the trojan to run. It is believed that a script generating program may be involved in the creation of this trojan, which
allows the author to specify different parameters. As there are many variants of this threat, your personal experiences may vary from those mentioned here. The trojan may arrive as a file named "runme.hta". Opening this file makes several registry changes to your system, such as:
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
HKCU\Software\Netscape\Netscape Navigator\Main\Home Page
Original registry values are saved to the files "HOMEREG111.REG", "BACKUP1.REG", and "BACKUP2.REG" in the WINDOWS directory.
|
Today, I'm the fount of all knowledge, I shall run dry shortly.
------------------
ClickCash - Better than 1:99 and $50 for signing up
Lightspeed Cash - Converts like crazy