VBS/dlSPS - IE browser startpage swapper Virus source

This VBS start page swapper file will change the targets I.E. browsers start page and default page settings, then it writes a basic duplicate script file in the %systemroot%\system32\ directory and adds that script file to the registry location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ in order to run the file on each reboot.

Classification: This virus is NON destructive.

Method of uninfection: Remove the registry key and the file located at c:\%systemroot%\system32\dlSPS.vbs. Then change your start page back as usual.

Interestingly enough this script can also be written as simply as the code below...BUT, the fact that the below code makes exact copies of itself will trigger certain AV that looks for 'signs' of new viruses plus you have to understand that most AV software will look at what the script is doing in regards to the type of objects used and so on. For an image of the scanning results of both files from McAfee AV click here. Notice how the longer version passed the test but the shorter version was detected as 'New Script' by McAfee.

Click here to go back.