x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
SPECIAL OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET A 50% OFF
x
CHRISTMAS OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 40% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 50% OFF
x
BLACKFRIDAY OFFER
Buy the best antivirus
at the best price
TODAY ONLY UP TO 70% OFF
x
CYBERMONDAY OFFER
Buy the best antivirus
at the best price
(Only for homeusers)
TODAY ONLY UP TO 70% OFF
Active Scan. Scan your PC free
Panda Protection

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

StartPage.DIH

Threat LevelModerate threatDamageHighDistributionNot widespread
Common name:StartPage.DIH
Technical name:W32/StartPage.DIH.worm
Threat level:Low
Type:Worm
Effects:  

The objective of this worm is to advertise the blog of its author, as the modifications it carries out in the system (Desktop wallpaper, Windows Explorer background, Internet Explorer start page) display the name of the author's weblog. It spreads through removable devices, like USB keys.

Affected platforms:

Windows 2003/XP/2000/NT/ME/98/95

First detected on:May 19, 2010
Detection updated on:May 31, 2010
StatisticsNo

Brief Description 

    

StartPage.DIH  is a visual worm that carries out several modifications in the system in order to advertise the blog of its author. Despite not being a destructive malware, its payload and modifications can be annoying for the infected user, as:

  • it changes the Desktop wallpaper.
  • it modifies the background of the root directory of the Windows Explorer, as well as the backgroung of the taskbar when users are browsing through the Windows Explorer.
  • it establishes as Internet Explorer website the weblog of the author of the worm.

StartPage.DIH spreads making copies of itself with the name FUNNY.EXE in the removable devices connected to the computer, like USB keys. Additionally, it also creates copies of itself in the mapped drives.

Visible Symptoms 

    

StartPage.DIH is easy to recognize, as it displays the following symptoms:

  • When it is run, a nebulous effect os created in the computer screen and then, the Desktop wallpaper is changed to another image.

    The following image belongs to the nebulous effect:

    Nebulous effect in the screen

    This other belongs to the Desktop wallpaper established by the worm:

    Modified Desktop wallpaper
  • It also modifies the background oof the root directory:

    Modified backgoung of the root directory
  • It establishes as Internet Explorer start page the following website, which belongs to a Persian weblog:

    New Internet Explorer website

 

In order to understand better the process StartPage.DIH follows, an explanatory video is at your disposal.