W32/StartPage.BBA is a Trojan that will infect Windows systems.

The trojan will arrive as a dropped file of another malware or may be downloaded from the Internet.

Upon execution, the trojan drops service.exe in the Windows System\microsoft\serv folder.


The trojan modifies the registry at the following location to load itself during each startup:

HKEY_USERS\(SID value)-
1003\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft

The trojan tries to connect to http://www.documenti-elettronici.com/i-verifycenter. Due to the permission rights the page will not be displayed.

Technical details can be found at this Proland Software page.