Alters the default startup and search pages for your web browser. The Windows Scripting Host must be installed for the trojan to run. May arrive as a file named 'runme.hta'. May change any of these registry settings: HKCUSoftwareMicrosoftInternet ExplorerMainDefault Page URL HKCUSoftwareMicrosoftInternet ExplorerMainDefault Search URL HKCUSoftwareNetscapeNetscape NavigatorMainHome Page Original registry values are saved to the files 'HOMEREG111.REG', 'BACKUP1.REG', and 'BACKUP2.REG' in the WINDOWS directory.