Trojan.JS.Cover is a Trojan that arrives as an .html file. When opened, it displays garbage characters in the Web browser window.

This Trojan exploits ActiveX capabilities, which allows it to modify the browser's home page. One variant of this Trojan prevents you from accessing the browser's Internet settings, which prevents you from changing your home page.

Symptoms

• Your home page has been changed to that of an adult Internet site.
• You can not access the browser's Internet settings (one variant).

Activation
When activated, this Trojan modifies the registry as follows:

• It adds the following subkeys:

  Start Page
  Search Bar
  Search Page

  to the registry key:

  HKEY_CURRENT_USER\Software\Microsoft\ Internet Explorer\Main

• Some variants of this Trojan also add the subkey

  Internet Explorer\Restrictions

  to the registry key:

  HKEY_CURRENT_USER\Software\Policies\Microsoft

  and sets it to the value

  NoBrowserOptions

When you leave the infected Web page, the Trojan opens several browser windows; each will be a different adult Web site.