W32/StartPage.JU!tr.dldr

Analysis

Attempts to download a file from the following URL:

http://{REMOVED} oo550.com/image/logo.jpg

It saves the downloaded file as undefinedWINDOWSundefined\tempaq, then executes it.

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
  FortiClient Systems
  
• Quarantine/delete files that are detected and replace infected files with clean backup copies.