It adds an entry to this key to ensure that the malware runs with your browser…
Firefox, IE and Chrome. Not seen it on Safari yet
hklm\software\clients\startmenuinternet|command