Thread: Trojan thing
View Single Post
  #8  
Old February 10th 05, 06:00 PM
Hugh Candlin
external usenet poster
 
Posts: n/a
Default


"Henry" wrote in message ...
I am not a computer technical person, but I am trying to get rid of a

Trojan
virus thing which has appeared on my PC, which is an HP Pavilion, new in
2000, 650MHz Athlon processor, using Windows 98SE and IE6.

It is called "StartPage-DU.dll" and keeps causing my antivirus software
(Regularly autoupdated McAfee) to report that it has removed a file called
SP.dll from my Windows Temp folder. It seems to be triggered by running
Internet Explorer.

I have looked in the McAfee and Sophos web sites for advice and although
they tell me what it does, I can see no advice that I can understand to

help
me locate the file in my PC which is actually causing the problem.

They talk about changes which the thing makes to the Registry, but that
seems so complex that I dare not touch it (I looked in something called
Regedit and it was full of very technical looking gobblydegook, though I

did
eventually manage to find the bits it was talking about).

There was something said about uninstalling a search assist program, but
when I try to do that it says it cannot.

I tried using something called AdAware which someone suggested and it

never
found it, nor did one called Spybot S&D, and I did a virus scan of my

whole
machine with McAfee and it didn't find it either, but it is still there
because McAfee still keeps deleting this file from TEMP and the home page
still keeps changing.

I keep seeing references to a file called SP.html, but I can't find one of
those anywhere on my PC.

The main thing this seems to be doing is to muck about with my Internet
Explorer home page, but I am worried that if I cannot get rid of it I

might
send it to other people with my E-Mails.

Can anyone give me some advice please - advice in very simple terms that I
might be able to understand please.


Run REGEDIT

Double-click your way to
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
by clicking on each of the keys in turn until you get to Main
========================
In the right-hand panel, if you find this key

"HOMEOldSP" = "about:blank"

Right-click on it and Delete it
========================
In the right-hand panel, if you find this key

"Search Bar" = "sp.html"

Right-click on it and Modify it to
http://www.google.com/ or
http://search.msn.com/
or any other search engine of your choice
and click OK
========================
In the right-hand panel, if you find this key

"Use Search Asst" = "no"

Right-click on it and Delete it
========================
Now double-click your way to

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\

In the right-hand panel, if you find this key

RunMRU "e" = "hhk.dll"
================================

Search the Registry for any other references to HHK.DLL
or SP.HTML and get rid of them also

Close REGEDIT

Search your computer, making sure that you search
My Computer, and not just one folder

If you find either of those files, get rid of them

Reboot

All of the above is based on settings in my own Registry,
plus the info from the McAfee site