If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Trojan startpage.16.m
A colleague's computer is sitting morosely on my living room floor, infected
(so it seems, according to AVG) with the Trojan startpage.16.m and no matter how many times AVG finds and heals the offending file - se.dll - the infection reappears on every reboot. And since this seems to be a variant of other startpage Trojans, dedicated removal methods don't appear to work across the board. There are a number of web forums which are discussing this problem but none seem to have dealt with it completely on a Windows ME machine, and I'm rather at a loss as to what I might do short of a reformat, which is an unpopular option due to important files. Has anyone seen/come across an effective way of dealing with this little bugger? TIA |
#2
|
|||
|
|||
Trent SC wrote:
A colleague's computer is sitting morosely on my living room floor, infected (so it seems, according to AVG) with the Trojan startpage.16.m and no matter how many times AVG finds and heals the offending file - se.dll - the infection reappears on every reboot. And since this seems to be a variant of other startpage Trojans, dedicated removal methods don't appear to work across the board. There are a number of web forums which are discussing this problem but none seem to have dealt with it completely on a Windows ME machine, and I'm rather at a loss as to what I might do short of a reformat, which is an unpopular option due to important files. Has anyone seen/come across an effective way of dealing with this little bugger? TIA Sure, just do the following malware removal steps. Make sure all tools are updated and you do all scans in Safe Mode. With ME, when you first go into Safe Mode you have to close that stupid Help app that starts. Also, delete all the Temporary and Temporary Internet Files before you start scanning. 1) Scan in Safe Mode with current version (not earlier than 2004) antivirus using updated definitions. Before you remove malware, get LSPFix (or WinSockFix for XP which you can get from MajorGeeks) - see links below. 2) Remove spyware with Spybot Search & Destroy and Ad-aware. These programs are free, so use them both since they complement each other. There is a new version of CWShredder from Intermute. I would not install the other Intermute programs, however. Alternately, there are CoolWebSearch malware removal steps at SilentRunners. Be sure to update these programs before running, and it is a good idea to do virus/spyware scans in Safe Mode. Make sure you are able to see all hidden files and extensions (View tab in Folder Options). If the malware remains even after you used Ad-aware and Spybot, you can scan with HijackThis. HijackThis is an excellent tool to discover and disable hijackers, but it requires expert skill. See below for HijackThis links, including sites where you can post your HJT logs. A combination of HijackThis and about:Buster works well in removing the about:Blank homepage hijacker. Again, this is an expert tool and novices should get help with it. 3) If you are running Windows ME or XP, you should disable/enable System Restore after the system is clean because malware will be in the Restore Points. With ME, you must disable System Restore completely. With XP, you can delete all but the most recent (presumably clean) System Restore point from the More Options section of Disk Cleanup (Runcleanmgr). 4) Make sure you've visited Windows Update and applied all security patches. Do not install driver updates from Windows Update. 5) Run a firewall. Links to help with malwa Software/Methods: http://www.safer-networking.org - Spybot Search & Destroy http://www.lavasoftusa.com - Ad-aware http://www.majorgeeks.com - good download site http://www.intermute.com/spysubtract..._download.html http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners http://www.cexx.org/lspfix.htm - Repair Winsock 2 settings after removing spyware http://www.spychecker.com/program/winsockxpfix.html - WinsockXPFix.exe HijackThis: http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim Eshelman http://aumha.net - forums http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis forum http://www.wilderssecurity.com/ http://forums.tomcoyote.org/ General: http://aumha.net - look under "Security" for various forums http://rgharper.mvps.org/cleanit.htm http://mvps.org/winhelp2002/unwanted.htm http://www.aumha.org/a/parasite.htm - The Parasite Fight http://www.spywarewarrior.com/rogue_anti-spyware.htm Malke -- MS MVP - Windows Shell/User Elephant Boy Computers www.elephantboycomputers.com "Don't Panic!" |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
cat & mouse & trojan horse | rooster | General | 22 | December 18th 04 08:41 AM |
Trojan Horse Dropper Delf.3.L | Gayline | General | 6 | October 7th 04 06:42 AM |
Got a trojan and need help | Sweetpea | General | 9 | September 4th 04 09:06 PM |
Trojan | General | 2 | August 7th 04 12:35 PM | |
Trojan Horse Viruses | Wendy | General | 33 | July 12th 04 08:15 PM |