A Windows 98 & ME forum. Win98banter

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Go Back   Home » Win98banter forum » Windows ME » General
Site Map Home Authors List Search Today's Posts Mark Forums Read Web Partners

Trojan startpage.16.m



 
 
Thread Tools Display Modes
  #1  
Old March 1st 05, 01:11 AM
Trent SC
external usenet poster
 
Posts: n/a
Default Trojan startpage.16.m

A colleague's computer is sitting morosely on my living room floor, infected
(so it seems, according to AVG) with the Trojan startpage.16.m and no matter
how many times AVG finds and heals the offending file - se.dll - the
infection reappears on every reboot. And since this seems to be a variant
of other startpage Trojans, dedicated removal methods don't appear to work
across the board.

There are a number of web forums which are discussing this problem but none
seem to have dealt with it completely on a Windows ME machine, and I'm
rather at a loss as to what I might do short of a reformat, which is an
unpopular option due to important files.

Has anyone seen/come across an effective way of dealing with this little
bugger?

TIA


  #2  
Old March 1st 05, 01:24 AM
Malke
external usenet poster
 
Posts: n/a
Default

Trent SC wrote:

A colleague's computer is sitting morosely on my living room floor,
infected (so it seems, according to AVG) with the Trojan
startpage.16.m and no matter how many times AVG finds and heals the
offending file - se.dll - the
infection reappears on every reboot. And since this seems to be a
variant of other startpage Trojans, dedicated removal methods don't
appear to work across the board.

There are a number of web forums which are discussing this problem but
none seem to have dealt with it completely on a Windows ME machine,
and I'm rather at a loss as to what I might do short of a reformat,
which is an unpopular option due to important files.

Has anyone seen/come across an effective way of dealing with this
little bugger?

TIA


Sure, just do the following malware removal steps. Make sure all tools
are updated and you do all scans in Safe Mode. With ME, when you first
go into Safe Mode you have to close that stupid Help app that starts.
Also, delete all the Temporary and Temporary Internet Files before you
start scanning.

1) Scan in Safe Mode with current version (not earlier than 2004)
antivirus using updated definitions.

Before you remove malware, get LSPFix (or WinSockFix for XP which you
can get from MajorGeeks) - see links below.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

If the malware remains even after you used Ad-aware and Spybot, you can
scan with HijackThis. HijackThis is an excellent tool to discover and
disable hijackers, but it requires expert skill. See below for
HijackThis links, including sites where you can post your HJT logs. A
combination of HijackThis and about:Buster works well in removing the
about:Blank homepage hijacker. Again, this is an expert tool and
novices should get help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore after the system is clean because malware will be in the
Restore Points. With ME, you must disable System Restore completely.
With XP, you can delete all but the most recent (presumably clean)
System Restore point from the More Options section of Disk Cleanup
(Runcleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malwa

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.majorgeeks.com - good download site
http://www.intermute.com/spysubtract..._download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners
http://www.cexx.org/lspfix.htm - Repair Winsock 2 settings after
removing spyware
http://www.spychecker.com/program/winsockxpfix.html - WinsockXPFix.exe

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://aumha.net - forums
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/

General:
http://aumha.net - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
 




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
cat & mouse & trojan horse rooster General 22 December 18th 04 09:41 AM
Trojan Horse Dropper Delf.3.L Gayline General 6 October 7th 04 06:42 AM
Got a trojan and need help Sweetpea General 9 September 4th 04 09:06 PM
Trojan General 2 August 7th 04 12:35 PM
Trojan Horse Viruses Wendy General 33 July 12th 04 08:15 PM


All times are GMT +1. The time now is 03:58 PM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2004-2024 Win98banter.
The comments are property of their posters.