Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Infected with SE.DLL (Trojan.Startpage)[resolved]

Started by nrgeti , Feb 25 2005 01:06 PM

This topic is locked

#1
nrgeti

Posted 25 February 2005 - 01:06 PM

Member

Member
17 posts

My system is infected with the Trojan.Startpage virus. Norton's antivirus says it is in SE.DLL but it cannot remove it because access is denied.

This virus always resets my IE Home Page to about.Blank

So far, this is what I have done.

1. Unchecked all files in msconfig. One of them was SE.DLL
2. Edited the Registry and removed all keys that had anything to do with SE.DLL. Most of these statements started with RUNDLL32.EXE
3. Deleted all the keys I could find that had a Search, Search Bar, Search Page, Start, Start Page values.
4. Ran DLLCOMPARE which did not find any locked files.
5. Ran Killbox and used it to remove C:\recycler\desktop.ini and c:\windows\system32\guard.tmp. Neither of these files exists.
6. I was then able to manually delete SE.DLL in one of the TEMP folders.
7. Ran Ad-aware which removed some simple files
8. Spybot will not run. It hangs on object #15
9. Ran popupdummy! which says it has about.blank in the block list but apparently this doesn't do anything.

My IE Home Page is still being reset to about.blank when I reboot.

#2
Guest_thatman_*

Posted 28 February 2005 - 07:43 AM

Guest

Hi nrgeti

Welcome to geekstogo

Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

Kc :tazz:

#3
nrgeti

Posted 28 February 2005 - 08:38 AM

Member

Topic Starter
Member
17 posts

I have already followed the directions on an earlier email that was attempting to remove the ABOUT.BLANK virus. This includes runing 4 more cleaning programs. They show empty: nothing in the logs, no viruses.

CWShredder
AboutBuster
Cleanup
Ad-aware

The first time after fixing the registry of all entries that contain ABOUT.BLANK I get the URL that I put in the Home Address field of IE. However, after opening IE, the Home Address goes back to ABOUT.BLANK.

There must be some program that runs when IE is executed. I don't know its name so cannot remove it.

#4
Guest_thatman_*

Posted 28 February 2005 - 10:28 AM

Guest

Hi nrgeti

Lets start with a HijackThis Log

Thanks

Kc

#5
nrgeti

Posted 01 March 2005 - 05:58 PM

Member

Topic Starter
Member
17 posts

Logfile of HijackThis v1.99.1

Scan saved at 6:04:57 PM, on 3/1/2005

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Dell\EUSW\Support.exe

C:\Program Files\PopupDummy!\PopupDummy! 3.01.EXE

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe

C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe

c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

C:\WINDOWS\System32\hkcmd.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe

C:\Program Files\Palm\HOTSYNC.EXE

C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe

C:\WINDOWS\System32\wuauclt.exe

F:\IntDownload\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll

O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\System32\iesp2.dll (file missing)

O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [PopupDummy!] C:\Program Files\PopupDummy!\PopupDummy! 3.01.EXE

O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"

O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l

O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup

O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [NSYSCPLSTR] vxdman.exe

O4 - HKCU\..\Run: [Yahoo! Pager] 1

O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"

O4 - HKCU\..\Run: [MON76234] TRPT.exe

O4 - HKCU\..\Run: [DTOURS] trycrt.exe

O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE

O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe

O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe

O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll

O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm

O9 - Extra button: PopupDummy! - {3C75C1F5-6D83-11d6-9855-00065B6980E9} - C:\Program Files\PopupDummy!\PopupDummy! 3.01.EXE (HKCU)

O9 - Extra 'Tools' menuitem: PopupDummy! - {3C75C1F5-6D83-11d6-9855-00065B6980E9} - C:\Program Files\PopupDummy!\PopupDummy! 3.01.EXE (HKCU)

O12 - Plugin for .tif: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\common\yinsthelper.dll

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab

O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab

O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo....plorer1_9us.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{07FE7868-1AFC-449C-96A5-823622487551}: NameServer = 69.50.188.180,195.225.176.31

O17 - HKLM\System\CCS\Services\Tcpip\..\{45BEC3B5-8A13-4B96-9368-DE8EDAE0EBCD}: NameServer = 69.50.188.180,195.225.176.31

O17 - HKLM\System\CCS\Services\Tcpip\..\{9BADF8AB-8EE6-43B7-A2E4-F8318DB56B30}: NameServer = 69.50.188.180,195.225.176.31

O17 - HKLM\System\CS1\Services\Tcpip\..\{07FE7868-1AFC-449C-96A5-823622487551}: NameServer = 69.50.188.180,195.225.176.31

O17 - HKLM\System\CS3\Services\Tcpip\..\{07FE7868-1AFC-449C-96A5-823622487551}: NameServer = 69.50.188.180,195.225.176.31

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

#6
Guest_thatman_*

Posted 02 March 2005 - 06:50 AM

Guest

Hi nrgeti

Welcome to geekstogo

Some off the following programs you may all ready have so there is no need to reinstall them again.

Please read through the instructions before you start (you may want to print this out).

Please download and install these programs - don't run them yet!!

Please download and unzip
About:Buster to a folder. Inside the folder is a readme file that has instructions on the use of the program.
AboutBuster MUST be updated before you use it.
Start AboutBuster, click the update button, check for update, drag the box to the side and hit download updates, close the box . Don't run it yet.

Please download and install AD-Aware.
Check Here on how setup and use it - please make sure you update it first.

Download and unzip cwsserviceremove to your desktop. Use either link below:
http://computercops....ownload&id=3002
http://www.mytechsup...rviceremove.zip

Download CW-Shredder at the link below:
CW-Shredder

Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked.
Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

For anyone using Windows XP, 'Search' will not automatically show hidden files even if your folder options settings are set to do that. Do this so you can see hidden files and folders - click here to download xphidden.zip. Extract xphidden.reg from the zip file and save it to the desktop. When done, double-click the xphidden.reg and when asked to merge say yes.

+++++++++++++++++++++++++++++++++++++++++++++++++

Here's the fix:

Important Step
1. Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:

Service: Service: N/A

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find this service listed go ahead with the next steps.

2. Reboot into Reboot into Safe Mode: Click here if you don't know how to do this.

3. Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for:

If you find the files, click on them, and then click End Process => Exit the Task Manager.

4. CLOSE ALL WINDOWS AND BROWSERS Scan with Hijack This and put checks next to all the following, then click "Fix Checked"

C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\System32\iesp2.dll (file missing)
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"

Using Windows Explorer, locate the following files/folders, and delete them:

C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe<--Delete this file
C:\WINDOWS\System32\iesp2.dll <--Delete this file
C:\Program Files\WareOut\WareOut.exe[/b] <--Delete the whole folder

Exit Explorer, and reboot as normal afterwards.

6. Run AboutBuster . This will scan your computer for the bad files and delete them. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

7. Scan with AdAware and let it remove any bad files found.

8. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Recycle Bin

Clean out off temp files in, Internet Explorer.
Internet Explorer: Tools/ Internet Options/ General/ Temporary internet files/ Delete Files (NOTE, that this may take very long!). You can also set the memory limit to about 80 MB at the Settings.

Mozilla: Edit/ Options/ Extended/ Cache/ Clear Cache

9. Double click on the cwsserviceremove and when asked to merge say yes.

10. Run CW-Shredder - Hit the FIX button - let it run and fix what it finds.

11. Reboot into normal mode.

12. Download the Hoster from here http://members.aol.c...bee/hoster.zip. Press "Restore Original Hosts" and press "OK". Exit Program.

13. Download and run this online virus scan:
http://housecall.tre.../start_corp.asp
Make sure you check "AutoClean"

Then reboot and post a fresh Hijack This log to see how we did.

Kc :tazz:

Edited by thatman, 02 March 2005 - 10:09 PM.

#7
nrgeti

Posted 02 March 2005 - 09:25 PM

Member

Topic Starter
Member
17 posts

One more question. When you say

2. Reboot into [url=http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406]SafeMode.[/url <---MAKE SURE YOU KNOW HOW TO DO THIS!!

Do you mean the regular Safe Mode? I don't understand the syntax of this statement when it includes ....symantec.com.... etc.

#8
Guest_thatman_*

Posted 02 March 2005 - 10:15 PM

Guest

Hi nrgeti

Sorry about that it have ajusted the link to Reboot into SafeMode.

You can continue with the fix.

Kc :tazz:

#9
rjs

Posted 03 March 2005 - 09:02 AM

Member

Member
22 posts

I have the same virus. Should I follow the steps above or would TAHTMAN be able to help me under my own thread started yesterday where i submitted my hyjackthis log file ( although I forgot to run this from a root directory on my C drive and ran it from a floder on my d drive - Does this matter ?

#10
Guest_thatman_*

Posted 03 March 2005 - 11:03 AM

Guest

Hi rjs

Please start your own thread.

Thank You

Kc :tazz:

#11
IceCactus

Posted 07 March 2005 - 04:07 AM

New Member

Member
3 posts

Hello!

Please search for Startpage.16.bd and to my pseudo in this forum.

I have used CWShredder with success.

Good luck.

#12
nrgeti

Posted 15 March 2005 - 08:49 AM

Member

Topic Starter
Member
17 posts

Hello, Thatman,

I have removed the SE.Trogan.startpage virus using the recipe you provided. Thank very much. I have several comments that may prove helpful for others.

1. At the time I was running your suggestions I could not find "cwsserviceremove" at either of these two links:
http://computercops....ownload&id=3002
http://www.mytechsup...rviceremove.zip
It may have been firewall problems. In any case I did not run it.

2. At the Ad-aware scan, I got two alerts for Trojan.startpage from the antivirus program AVG which was running in the background. AVG deleted the two programs. I think this is what actually cleaned up my PC. Previously full system scans by Norton's Antivirus, McAfee, etc. did not detect these two infected programs.

#13
Guest_thatman_*

Posted 15 March 2005 - 09:19 AM

Guest

Hi nrgeti

Please post a new HJT.log

Kc :tazz:

#14
Dr. Gonzo

Posted 05 April 2005 - 11:40 AM

New Member

Member
1 posts

To thatman, I am also infected with "se.dll" Trojan:StartPage and im currently following the steps of ur (very helpful) recipe, but I cannot find the "Service: Service N/A" in the service.msc box. I have little understanding of computer language, tho have been following ur instructions well until this point.

Help much appreciated.

Gonzo

#15
Michelle

Posted 05 April 2005 - 11:54 AM

Malware Removal Goddess

Retired Staff
8,928 posts

rjs and Dr. Gonzo - I know you want help (as does everyone else in this forum), but it is very rude to hijack someone's thread. Please post your own topic and someone will be along to help you with your system as soon as possible.