Viruses, Spyware and...

Viruses, Spyware and other Nasties RSS

Can't delete virus

Last »

•

Join Date: Jun 2005

Posts: 15

Reputation: Larry H is an unknown quantity at this point

Solved Threads: 1

Larry H

Offline

Newbie Poster

Re: about:blank?

Jun 6th, 2005

•

Originally Posted by agbd

This is my first visit to this site and I need some help.
When you open Internet Explorer the following virus notice comes onto the screen

VIRUS DETECTED
C:\WINDOWS\TEMP\SE.DLL
Trojan Horse Startpage.19J

When you press the heal button it heals it and then comes up with a box in the bottom of the screen which says RUNDLL. However, every time you open internet explorer this same virus comes up again.

We have AVG Version 7 and AD-AWARE SE on our computer but we can't get rid of the virus.

Can anyone help me please? I'm new to this.
Thanks

I, too, am new to this site & have the exact same problem coming up sincelast week.

Larry H

•

Join Date: Jul 2004

Posts: 2,964

Reputation: dlh6213 is on a distinguished road

Solved Threads: 209

dlh6213

Offline

Posting Maven

Re: Can't delete virus

Jun 7th, 2005

Hi Larry, welcome to DaniWeb

I've split your post into it's own thread per forum rules (http://www.daniweb.com/techtalkforum..._faq#faq_rules)

Download, install, update, and run these tools:

CWShredder -- http://www.intermute.com/spysubtract..._download.html
about:Buster -- http://www.majorgeeks.com/download4289.html

Please get the self-extracting version of HijackThis from here (in line 2):
http://www.malwareremoval.com/downloads.html

Then close any open browser windows, 'Scan and Save Log' with hijackthis, copy the log, and paste it in this thread.

Links to help you help yourself :

Protect Your PC & Avoid Infections -- http://www.daniweb.com/techtalkforums/thread27519.html

Cleanup Procedures & Tools -- http://www.daniweb.com/techtalkforums/thread27570.html

Infection Removal & HijackThis Use -- http://www.daniweb.com/techtalkforums/thread28196.html

•

Join Date: Jun 2005

Posts: 15

Reputation: Larry H is an unknown quantity at this point

Solved Threads: 1

Larry H

Offline

Newbie Poster

Re: Can't delete virus

Jun 9th, 2005

•

Originally Posted by dlh6213

Hi Larry, welcome to DaniWeb

I've split your post into it's own thread per forum rules (http://www.daniweb.com/techtalkforum..._faq#faq_rules)

Download, install, update, and run these tools:

CWShredder -- http://www.intermute.com/spysubtract..._download.html
about:Buster -- http://www.majorgeeks.com/download4289.html

Please get the self-extracting version of HijackThis from here (in line 2):
http://www.malwareremoval.com/downloads.html

Then close any open browser windows, 'Scan and Save Log' with hijackthis, copy the log, and paste it in this thread.

Need help with all the above. Have tried to download CW and Buster and hasving no luck and the Hijack This I need more detailed stp by step help. Nothing seems to be working to get this problem out of my system.
larry H

•

Join Date: Dec 2003

Posts: 6,439

Reputation: DMR will become famous soon enough

Solved Threads: 362

DMR

Offline

Wombat At Large

Re: Can't delete virus

Jun 9th, 2005

Hi Larry,

Please do as dlh6213 suggested and we'll go from there:

•

Originally Posted by dlh6213

Please get the self-extracting version of HijackThis from here (in line 2):
http://www.malwareremoval.com/downloads.html

Then close any open browser windows, 'Scan and Save Log' with hijackthis, copy the log, and paste it in this thread.

"May the Wombat of Happiness snuffle through your underbrush."
- Ancient Aborigine blessing

Please do not contact me by email or PM for help. We're all volunteers here, and only have so much free time to dedicate to our efforts.

However, if I've been working on a thread with you already, and seem to have "forgotten" your thread, please do send me a message. I try not to let things slip through the cracks, but it does happen sometimes.

•

Join Date: Jun 2005

Posts: 15

Reputation: Larry H is an unknown quantity at this point

Solved Threads: 1

Larry H

Offline

Newbie Poster

Re: Can't delete virus

Jun 10th, 2005

•

Originally Posted by DMR

Hi Larry,

Please do as dlh6213 suggested and we'll go from there:

Hope I've correctly downloaded the malware prog. & copied & pasted the scanlog [even I see a bunch of aboutblank things in it].

Logfile of HijackThis v1.99.1
Scan saved at 5:21:49 PM, on 6/10/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\IOMEGA HOTBURN PRO\AUTOLAUNCH.EXE
C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\PICASA2\PICASAMEDIADETECTOR.EXE
C:\WINDOWS\SYSTEM\SRSYSTEMTRAY.EXE
C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE
C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\JUNO\BIN\JUNO.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\JUNO\QSACC\X1EXEC.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Juno Online Services, Inc.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7900
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 64.136.29.30;64.136.21.30;64.136.29.34;searchap.untd.com;127.0.0.1;localhost;*windowsupdate.microsoft.com;*windowsupdate.com;*wustat.windows.com;*.pogo.com;*test-speed.com;liveupdate.symantecliveupdate.com;*symantec.com;*.nai.com;*.networkassociates.com;<local>
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: BHOPopupSmasher Class - {702EA91C-1ACF-4772-8078-18F2B2EE1031} - C:\WINDOWS\SYSTEM\BLOCKACTIVEX.DLL
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDSG.DLL
O2 - BHO: (no name) - {BCDCF4B9-D8CE-11D9-9DB5-F3B7069DB654} - C:\WINDOWS\SYSTEM\AGDH.DLL
O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\PROGRAM FILES\JUNO\QSACC\X1IEBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\PROGRAM FILES\CANON\EASY-WEBPRINT\TOOLBAND.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [SystemTraySR] C:\WINDOWS\SYSTEM\SRSystemTray.exe
O4 - HKLM\..\Run: [MonitorSR] C:\WINDOWS\SYSTEM\SRMonitor.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunOnce: [untd_recovery] C:\PROGRAM FILES\JUNO\QSACC\X1EXEC.EXE
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1
O4 - HKCU\..\Run: [Spyware Doctor] "C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE" /Q
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\PROGRAM FILES\CANON\EASY-WEBPRINT\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\PROGRAM FILES\CANON\EASY-WEBPRINT\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\PROGRAM FILES\CANON\EASY-WEBPRINT\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\PROGRAM FILES\CANON\EASY-WEBPRINT\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\PROGRAM FILES\JUNO\QSACC\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\PROGRAM FILES\JUNO\QSACC\appres.dll/227
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
O9 - Extra button: Juno - {53ACB2E0-8D4F-11D9-9DB5-E232C24C1E74} - juno.exe (file missing) (HKCU)
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - https://livesc02.custhelp.com/6030-b.../java/RntX.cab
O18 - Filter: text/html - {BCDCF4B8-D8CE-11D9-9DB5-F3B769D113CF} - C:\WINDOWS\SYSTEM\AGDH.DLL
O18 - Filter: text/plain - {BCDCF4B8-D8CE-11D9-9DB5-F3B769D113CF} - C:\WINDOWS\SYSTEM\AGDH.DLL

•

Join Date: Jun 2005

Posts: 15

Reputation: Larry H is an unknown quantity at this point

Solved Threads: 1

Larry H

Offline

Newbie Poster

Re: Can't delete virus

Jun 14th, 2005

Hi, I think I properly installed and ran the Hijack this program, then copie& pasted the log and sent it to you. That was on Friday. It's Tues. morn and I've had no reply-- [I understand your time is limited but just want to make sure it was rec'd.

larry H

•

Join Date: Jun 2005

Posts: 17

Reputation: buddylee614 is an unknown quantity at this point

Solved Threads: 0

buddylee614 buddylee614 is offline

Offline

Newbie Poster

Re: Can't delete virus

Jun 14th, 2005

use the microsoft antispyware, i bet its gonna get it out
download it for http://www.download.com/Microsoft-Wi...ml?tag=lst-0-4 or get it from microsoft's website and search for it....

hope that helps.....

buddylee614,viz ex!!

•

Join Date: Jul 2004

Posts: 2,964

Reputation: dlh6213 is on a distinguished road

Solved Threads: 209

dlh6213

Offline

Posting Maven

Re: Can't delete virus

Jun 18th, 2005

•

Originally Posted by Larry H

Need help with all the above. Have tried to download CW and Buster and hasving no luck and the Hijack This I need more detailed stp by step help. Nothing seems to be working to get this problem out of my system.
larry H

What kind of problem are you having getting CWShredder and about:Buster?

•

Join Date: Dec 2003

Posts: 6,439

Reputation: DMR will become famous soon enough

Solved Threads: 362

DMR

Offline

Wombat At Large

Re: Can't delete virus

Jun 19th, 2005

•

Originally Posted by Larry H

Hi, I think I properly installed and ran the Hijack this program, then copie& pasted the log and sent it to you. That was on Friday. It's Tues. morn and I've had no reply-- [I understand your time is limited but just want to make sure it was rec'd.

larry H

Sorry to leave you hanging Larry,

My birthday was on the 10th, I had relatives visiting from then until the 17th, I took a much-needed trip to Yosemite National Park somewhere in there, and also lost my Internet service for a few days too boot... a long week & 1/2.

You definitely have a version of the About:Blank infection at the very least.

1. Download, install, and run the MS AntiSpyware program that buddylee614 linked to; let it fix everything it finds.

2. Try these alternate download links for About:Buster and CWShredder:

about:buster
CWShredder

3. Also download this "about:blank" removal tool.

4. Reboot into safe mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up)

- Run the three removal utilities I linked to above consecutively.

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".

- For every user account listed under C:\Documents and Settings, delete the entire contents of these folders (but not the folders themselves):

Important: One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if any data that you care about is living in those Temp folders, you need to move it to a safe location now, or it will be erased along with everything else!

1. Cookies
2. Local Settings\Temp
3. Local Settings\History
4. Local Settings\Temporary Internet Files

- Delete the entire content of your C:\Windows\Temp folder.

- Delete the entire content of your C:\Windows\Prefetch folder.

Note- If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed. Windows will allow you to delete the versions of those files which exist in sub-folders within the main Temp/Temorary folders, but might not let you delete the versions of those files that exist in the main Temp folders themselves; this is normal and OK.

- Empty your Recycle Bin.

- Reboot normally.

5. Run HijackTHis again and post a new log.