[Solved]Trojan Startpage-DU

Discussion in 'adware, spyware & hijack cleaning' started by maxedracer, Jun 27, 2004.

Thread Status:
Not open for further replies.
  1. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Hi im having problems with this startpage-DU virus it changes my hompage to about blank, mcafee gets rid of it but it keeps coming back, i get a warning about it has found the virus again every so many hours, i orginally had 3 trojans on they were "exploit-Mhtredir.gen" "VBS/psyme" "Startpage-C" since mcafee got rid of these they havent come back but this Startpage-DU does

    Here is my hijackthis log file:

    Logfile of HijackThis v1.97.7
    Scan saved at 00:00:29, on 28/06/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\WINDOWS\System32\ctfmon.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    C:\WINDOWS\System32\nvsvc32.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    c:\progra~1\mcafee.com\vso\mcvsftsn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\ICQ\Icq.exe
    C:\Documents and Settings\Jez\Desktop\downloads\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5DA98580-72A5-454F-BC66-8EF0F6FB2952} - C:\WINDOWS\System32\aba.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
    O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/mickey/us/win/QuickTimeInstaller.exe
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
    O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/beta_reg/soesysinfo.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://www.smgradio.com/core/player/abasetup144.cab
    O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
    O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab

    Thx
     
  2. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
    Re: Trojan Startpage-DU

    HI maxedracer

    Pls. save HJT in a convenient permanent folder such as C:\HJT

    Then Download cwshredder here Close all browser windows and click on the fix/next button.

    This may not help, but try running CWShredder in safe mode and then while in safe mode open HJT and check the following entries, click Fix and then REBOOT.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Jez\LOCALS~1\Temp\sp.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

    O2 - BHO: (no name) - {5DA98580-72A5-454F-BC66-8EF0F6FB2952} - C:\WINDOWS\System32\aba.dll (file missing)

    O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)


    Reboot

    Then use the Disk Cleanup Utility to empty all your Temp folders.

    Then Disable system restore: Instructions here
    Reboot

    Enable System Restore.

    Pls. post another log.
     
  3. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    k heres the log:

    Logfile of HijackThis v1.98.0
    Scan saved at 20:49:12, on 29/06/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVPersonal\AVGNT.EXE
    C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
    C:\PROGRA~1\mcafee.com\agent\mcagent.exe
    c:\progra~1\mcafee.com\vso\mcvsescn.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\AVPersonal\AVGUARD.EXE
    C:\Program Files\AVPersonal\AVWUPSRV.EXE
    c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
    C:\WINDOWS\System32\nvsvc32.exe
    c:\PROGRA~1\mcafee.com\vso\mcshield.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    F0 - system.ini: Shell=
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
    O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
    O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
    O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - https://cs7b.instantservice.com/jars/customerxsigned42.cab
    O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/beta_reg/soesysinfo.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
    O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://www.smgradio.com/core/player/abasetup144.cab
    O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
    O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab
     
  4. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
    Re: Trojan Startpage-DU

    HI maxedracer

    SUPER - Great job !

    You have only to fix one small "thing" in HJT:

    check F0 - system.ini: Shell= in in HJT - click "fix checked".

    Reboot.

    You are done :)

    Happy Safe Computing :)
     
  5. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    hi, im having a bit of a problem i know i deleted the 01 files in the hijackthis program, and the 01 reg values it says in the hijackthis info are browser hijacks for the auto search msn page which you should get when you type in a url wrong, but for some reason even though the 01 reg values have been deleted now the imposter page is still coming up when i type in a url wrong instead of the default msn auto search page.

    also the F0 value you have told me to fix will not go away and everytime i fix it reboot and load hijackthis up again it is still there
     
  6. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    my fault i actually didnt have any 01 reg files in the scan that hijackthis did but that is my exact problem i have a browser hijack that has taken over my msn auto search page when i type a url in wrong to their hosts page, according to the hijackthis info i should be gettin a 01 value in the scan but im not
     
  7. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
  8. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
    Re: Trojan Startpage-DU

    Let's give this a try:

    Copy the contents of the Quote box to Notepad. Name the file as search.reg
    save as type all files
    Double click on search.reg to enter into the registry.

     
  9. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    and do i add it to the registry ?
     
  10. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    because all it said was are u sure u want to add this to the registry ?
     
  11. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
    Re: Trojan Startpage-DU

    Yes, if you are asked to overwrite say "yes".
     
  12. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    dont think i was asked to overwrite but its in the reg now
     
  13. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    what does it do ?
     
  14. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
  15. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    hmm just this second mcafee has come up with a warning saying the file C:\WINDOWS\SYSTEM32\Jandoca.dll was infected by the startpage-DU trojan and has been deleted, this is what it keeps saying every so often i have tried lots of things to get rid of it but it just keeps coming back
     
  16. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    would i need to re-boot to make the reg IE changes take effect ?
     
  17. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    hmm some times like now hehe explorer in the task manager starts slowing the whole system down wasting lots of mem its using 383,296 k at the mo and thats without me being on the net
     
  18. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
  19. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    i downloaded trojan hunter and it didnt find any, i was looking on the internet about browser hijacking and read that some of the newer ones are near impossible to get rid of :( i hope i dont have one of those on all the forums i have looked at with peeps with the same problem it would say it in hijackthis they would have a 01 entry where their hosts file had been hijacked but i havent got this, i havent seen anything from any programs or reg entries that suggests i have been hijacked except the occasional detection from mcafee and the fact that i get re-directed to

    http://s1di.d8t.biz/index.php?aid=20038

    if you click on any link on this page it brings up search results and at the top of the page it says cool search im not sure if this is anything to do with cool web search or not
     
  20. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    just looking at my task manager now all processes usage adds up to about 50k and explorer has dropped to 383k to 18k yet for some reason in the performance tab there is 600mb of memory being used and thats just stupid, i read that some browser hijacker programs or viruses make the system use more memory and more until there is no more available
     
  21. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
  22. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    yes the annoying thing is that it says if you have the latest DAT engine which i do it should get rid of it but it doesnt
     
  23. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
    Re: Trojan Startpage-DU

    what happens if you run the scan in SAFEMODE??
     
  24. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    nothing i think ive tried it before i was talking to mcafee tech support for 2 days and tried everything they suggested but it still didnt get rid of it, i have looked at my reg file and none of the reg entries are there that mcafee say should be if you have a startpage-DU virus so i havent got a clue how its still hijacking my browser search page
     
  25. maxedracer

    maxedracer Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    46
    Re: Trojan Startpage-DU

    explorer is draining mem again :( 630 mb in use and all i got open is 1 web page
     
Thread Status:
Not open for further replies.