Bullguard Antivirus Forum Download A Free Copy Of Bullguard Antivirus Software
Free Antivirus Forum - Learn about antivirus, firewalls and personal security Free Antivirus Forum - Learn about antivirus, firewalls and personal security
 HomeLog InRegisterCommunity CalendarSearch the ForumView The Member ListHelp
Trojan Startpage.16.BD
   
BullGuard Antivirus Forum > Virus Removal > Removal Help > Trojan Startpage.16.BD  
Forum Quick Jump
 
New Topic Post reply to : Trojan Startpage.16.BD Printable version of : Trojan Startpage.16.BD
[ << Previous Thread | Next Thread >> ]

linc1068
New Member


Date Joined Apr 2005
Total Posts : 1
  		   Posted 4-10-2005 12:47 (GMT +1)    Quote: Trojan Startpage.16.BDAlert an admin about: Trojan Startpage.16.BD
Hi,
 
I know that this virus has been discussed before, but could someone please have a look at this highjackthis log and see which items I need to check and get it to fix?  I am quite new at this type of thing and am a bit unsure about what
I need to do.
 
Thank you
 
 
 
Logfile of HijackThis v1.99.1
Scan saved at 12:26:14, on 10/04/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\HJT\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Emily\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Emily\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO:   - {7129ab98-b8f7-4cb9-ae9f-75fb10d89ccd} - C:\WINDOWS\System32\xxhvfa.dll
O2 - BHO: (no name) - {EC736328-77F7-4458-9467-B905641063AB} - C:\WINDOWS\System32\kmjp.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CPLDBL10] C:\Program Files\EzButton\CPLDBL10.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /O6 "USB001" /M "Stylus C44"
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Emily\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11111111-1111-1111-1111-666666666666} - ms-its:mhtml:file://d:\foo.mht!http://www.doctorinternet.co.uk//x.chm::/open.exe
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O18 - Filter: text/html - {3C65A6D7-C772-49A5-A8F7-5DBEC8F84E38} - C:\WINDOWS\System32\kmjp.dll
O18 - Filter: text/plain - {3C65A6D7-C772-49A5-A8F7-5DBEC8F84E38} - C:\WINDOWS\System32\kmjp.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: SysTray - {7129ab98-b8f7-4cb9-ae9f-75fb10d89ccd} - C:\WINDOWS\System32\xxhvfa.dll
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
 
Back to Top
 

Emilio (SVK)
Gold Member




Date Joined Jan 2005
Total Posts : 1876
  		   Posted 4-11-2005 3:38 (GMT +1)    Quote: Trojan Startpage.16.BDAlert an admin about: Trojan Startpage.16.BD
Hi Linc1068

Download Ad-AwareSE

Download SpyBot

Download Mwav

Download SysClean (sysclean.com file)
Download pattern file
(unpack and copy with sysclean.com to the same folder)

Download TDS-3
Download TDS-3 update
(just re-copy radius.td3 file to the folder TDS-3)

Download latest Stinger version

Download CCleaner

http://www.docsdownloads.com/Tier1/dr-delete.htm

Download Advanced process termination
www.diamondcs.com.au/index.php?page=apt
(you don´t have to install it....it´s only executable utility)

install and check for updates....

PROCEDURE:
1.Turn off System restore

2.Reboot to the "Safe mode"

3.Show hidden files

4.Run Hijackthis:
Check:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Emily\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Emily\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: - {7129ab98-b8f7-4cb9-ae9f-75fb10d89ccd} - C:\WINDOWS\System32\xxhvfa.dll
O2 - BHO: (no name) - {EC736328-77F7-4458-9467-B905641063AB} - C:\WINDOWS\System32\kmjp.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Emily\LOCALS~1\Temp\se.dll,DllInstall
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {11111111-1111-1111-1111-666666666666} - ms-its:mhtml:file://d:\foo.mht!http://www.doctorinternet.co.uk//x.chm::/open.exe
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O18 - Filter: text/html - {3C65A6D7-C772-49A5-A8F7-5DBEC8F84E38} - C:\WINDOWS\System32\kmjp.dll
O18 - Filter: text/plain - {3C65A6D7-C772-49A5-A8F7-5DBEC8F84E38} - C:\WINDOWS\System32\kmjp.dll
O21 - SSODL: SysTray - {7129ab98-b8f7-4cb9-ae9f-75fb10d89ccd} - C:\WINDOWS\System32\xxhvfa.dll
Fix checked...........

5.Run Advanced Process Termination:
(skip this step)
select and then press "ALL" button in PROCES CONTROL OPTIONS

6.Find and delete these files:(use Dr.Delete)
C:\WINDOWS\System32\kmjp.dll
C:\WINDOWS\System32\xxhvfa.dll
C:\DOCUME~1\Emily\LOCALS~1\Temp\se.dll
spage.html

7.Scans:
run scan with Ad-AwareSE (full system scan, scan volume for ADS)
run scan with SpyBot
run scan with Stinger
run scan with Mwav (all scan options)
run scan with SysClean
run scan with TDS-3 (choose all choices to scan in SCAN CONTROL)

8.Cleaning
run CCleaner (analyze---run cleaner)

9.Enable System restore (reverse progress of disabling)

10.Reboot

post new log for check...thx

Emilio24

Back to Top
 
New Topic Post reply to : Trojan Startpage.16.BD Printable version of : Trojan Startpage.16.BD
 
Forum Information
Currently it is Saturday, November 21, 2009 1:35 PM (GMT +1)
There are a total of 73.031 posts in 17.116 threads.
In the last 3 days there were 14 new threads and 69 reply posts. View Active Threads
Who's Online
This forum has 30334 registered members. Please welcome our newest member, sushil.
34 Guest(s), 1 Registered Member(s) are currently online.  Details
urbane
5 Latest Threads
Constant scanning andskipped files? (1)21-11-2009 10:08:33 (Dickens)
Michael Vick jerseys (1)21-11-2009 09:42:37 (Dickens)
Arizona Cardinals Jerseys (1)21-11-2009 09:37:23 (Dickens)
How to remove this Malware/Virus (0)21-11-2009 06:54:16 (bozzack)
Atlanta Falcons Jerseys (0)21-11-2009 06:15:26 (donejerseys)


Need Support? Write to: | Forum Help Manual

Download free trial version of Bullguard