HI,

FM,

How do I rid myself of this trojan virus.....Startpage.DZ?



.....

any info appreciated.



rainy

rainy wrote:



> HI,

> FM,

> How do I rid myself of this trojan virus.....Startpage.DZ?

>

> .....

> any info appreciated.

>

> rainy



By installing and running a current antivirus using updated definitions.

A quick Google indicates that this may be connected with the Bagle

virus. Since you didn't tell us what you've already done, I can't be

more specific. Have you run av software and had it fail to clean the

virus? Post back with details for more help.



Malke

--

MS MVP - Windows Shell/User

Elephant Boy Computers

www.elephantboycomputers.com

"Don't Panic!"

I could not find any info on a Start Page: DZ virus. Nor could I find

anything on a "Bagle" Virus. My problem dealt with the Trojan: Start Page

Virus. It hijacks the start page.



I have xp pro on my machine.



The first thing I did was to do a scan for the virus. I did that at

Symantec. (At http://www.Symantec.com click the "Security Response Tab"at

the top of the page. In the middle of the page that comes up you will find,

on the right side, a  "Check for Security Risk" Icon. Click on that and

follow the instructions to start the "VIRUS CHECK".)



It detected some eight files infected.

1. Three copies of the "Hosts" files

2. Two files in the R7 folder of the Temporary Solutions Folder

3. Three files in the Downloaded Internet Folder.



Once the Virus was detected I went to Symantec's Encyclopedia and looked up

the details and removal instruction for Trojan: StartPage Virus. (I also

looked up Bookmaker F. that is a variant of the Virus) There is no 'removal

tool', you have to do it manually.



The infected Hosts folder is found by doing a search on the C Drive. Used

Notebook to open the files. I found the corresponding bad instruction.

Deleted these files but one of them came back again.



Logged on as administrator and removed the files in R7 folder. The problem

with the bad files in the Downloaded Internet Folder is that it contains a

number of "Hidden" files, and two created directories (Conflict 1 and

Conflict 2), which would not show up using Windows Explorer (even logged on

as Administrator and with the "show all hidden folders and files" checked).

I had to open up Dos and access the directories to see and delete the files.

If you don't know how to do that let me know.



Even with these eight files finally deleted I had to use Spybot (newly

installed) to find the bad file that was causing the creation of the

corrupted "Hosts" file. I also followed the registry removal instructions to

correct the problems there.



As I explained originally I still have a residual problem.







"rainy" <anonymous@discussions.microsoft.com> wrote in message

news:D36C6B33-10E8-411B-BEF5-1ADA842A60A6@microsoft.com...

> HI,

> FM,

> How do I rid myself of this trojan virus.....Startpage.DZ?

>

> ....

> any info appreciated.

>

> rainy

updated...my microsoft....patches..etc.

then use avg..virus program....

avg said...it found the virus...but said i could delete the file....Winlogon.exe file..it was attached to???

and then i came here to talk to you guys...

in hopes of  an answer....

won't be back for ..2 days.....k...on a holiday break

randy

still...no...real results....

it looks like alot of work..to do what your talking about...

is there an easier way...

i have windows 2000 professional..not xp??

is that a difference?

rainy...



only been able to get to you now....

was on holidays...

rainy wrote:



> still...no...real results....

> it looks like alot of work..to do what your talking about...

> is there an easier way...

> i have windows 2000 professional..not xp??

> is that a difference?

> rainy...

>

> only been able to get to you now....

> was on holidays...



Lose the bloody ellipses, please and use complete sentences for clear

posts. Yes, there is an easier way: take the machine to a good local

computer repair shop and have a professional clean it up for you. No,

it doesn't make a difference that you have Win2k.



Malke

--

MS-MVP Windows User/Shell

Elephant Boy Computers

www.elephantboycomputers.com

"Don't Panic"

On Sat, 05 Jun 2004 18:39:08 -0500, Malke wrote:



> rainy wrote:

> 

>

> Lose the bloody ellipses, please and use complete sentences for clear

> posts. Yes, there is an easier way: take the machine to a good local

> computer repair shop and have a professional clean it up for you. No,

> it doesn't make a difference that you have Win2k.



Except that rainy does not have a builtin firewall and needs to get

one before attempting to go online again:

http://www.zonelabs.com/store/content/home.jsp

http://www.kerio.com/kpf_home.html

http://smb.sygate.com/products/spf/spf_ov.htm



Wait a minute, those are www hyperlinks (online).

Interesting catch 22.

Rainy, get the professional to burn your chosen software firewall

to cd for you.



--

Windows: What worm do you want to host today?

Jason Wade wrote:



> On Sat, 05 Jun 2004 18:39:08 -0500, Malke wrote:

> 

>

> Except that rainy does not have a builtin firewall and needs to get

> one before attempting to go online again:

> http://www.zonelabs.com/store/content/home.jsp

> http://www.kerio.com/kpf_home.html

> http://smb.sygate.com/products/spf/spf_ov.htm

>

> Wait a minute, those are www hyperlinks (online).

> Interesting catch 22.

> Rainy, get the professional to burn your chosen software firewall

> to cd for you.

>



You're right, Jason, although someone who doesn't want to be bothered to

do the "normal" disinfecting routines isn't going to want to deal with

installing a firewall, setting it up, etc. That's why I suggested that

s/he just take the machine to a shop instead of trying to do this on

his/her own. We all know how meticulous you have to be in cleaning a

machine and how tedious it can be.



Malke

--

MS MVP - Windows Shell/User

Elephant Boy Computers

www.elephantboycomputers.com

"Don't Panic!"

Good Afternoon,  here is a summary of my problem.

1. Everytime I open up Internet Explorer the Trojan Start page is activated.  

2. Everytime I open up Windows Explorer the Trojan Start page virus is activated.

3.I ordered xoftspy to get rid of the problem.(dumb move)   It found many trojans and deleted most of them.  But not the famous trojan start page.

4. I have norton anti-virus and I scan my pc and it says the  febb.dll is infected.   I tried to quarantined it and delete but when i reboot and rescan it's still there.

5.  when using Xoftspy  is find the same files.  here is it's summary of result 

VENDOR:        

comet cursor

cws.mrhop

cws.mrhop

i delete it and rescan and it comes back 

Can someone tell me what to do to get rid of the trojan start page virus 



Thank you

On Wed, 23 Jun 2004 17:10:20 -0500, alcoach

<alcoach.18f15w@mail.mcse.ms> wrote:



>

>Good Afternoon,  here is a summary of my problem.

>1. Everytime I open up Internet Explorer the Trojan Start page is

>activated.

>2. Everytime I open up Windows Explorer the Trojan Start page virus is

>activated.

>3.I ordered xoftspy to get rid of the problem.(dumb move)   It found

>many trojans and deleted most of them.  But not the famous trojan start

>page.

>4. I have norton anti-virus and I scan my pc and it says the  febb.dll

>is infected.   I tried to quarantined it and delete but when i reboot

>and rescan it's still there.

>5.  when using Xoftspy  is find the same files.  here is it's summary

>of result

>VENDOR:

>comet cursor

>cws.mrhop

>cws.mrhop

>i delete it and rescan and it comes back

>Can someone tell me what to do to get rid of the trojan start page

>virus

>

>Thank you



CWS is CoolWebSearch.  CWS shredder is the tool that removes this.

Download from here

http://www.spywareinfo.com/~merijn/downloads.html



Taff............







www.sounds-pa.com    |   www.thecomputerworkshop.com