StartPage-DU.dll Trojan

Hello Frosticilus,

First of all I need you to download some programs for use later.

Download this file and unzip it to your desktop

Download About:Buster from here. Once it is downloaded extract it to c:\aboutbuster and check for updates. Do NOT use it yet

Download CWShredder from here, install it, check for updates but again, don't use it yet.

Then, Download Ad-aware Second Edition here and install it. If you already have Ad-aware Second Edition skip to the next step.

Open adaware and Click the "Check for updates now" line on the main screen. CLick the "Connect" button on the webupdate screen.

If an update is available download it and install it. Click the "Finish" button to go back to the main screen.

Click on the "Settings" button (gear symbol in the upper right corner of the main status screen) in the quick launch toolbar to open the General settings screen. Check the "Automatically quarantine objects prior to removal" setting and then click "Proceed" to save your changes

Click the "Scan now" button in the main menu on the left side of the main status screen or use the "Start" button in lower right corner. This will open the Preparing System Scan screen. Please deselect "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat. Then select "Use custom scanning options" and click "CUstomize". This will open the "Scan Settings Page. Make sure all of the following are On with a "green" checkmark:

Scan within archives
Scan active processes
Scan Registry
Deep-scan Registry
Scan my IE Favorites for banned URLs
Scan my Hosts File

Then click on the "Tweak" Button to open up the tweak settings.

Open up the Scanning Engine section and make sure all of the following are On with a "green" checkmark:

Scan registry for all users instead of current user only

Make sure the following is unchecked with a "red" X:

Unload recognized processes & modules during scan.

Open up the Cleaning Engine section and make sure all of the following are On with a "green" checkmark:

Always try to unload modules before deletion
During Removal, unload Explorer and IE if necessary
Let Windows remove files in use at next reboot.

Click the "Proceed" button to save settings.

Don't scan yet. We will do it in safe mode.

Ensure hidden files and folders are set to show;

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Show hidden files and folders.
• Uncheck the Hide protected operating system files (recommended) option.
• Click Yes to confirm.
• Click OK.

Next, go to Start->Run and type "Services.msc" (without quotes) then hit Ok

Scroll down and find the service called . When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.

Please disconnect from the Internet and unplug your modem for the duration of this fix You may want to print the rest of these instructions.

Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE

While in safe mode, double click on the cwsserviceemove.reg file you downloaded at the beginning. Grant it permission to add the registry items.

Then Open cwshredder that you downloaded in the first step. Close all browser windows and click on the fix/next button.

Bring up task manager Ctrl-Alt-Del and end these processes if they are present

addyy.exe
apiqu32.exe
mfczv.exe

addyq.exe
d3rp32.exe
crug.exe
winkt.exe

netzi32.exe
atlpy32.exe

appak32.exe
crmb.exe
javaqs32.exe
javaep.exe
mfcjt.exe
sdkzj.exe
sysds.exe

netvc32.exe
sysgi.exe
syseg32.exe
crry.exe

iepg32.exe
d3jg.exe
netzq32.exe
ipvi32.exe
crrg.exe
apilx32.exe
javauq32.exe
ntya.exe
syseo.exe
javaxf32.exe
cria.exe
ipbr32.exe
sysmw32.exe
javavm32.exe
iekx.exe
mswd32.exe
ntnk32.exe
d3ly.exe
atlam32.exe
ipcf.exe
ipqu.exe
netzs.exe
wincn.exe
ntcv32.exe
d3en32.exe
ipig.exe
atljb32.exe
addkb32.exe
crol.exe

apire32.exe
atlke.exe
msox32.exe
crpx32.exe
javaxs.exe
atlyv.exe

syshi32.exe
iepd.exe
atlzb.exe
atlaf.exe
d3lu32.exe
netjc.exe
mfcav32.exe
ntri32.exe
ipmr.exe
sdkat.exe
sdkgq.exe
crow32.exe
ipej32.exe
d3xi.exe
javagi32.exe
craz32.exe

I am continuing the fix in the next reply so don't stop here.

Now find and delete these files, if you can't find one then don't worry.. just move on to the next one.

C:\WINDOWS\system32\aqnar.dll

C:\WINDOWS\syspw.dll

C:\WINDOWS\system32\atlyb32.dll

C:\WINDOWS\system32\addyy.exe
C:\WINDOWS\apiqu32.exe
C:\WINDOWS\system32\mfczv.exe

C:\WINDOWS\addyq.exe
C:\WINDOWS\system32\d3rp32.exe
C:\WINDOWS\system32\crug.exe
C:\WINDOWS\winkt.exe

C:\WINDOWS\system32\netzi32.exe
C:\WINDOWS\system32\atlpy32.exe

C:\WINDOWS\appak32.exe
C:\WINDOWS\system32\crmb.exe
C:\WINDOWS\system32\javaqs32.exe
C:\WINDOWS\javaep.exe
C:\WINDOWS\mfcjt.exe
C:\WINDOWS\sdkzj.exe
C:\WINDOWS\sysds.exe

C:\WINDOWS\netvc32.exe
C:\WINDOWS\system32\sysgi.exe
C:\WINDOWS\system32\syseg32.exe
C:\WINDOWS\crry.exe

C:\WINDOWS\iepg32.exe
C:\WINDOWS\d3jg.exe
C:\WINDOWS\netzq32.exe
C:\WINDOWS\system32\ipvi32.exe
C:\WINDOWS\system32\crrg.exe
C:\WINDOWS\apilx32.exe
C:\WINDOWS\javauq32.exe
C:\WINDOWS\system32\ntya.exe
C:\WINDOWS\system32\syseo.exe
C:\WINDOWS\javaxf32.exe
C:\WINDOWS\system32\cria.exe
C:\WINDOWS\system32\ipbr32.exe
C:\WINDOWS\system32\sysmw32.exe
C:\WINDOWS\system32\javavm32.exe
C:\WINDOWS\system32\iekx.exe
C:\WINDOWS\system32\mswd32.exe
C:\WINDOWS\system32\ntnk32.exe
C:\WINDOWS\d3ly.exe
C:\WINDOWS\atlam32.exe
C:\WINDOWS\ipcf.exe
C:\WINDOWS\ipqu.exe
C:\WINDOWS\system32\netzs.exe
C:\WINDOWS\system32\wincn.exe
C:\WINDOWS\ntcv32.exe
C:\WINDOWS\system32\d3en32.exe
C:\WINDOWS\system32\ipig.exe
C:\WINDOWS\system32\atljb32.exe
C:\WINDOWS\addkb32.exe
C:\WINDOWS\crol.exe

C:\WINDOWS\apire32.exe
C:\WINDOWS\system32\atlke.exe
C:\WINDOWS\system32\msox32.exe
C:\WINDOWS\system32\crpx32.exe
C:\WINDOWS\system32\javaxs.exe
C:\WINDOWS\atlyv.exe

C:\WINDOWS\syshi32.exe
C:\WINDOWS\iepd.exe
C:\WINDOWS\system32\atlzb.exe
C:\WINDOWS\system32\atlaf.exe
C:\WINDOWS\system32\d3lu32.exe
C:\WINDOWS\netjc.exe
C:\WINDOWS\system32\mfcav32.exe
C:\WINDOWS\system32\ntri32.exe
C:\WINDOWS\ipmr.exe
C:\WINDOWS\system32\sdkat.exe
C:\WINDOWS\sdkgq.exe
C:\WINDOWS\system32\crow32.exe
C:\WINDOWS\ipej32.exe
C:\WINDOWS\system32\d3xi.exe
C:\WINDOWS\system32\javagi32.exe
C:\WINDOWS\system32\craz32.exe

C:\WINDOWS\system32\addyy.exe

Now run hijackthis and click the scan button, when it has finished scanning put a check against the following and click 'fix checked'

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Class - {7085B7F3-6735-6A89-5650-95D1C3942B93} - C:\WINDOWS\syspw.dll
O2 - BHO: Class - {ABD21B9C-E941-0D73-3CFC-DA88CA3C766E} - C:\WINDOWS\system32\atlyb32.dll

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr__.exe
O4 - HKLM\..\Run: [apifv.exe] C:\WINDOWS\system32\apifv.exe
O4 - HKLM\..\RunOnce: [addyy.exe] C:\WINDOWS\system32\addyy.exe
O4 - HKLM\..\RunOnce: [apiqu32.exe] C:\WINDOWS\apiqu32.exe
O4 - HKLM\..\RunOnce: [mfczv.exe] C:\WINDOWS\system32\mfczv.exe
O4 - HKLM\..\RunOnce: [addyq.exe] C:\WINDOWS\addyq.exe
O4 - HKLM\..\RunOnce: [d3rp32.exe] C:\WINDOWS\system32\d3rp32.exe
O4 - HKLM\..\RunOnce: [crug.exe] C:\WINDOWS\system32\crug.exe
O4 - HKLM\..\RunOnce: [winkt.exe] C:\WINDOWS\winkt.exe
O4 - HKLM\..\RunOnce: [netzi32.exe] C:\WINDOWS\system32\netzi32.exe
O4 - HKLM\..\RunOnce: [atlpy32.exe] C:\WINDOWS\system32\atlpy32.exe
O4 - HKLM\..\RunOnce: [appak32.exe] C:\WINDOWS\appak32.exe
O4 - HKLM\..\RunOnce: [crmb.exe] C:\WINDOWS\system32\crmb.exe
O4 - HKLM\..\RunOnce: [javaqs32.exe] C:\WINDOWS\system32\javaqs32.exe
O4 - HKLM\..\RunOnce: [javaep.exe] C:\WINDOWS\javaep.exe
O4 - HKLM\..\RunOnce: [mfcjt.exe] C:\WINDOWS\mfcjt.exe
O4 - HKLM\..\RunOnce: [sdkzj.exe] C:\WINDOWS\sdkzj.exe
O4 - HKLM\..\RunOnce: [sysds.exe] C:\WINDOWS\sysds.exe
O4 - HKLM\..\RunOnce: [netvc32.exe] C:\WINDOWS\netvc32.exe
O4 - HKLM\..\RunOnce: [sysgi.exe] C:\WINDOWS\system32\sysgi.exe
O4 - HKLM\..\RunOnce: [syseg32.exe] C:\WINDOWS\system32\syseg32.exe
O4 - HKLM\..\RunOnce: [crry.exe] C:\WINDOWS\crry.exe
O4 - HKLM\..\RunOnce: [iepg32.exe] C:\WINDOWS\iepg32.exe
O4 - HKLM\..\RunOnce: [d3jg.exe] C:\WINDOWS\d3jg.exe
O4 - HKLM\..\RunOnce: [netzq32.exe] C:\WINDOWS\netzq32.exe
O4 - HKLM\..\RunOnce: [ipvi32.exe] C:\WINDOWS\system32\ipvi32.exe
O4 - HKLM\..\RunOnce: [crrg.exe] C:\WINDOWS\system32\crrg.exe
O4 - HKLM\..\RunOnce: [apilx32.exe] C:\WINDOWS\apilx32.exe
O4 - HKLM\..\RunOnce: [javauq32.exe] C:\WINDOWS\javauq32.exe
O4 - HKLM\..\RunOnce: [ntya.exe] C:\WINDOWS\system32\ntya.exe
O4 - HKLM\..\RunOnce: [syseo.exe] C:\WINDOWS\system32\syseo.exe
O4 - HKLM\..\RunOnce: [javaxf32.exe] C:\WINDOWS\javaxf32.exe
O4 - HKLM\..\RunOnce: [cria.exe] C:\WINDOWS\system32\cria.exe
O4 - HKLM\..\RunOnce: [ipbr32.exe] C:\WINDOWS\system32\ipbr32.exe
O4 - HKLM\..\RunOnce: [sysmw32.exe] C:\WINDOWS\system32\sysmw32.exe
O4 - HKLM\..\RunOnce: [javavm32.exe] C:\WINDOWS\system32\javavm32.exe
O4 - HKLM\..\RunOnce: [iekx.exe] C:\WINDOWS\system32\iekx.exe
O4 - HKLM\..\RunOnce: [mswd32.exe] C:\WINDOWS\system32\mswd32.exe
O4 - HKLM\..\RunOnce: [ntnk32.exe] C:\WINDOWS\system32\ntnk32.exe
O4 - HKLM\..\RunOnce: [d3ly.exe] C:\WINDOWS\d3ly.exe
O4 - HKLM\..\RunOnce: [atlam32.exe] C:\WINDOWS\atlam32.exe
O4 - HKLM\..\RunOnce: [ipcf.exe] C:\WINDOWS\ipcf.exe
O4 - HKLM\..\RunOnce: [ipqu.exe] C:\WINDOWS\ipqu.exe
O4 - HKLM\..\RunOnce: [netzs.exe] C:\WINDOWS\system32\netzs.exe
O4 - HKLM\..\RunOnce: [wincn.exe] C:\WINDOWS\system32\wincn.exe
O4 - HKLM\..\RunOnce: [ntcv32.exe] C:\WINDOWS\ntcv32.exe
O4 - HKLM\..\RunOnce: [d3en32.exe] C:\WINDOWS\system32\d3en32.exe
O4 - HKLM\..\RunOnce: [ipig.exe] C:\WINDOWS\system32\ipig.exe
O4 - HKLM\..\RunOnce: [atljb32.exe] C:\WINDOWS\system32\atljb32.exe
O4 - HKLM\..\RunOnce: [addkb32.exe] C:\WINDOWS\addkb32.exe
O4 - HKLM\..\RunOnce: [crol.exe] C:\WINDOWS\crol.exe
O4 - HKLM\..\RunOnce: [apire32.exe] C:\WINDOWS\apire32.exe
O4 - HKLM\..\RunOnce: [atlke.exe] C:\WINDOWS\system32\atlke.exe
O4 - HKLM\..\RunOnce: [msox32.exe] C:\WINDOWS\system32\msox32.exe
O4 - HKLM\..\RunOnce: [crpx32.exe] C:\WINDOWS\system32\crpx32.exe
O4 - HKLM\..\RunOnce: [javaxs.exe] C:\WINDOWS\system32\javaxs.exe
O4 - HKLM\..\RunOnce: [atlyv.exe] C:\WINDOWS\atlyv.exe
O4 - HKLM\..\RunOnce: [syshi32.exe] C:\WINDOWS\syshi32.exe
O4 - HKLM\..\RunOnce: [iepd.exe] C:\WINDOWS\iepd.exe
O4 - HKLM\..\RunOnce: [atlzb.exe] C:\WINDOWS\system32\atlzb.exe
O4 - HKLM\..\RunOnce: [atlaf.exe] C:\WINDOWS\system32\atlaf.exe
O4 - HKLM\..\RunOnce: [d3lu32.exe] C:\WINDOWS\system32\d3lu32.exe
O4 - HKLM\..\RunOnce: [netjc.exe] C:\WINDOWS\netjc.exe
O4 - HKLM\..\RunOnce: [mfcav32.exe] C:\WINDOWS\system32\mfcav32.exe
O4 - HKLM\..\RunOnce: [ntri32.exe] C:\WINDOWS\system32\ntri32.exe
O4 - HKLM\..\RunOnce: [ipmr.exe] C:\WINDOWS\ipmr.exe
O4 - HKLM\..\RunOnce: [sdkat.exe] C:\WINDOWS\system32\sdkat.exe
O4 - HKLM\..\RunOnce: [sdkgq.exe] C:\WINDOWS\sdkgq.exe
O4 - HKLM\..\RunOnce: [crow32.exe] C:\WINDOWS\system32\crow32.exe
O4 - HKLM\..\RunOnce: [ipej32.exe] C:\WINDOWS\ipej32.exe
O4 - HKLM\..\RunOnce: [d3xi.exe] C:\WINDOWS\system32\d3xi.exe
O4 - HKLM\..\RunOnce: [javagi32.exe] C:\WINDOWS\system32\javagi32.exe
O4 - HKLM\..\RunOnce: [craz32.exe] C:\WINDOWS\system32\craz32.exe

O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.15.36/ttinst.cab

O18 - Filter hijack: text/webviewhtml - (no CLSID) - (no file)

O23 - Service: Network Security Service - Unknown - C:\WINDOWS\system32\addyy.exe (file missing)

The following step is important as you may have several malware files in your temp directories.

Then browse to the C:\documents and settings\Your User Name (repeat for all other user names in documents and settings)\local settings\temp folder and delete all files and folders in it. Then browse to the C:\Window\Temp folder and delete all files and folders in it. Then in internet explore click tools>internet Options>General. Click on Delete Files make sure you get all offline content as well.

Now navigate to the c:\aboutbuster directory and double-click on AboutBuster.exe. Click Begin Removal to allow AboutBuster to scan. When it has finished, AboutBuster will open a 'Scan Completed' window. Click OK. Another information window will open. Click on Exit. AboutBuster will inform you that a log has been created. Click OK. I will need you to post that log later.

Scan with Adaware by opening it and clicking the "Next" button to start the scan.

When the scan is completed the Performing System Scan screen will change name to "Scan Complete".

Click the "Next" button to get to the Scanning Results screens where more information about the objects detected during the scan is available.

Click the Critical Objects Tab. In general all of the items listed will be bad. Be carefull with the Hosts file entries. Malware uses the hosts file to redirect you websites. However you can use the hosts file as a way to prevent malware. If the object has 127.0.0.1 in it, it should most likely not be deleted as it is protecting against unwanted sites. For more information on how to use a host file to protect yourself read here. So in short, you may or may not want to fix the hosts file entries.

To fix all the bad critical objects do the following:

Right click on one of them to open up the selection screen. Click the "Select All" button to select all entries. In general all should be selected with the exception of the good hosts file entries.

When all are selected Click "Next" and then "OK" in the pop-up window to confirm the removal.

Now reboot,and run hijackthis again and post a fresh log along with the about buster log.