Trojan StartPage

[eggy168]

Hi,
I have 2 pc got th Trojan StartPage virus. I followed the Symantec removal kit to clean the regedit, unfortunately I found no values that was suggested by the symantec.com. Anyhow, I scaned the pc and it said nothing affected. Then, I deleted the alerts from the Norton AntiVirus. 5 Min after I did all the job, the two pc had the pop up again about the virus found. Now,I tried to open the Hosts file and deleted everything except the "127.0.0.1 localhost".

Now, the question is after deleting all the entries and saved the file, it created a text file instead of the dll (I assumed). Am I doing something wrong here? Will it clear the virus?

Thanks for the help.

Eggy

 

[electronicsfreak]

I dont trust norton to much, my advice download ewido from the link below and do a full system scan in safe mode under the infected account. let us know your results.

http://www.ewido.net/en/

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[erikhertzel]

Ewido is a good malware tool, but is not really for viruses as much as for malware such as spyware, adware, trojans, etc...

So, just to make sure do this:

Run an online antivirus check from

http://www.kaspersky.com/virusscanner

choose extended database for the scan...

And,

Webroot spysweeper Trial:

Download it here:

http://www.sabethacomputing.com/downloads.html

Webroot Spysweeper 14 day Trial

Update the defs and do a sweep.

Hope that helps,

Erik

 

[Frank4d]

I had an email worm that I tried to delete several years ago when two PCs were connected to a router with file sharing enabled. As soon as I cleaned one, and then cleaned the other, the fist one was re-infected again. I went through the cleaning cycle several times before I discovered the solution which was to disconnect both from the router, clean them, and then reconnect to the router. It has been a long time, but I remember the worm searched for network shares and installed itself if a share was found.

 

[linney]

Just referring to your Host file, it is a non-extension type of file, so you can rename it and delete the .txt extension.
You may have to UNcheck "Hide extensions for known file types" in Folder Options/ View, to see and access the file extension bit of the name.



Removing adware & spyware
faq608-4650

 

[eggy168]

I can't delete the .txt extension or I have no ideas how to delete it. Can you please let me know? Thanks

 

[erikhertzel]

Just go to the hosts file under the following:

c:\winnt\system32\drivers\etc\hosts

Your PC will not know what program to use to open it. When it asks, use notepad.

For more information look here:

http://accs-net.com/hosts/how_to_use_hosts.html

 

[linney]

Uncheck "Hide extensions for known file types" in Folder Options/ View, to see and access the file extension bit of the name.

Use the Rename function in Explorer to delete the .txt part of the name. Ignore any warning message about changing a file extension (in this instance only).

 

[eggy168]

I followed the instruction, but it still saying the error message that I can't replace the .txt to a regular HOSTS file. I really have trouble doing this.
Really Annoying.

 

[linney]

Would you like to post the exact message you are getting when you try to rename it?

Some security programs block changing data in the hosts file by making it a read only file, perhaps you are running into this type of problem?

Have you tried approaching the problem from Safe Mode, or even copying a hosts file from another machine?

 

[eggy168]

Someone told me it is because the FAT32 set up? you think it causes the problem?
I have the StopZilla program installed beside the Norton Antivirus program. It causes the problem, too?
I tried to delete the hosts file in Dos and it can't let me delete it, too. Just weird that I can't delete it and copy from other machine.
This is the error message,

Error renaming File or Folder
Cannot rename Hosts: A file with the name you specified already esists. Specify a different file name

Thanks for your help.

 

[erikhertzel]

I would boot into Safe Mode and try it and stop all security programs as well.

 

[linney]

Go back to Folder Options/ View and tick the box to "show hidden files", and uncheck the other box to "hide protected system files (recommended)".

Recheck your etc folder and see what files you have in there.

You can also go to C:\WINDOWS\system32\drivers\etc via DOS, change the Attributes, using the Attrib command, to show hidden, read only, and system files. Then run a DIR command and see what you have listed in that Directory.

I don't think that FAT32 will be the problem. As the error message says, "Cannot rename Hosts: A file with the name you specified already exists". You already have a file named hosts in existence in that Directory.

Mind you, stranger things have happened with Windows, but look at the obvious reasons first.