Re: How do I remove a Trojan.StartPage virus

From: Trent SC (trent_at_invalid.invalid)
Date: 03/02/05 

Date: Wed, 2 Mar 2005 00:14:30 -0000

> | Every time I log on I get the error message that reads RUNDLL Error
> Loading
> | C:\DOCUME~1\JEFFG~1\LOCALS~1\Temp\se.dll After I click ok I get a
> message
> | that says Trojan.StartPage detected and removed. How do I completely
> get rid
> | of this virus and the rundll message?
>
> Dump the contents of the IE Temporary Internet Folder cache (TIF)
> start --> settings --> control panel --> internet options --> delete files
>
> 1) Download the following three items...
>
> Trend Sysclean Package
> http://www.trendmicro.com/download/dcs.asp
> Latest Trend signature files.
> http://www.trendmicro.com/download/pattern.asp
> Ad-aware SE (free personal version v1.05)
> http://www.lavasoftusa.com/
> Create a directory.
> On drive "C:\"
> (e.g., "c:\New Folder")
> or the desktop
> (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
>
> Download SYSCLEAN.COM and place it in that directory.
> Download the Trend Pattern File by obtaining the ZIP file.
> For example; lpt448.zip
>
> Extract the contents of the ZIP file and place the contents in the same
> directory as
> SYSCLEAN.COM.
>
> 2) Update Ad-aware with the latest definitions.
> 3) If you are using WinME or WinXP, disable System Restore
> http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
> 4) Reboot your PC into Safe Mode and shutdown as many applications as
> possible.
> 5) Using both the Trend Sysclean utility and Ad-aware, perform a Full
> Scan of your
> platform and clean/delete any infectors/parasites found.
> (a few cycles may be needed)
> 6) Restart your PC and perform a "final" Full Scan of your platform
> using both the
> Trend Sysclean utility and Adaware
> 7) If you are using WinME or WinXP,Re-enable System Restore and
> re-apply any
> System Restore preferences, (e.g. HD space to use suggested 400 ~
> 600MB),
> 8) Reboot your PC.
> 9) If you are using WinME or WinXP, create a new Restore point
>
> * * * Please report back your results * * *

Sorry to *** in on this thread, but am having the same problem on an ME
machine and the above solutions didn't do the business - still infected!