Spyware, Viruses, & Security forum

General discussion

Annoying Trojan called StartPage-EH.....Please help me !!!

by wsocnet / November 30, 2004 2:58 PM PST

Dear All,

I have a problem with Trojan detected by McAfee as StartPage-EH. The antivirus says that the file being infected is BEHKNQTW.DLL (located in directory windows\system). However, the antivirus cannot clean it nor can it delete the infected file.

I then tried deleting it manually (by using both windows explorer and DOS command line but not succeeded that's to say the BEHKNQTW.DLL cannot still be deleted. Is that file required by the windows, I mean what file is it?

The symptoms I undergo is when I opened the IE Browser to a certain address, say www.yahoo.com. It redirects me to page http://ssearch.biz displaying look like Search Engine but Nothing can do with it.

I use Win98SE with IE v6, many removal tools I have been trying i.e. SpybotS&D, CWShredder, Doctor Spyware,Spyware Guard, and the likes. I also tried resetting Web Setting to its default

But the Trojan is still there. It comes back again.

Your help to get rid of this annoying thing will greatly be appreciated.


Best regards,
Wans

Discussion is locked
You are posting a reply to: Annoying Trojan called StartPage-EH.....Please help me !!!
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Annoying Trojan called StartPage-EH.....Please help me !!!
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Re: Annoying Trojan called StartPage-EH.....Please help me !
by roddy32 / November 30, 2004 8:48 PM PST

Hi Wans
"ssearch.biz" is a nasty one so I will leave it for one of the experts to help you. You will probably need more tools than what you listed. I'm also not familiar with "Doctor Spyware". There is a program that is called "Spyware Doctor", which is not condemned but is also not condoned. Also, what do you mean by "and the likes"? There are a lot of ripoffs out there so please be specific also what you are using. The others that you listed are good although there are a couple more I would add if you don't already have them.I'm just prepping you for one of the experts because they will probably ask you the same questions.

Collapse -
Re: Annoying Trojan called StartPage-EH.....Please help me !
by Bugbatter / November 30, 2004 10:42 PM PST

That file, its "friends" and its registry entries need to go. You will need more tools, and you will need somebody to walk you through a fix. Post a HijackThis log on one of the forums that handle such.
Download HijackThis v.1.98.2 to its own permanent folder.
http://www.spywareinfo.com/~merijn/files/HijackThis.exe
If that link is not working, extract from http://www.downloads.subratam.org/hijackthis.zip

To create a folder:
Click My Computer, then C:\
In the menu bar, File->New->Folder.
That will create a folder named "New Folder", which you can rename to "HJT" or "HijackThis".
Now you have C:\HJT\ folder.

Scan and DO NOT fix anything.
After Scan, the Scan button changes to Save Log.
Click that, save it somewhere. Do Ctrl-A to Select all, and then copy and paste it into a post on one of the following sites in their malware forum so an expert can tell you what to fix.
It may take a few days because they are swamped, but they will get to you eventually.
Here:
- http://www.computercops.biz/

- http://forums.spywareinfo.com/

or any listed here: http://www.a-sap.org

Collapse -
Re: Annoying Trojan called StartPage-EH.....Please help me !
The antivirus says that the file being infected is BEHKNQTW.DLL (located in directory windows\system). However, the antivirus cannot clean it nor can it delete the infected file.

Try this:

Download the killbox from here.
http://download.broadbandmedic.com/

Extract TheKillBox.exe from the zip file and double click it to open it up.

Then try this.
In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\Windows\System\BEHKNQTW.DLL


Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot". On the next screen, click on the File menu and choose "Add File". C:\Windows\System\BEHKNQTW.DLL listing should show up in the window. If that's successful, choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.
Collapse -
Re: Annoying Trojan called StartPage-EH.....Please help me !
by wsocnet / December 4, 2004 11:56 PM PST

Deal All,
Thank you all: roddy32, bugbatter, and Marianna for your supports on this Trojan.

I have tried everything as instructed here, however, the Trojan did not want to go out. As roddy32 said, it was a nasty trojan, indeed. The tool called Killbox did not remove BEHKNQTW.DLL, the Trojan was apparently immune.

I eventually tried (today, 05 Dec 2004) the Panda Titanium AV 2004, and fully scanned my computer.

Oh.....thanks God. It is successful that Panda TAV did delete the nasty Trojan.

The Antivirus detected the Trojan as StartPage.HT by which StartPage-EH is alias thereof.

Well...As of now I have my own computer free of that Trojan and my IE works normally, not redirected to http://ssearch.biz anymore.

Regards,
Wans

Collapse -
Great job ! Maybe now is the best time to get Firefox
Collapse -
(NT) (NT) Great News Wans, congrats. :D
by roddy32 / December 5, 2004 1:18 AM PST
Collapse -
Startpage-EH destroy
by Atlantar / January 20, 2005 9:26 AM PST

I had this spy and run Spybot and I had no problem to destroy it and it did not come back. But, you have to use the latest version of spybot. I use windows xp Professional

Popular Forums
icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

Does BMW or Volvo do it best?

Pint-size luxury and funky style

Shopping for a new car this weekend? See how the BMW X2 stacks up against the Volvo XC40 in our side-by-side comparison.