Infected with Trojan-Dropper.Win32.StartPage?

Variant: Trojan-Dropper.Win32.StartPage?

Affected OS: Win 9x / ME / XP /Vista / 7

Trojan-Dropper.Win32.StartPage? inserts malicious files to computers without the PC user’s knowledge, pretends itself as legitimate files, uses system resources and slows down computers processing extensively. It may frequently pop up advertising messages and in worst case scenario, severely destroy important computer data.

Here’s how to remove Trojan-Dropper.Win32.StartPage:

  • Boot to safe mode by pressing F8 key before the Windows logo appears then choose safe mode in the selection list then click Enter key.
  • Delete browsers (Internet Explorer / Firefox / Opera /Chrome) cookies and cache.
  • Show hidden folders and files by going to My Computer → Tools → Folder Options → View Tab  → click show hidden folders, files and drives. Uncheck hide operating systems files. Click OK.
  • Open Registry Editor by clicking Start → run → type “regedit” → click OK → Locate and Delete the listed registry entries:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

Caution: Backup the registry before editing/deleting.

  • Unregister the following DLL files:

%CommonAppData%\wangdun\kwsui.dll
%CommonAppData%\wangdun\kwssp.dll
%CommonAppData%\wangdun\kswebshield.dll
%CommonAppData%\wangdun\kswbc.dll

To unregister in Windows:
Windows 9x/ME/XP:

Start → Run → type “regsvr32 /u %CommonAppData%\wangdun\kwsui.dll” (Example) then click OK.

Windows Vista and 7:

Start → type run → you should see “run” under programs, click on it, then
type“regsvr32 /u%CommonAppData%\wangdun\kwsui.dll” (Example) then click OK.

Once you have unregistered a file successfully, a pop up window appears and confirms the specific  file as unregistered.

  • Delete the following processes files:

%CommonAppData%\wangdun\KSWebShield.exe
%CommonAppData%\wangdun\kwsui.dll
%CommonAppData%\wangdun\KWSSVC.log
%CommonAppData%\wangdun\kwssp.dll
%CommonAppData%\wangdun\KSWebShield.exe
%CommonAppData%\wangdun\kswebshield.dll
%CommonAppData%\wangdun\kswbc.dll
%CommonAppData%\kingsoft\kws\spitesp.dat
%CommonAppData%\kingsoft\kws\kws.ini

  • Restart Computer