|
|
|
re: sp.dll and user.ini
Tuesday, October 16, 2001 at 8:11 am
Posted by Chris Caldwell
(4 messages posted)
I have a 2000 machine the gives me the error "cannot import c:\winnt\sp.dll Not
all data was successfully written to the registry. Some keys are open by the system
or other processes." The copy of sp.dll that I found on that machine refers to registry
entries that point to a web page called www.jethomepage.com
On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Tuesday, October 16, 2001 at 2:22 pm
Posted by Rowan
(3 messages posted)
The sp.dll file always caused internet explorer to bring up this "jethomepage" as
the default search engine. I had tried changing the registry settings and the default
settings of IE but this did not work. Finally, I searched for the "jethomepage" and
found this string in sp.dll. I renamed the file but got an error. I then just edited
the file and removed all the lines except for the first line "REGEDIT4". After that,
IE was ok.
On Tuesday, October 16, 2001 at 8:11 am, Chris Caldwell wrote:
>I have a 2000 machine the gives me the error "cannot import c:\winnt\sp.dll Not
>all data was successfully written to the registry. Some keys are open by the system
>or other processes." The copy of sp.dll that I found on that machine refers to
registry
>entries that point to a web page called www.jethomepage.com
>
>
>On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Saturday, October 20, 2001 at 8:32 pm
Posted by Pdog
(4 messages posted)
On Tuesday, October 16, 2001 at 8:11 am, Chris Caldwell wrote:
>I have a 2000 machine the gives me the error "cannot import c:\winnt\sp.dll Not
>all data was successfully written to the registry.
I have the same error on startup and as soon as the desktop appears
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Sunday, October 21, 2001 at 2:54 pm
Posted by Bob Struthers
(1 messages posted)
SP.DLL is loaded into the windows directory by a trojen. It changes the resistry
settings to point Internet Explorer to www.jethomepage.com/ie for searching. It
also enables some popups. SP.DLL is not a real library file, it ia text file that
modifies the registry.
Bob
On Tuesday, October 16, 2001 at 8:11 am, Chris Caldwell wrote:
>I have a 2000 machine the gives me the error "cannot import c:\winnt\sp.dll Not
>all data was successfully written to the registry. Some keys are open by the system
>or other processes." The copy of sp.dll that I found on that machine refers to
registry
>entries that point to a web page called www.jethomepage.com
>
>
>On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Monday, October 22, 2001 at 2:04 am
Posted by Marcus
(1 messages posted)
I noticed sp.dll on my machine last night and also had a file called c:\ht.hta running
in the background twice which didn't show up in Windows Explorer. On checking the
registry, there was an entry under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
which read something like "regedit -s c:\windows\sp.dll" so I deleted it. On reboot,
the ht.hta files did not reappear and I also deleted sp.dll without any problems
or error messages. I'm not sure if ht.hta was from this as well but will be keeping
an eye on it for the next few days as this is also obviously virus related although
my Anti-Virus software is normally on the ball but obviously doesn't detect this
yet.
This section of the registry is always worth checking every so often as most viruses
these days launch themselves through it. But be careful as this is also where Windows
launches a lot of TSRs itself.
On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Monday, October 22, 2001 at 12:57 pm
Posted by Terence Mills
(4 messages posted)
Is this a Trojan virus? I found that the Administrator account boots without the
message
coming up and
The registry now has an auto run line in: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run for: sp SZ regedit -s C:\WINNT\sp.dll
I renamed the DLL and now it complains about not finding the file, of course!
Thinking about deleting it (no harm, no foul)
Win98 has a similar Reg Key as this is where all auto start programs reside (usually
Systray stuff starts here, I've found)
What's Jethomepage all about? Is is a new marketing virus to get us all
onto their site?
Terence
On Sunday, October 21, 2001 at 2:54 pm, Bob Struthers wrote:
>SP.DLL is loaded into the windows directory by a trojen. It changes the resistry
>settings to point Internet Explorer to www.jethomepage.com/ie for searching. It
>also enables some popups. SP.DLL is not a real library file, it ia text file that
>modifies the registry.
>
>Bob
>
>
>On Tuesday, October 16, 2001 at 8:11 am, Chris Caldwell wrote:
>I have a 2000 machine the gives me the error "cannot import c:\winnt\sp.dll Not
>all data was successfully written to the registry. Some keys are open by the system
>or other processes." The copy of sp.dll that I found on that machine refers to
>registry
>entries that point to a web page called www.jethomepage.com
>
>
>On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Monday, October 22, 2001 at 1:38 pm
Posted by Terence Mills
(4 messages posted)
Found out that this may be a Virus per Symantec URL below. Dated Aug 22,2001 ITs
called the JS.Seeker.B
http://www.symantec.com/avcenter/venc/data/js.seeker.b.html
Terence
On Sunday, October 21, 2001 at 2:54 pm, Bob Struthers wrote:
>SP.DLL is loaded into the windows directory by a trojen. It changes the resistry
>settings to point Internet Explorer to www.jethomepage.com/ie for searching. It
>also enables some popups. SP.DLL is not a real library file, it ia text file that
>modifies the registry.
>
>Bob
>
>
>On Tuesday, October 16, 2001 at 8:11 am, Chris Caldwell wrote:
>I have a 2000 machine the gives me the error "cannot import c:\winnt\sp.dll Not
>all data was successfully written to the registry. Some keys are open by the system
>or other processes." The copy of sp.dll that I found on that machine refers to
>registry
>entries that point to a web page called www.jethomepage.com
>
>
>On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Monday, October 22, 2001 at 1:41 pm
Posted by Terence Mills
(4 messages posted)
Found out that this may be a Virus per Symantec URL below. Dated Aug 22,2001 ITs
called the JS.Seeker.B
http://www.symantec.com/avcenter/venc/data/js.seeker.b.html
Terence
On Tuesday, October 16, 2001 at 8:11 am, Chris Caldwell wrote:
>I have a 2000 machine the gives me the error "cannot import c:\winnt\sp.dll Not
>all data was successfully written to the registry. Some keys are open by the system
>or other processes." The copy of sp.dll that I found on that machine refers to
registry
>entries that point to a web page called www.jethomepage.com
>
>
>On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Tuesday, October 23, 2001 at 7:41 am
Posted by BDIVINE
(6 messages posted)
On Monday, October 22, 2001 at 1:41 pm, Terence Mills wrote:
>Found out that this may be a Virus per Symantec URL below. Dated Aug 22,2001 ITs
>called the JS.Seeker.B
>http://www.symantec.com/avcenter/venc/data/js.seeker.b.html
>Terence
>
>
>On Tuesday, October 16, 2001 at 8:11 am, Chris Caldwell wrote:
>I have a 2000 machine the gives me the error "cannot import c:\winnt\sp.dll Not
>all data was successfully written to the registry. Some keys are open by the system
>or other processes." The copy of sp.dll that I found on that machine refers to
>registry
>entries that point to a web page called www.jethomepage.com
>
>
>On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
IT does seem to be a virus. IF you go to the regestry under the RunOnce key you will
find regedit -s c:\winnt\sp.dll that is where it is loading from. you can remove
it from this location.
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Thursday, October 25, 2001 at 6:02 pm
Posted by sepp maier
(1 messages posted)
On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
I got infected with sp.dll today. I think I picked it up searching at astalavista.com.
I opened sp.dll with the notepad and found the following regedit:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer]
"SearchURL"="http://www.jethomepage.com/ie/"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.jethomepage.com/ie/"
"Search Page"="http://www.jethomepage.com/ie/"
"Search Bar"="http://www.jethomepage.com/ie/"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.jethomepage.com/ie/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.jethomepage.com/ie/"
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer]
"SearchURL"="http://www.jethomepage.com/ie/"
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.jethomepage.com/ie/"
"Default_Search_URL"="http://www.jethomepage.com/ie/"
"Search Bar"="http://www.jethomepage.com/ie/"
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.jethomepage.com/ie/"
I deleted them all and of course the sp.dll file.
In msconfig sp.dll is mentioned in autostart, I unhooked
this as well.
No trouble since then, one more reason for using netscape I guess.
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Thursday, October 25, 2001 at 8:42 pm
Posted by Fast Jeff
(1 messages posted)
When I opened sp.dll in notetab, it shoed a bunch of links.
I'll copy and paste them.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer]
"SearchURL"="http://www.jethomepage.com/ie/"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.jethomepage.com/ie/"
"Search Page"="http://www.jethomepage.com/ie/"
"Search Bar"="http://www.jethomepage.com/ie/"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.jethomepage.com/ie/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.jethomepage.com/ie/"
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer]
"SearchURL"="http://www.jethomepage.com/ie/"
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.jethomepage.com/ie/"
"Default_Search_URL"="http://www.jethomepage.com/ie/"
"Search Bar"="http://www.jethomepage.com/ie/"
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.jethomepage.com/ie/"
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Monday, November 12, 2001 at 11:08 am
Posted by Kevin Walters
(2 messages posted)
Unfortunately, I deleted the file SP.dll. This does not cause the error to go away.
I can't find a copy of the file to replace it and I have tried adding a blank text
file with that name, but nothing works. Anyone want to donate a copy of the file
or have any ideas?
On Tuesday, October 16, 2001 at 8:11 am, Chris Caldwell wrote:
>I have a 2000 machine the gives me the error "cannot import c:\winnt\sp.dll Not
>all data was successfully written to the registry. Some keys are open by the system
>or other processes." The copy of sp.dll that I found on that machine refers to
registry
>entries that point to a web page called www.jethomepage.com
>
>
>On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Monday, November 19, 2001 at 8:51 pm
Posted by hesterloli
(2 messages posted)
Yes I first noticed ht.hta in the C drive. Since I know I don't put hta files in
the C drive I removed it. This is what it says. It is just an ASCI file you know:
Now I noticed that my homepage was changed before all this. The http's in this looks
like it was one of them. The sp.dll I noticed when I just happend to look in HKLM\Software\Microsoft\Windows\CurrentVersion\Run.
It is not a valid 32-bit dll as can be checked using Depends. It has no signature.
I think I will look at in QuickView later.
I hope this is the extant of it. And it just goes to show you AV sux.
hesterloli
On Sunday, August 26, 2001 at 4:24 pm, Rowan wrote:
>Does anyone know what sp.dll and user.ini are used for?
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Sunday, June 2, 2002 at 6:39 am
Posted by Leandros Komninos
(1 messages posted)
I have managed to do the same as you, have you got a copy of sp.dll, as it would
be apperciated.
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Wednesday, June 19, 2002 at 9:30 pm
Posted by Kevin Walters
(2 messages posted)
Sorry, everyone, once I found the fix, I should have posted it here... the answer
is very simple, just open a text file type in "REGEDIT4" at
the top and hit enter to add a new line and save it in your windows directory with
the name "sp.dll".
On Monday, November 12, 2001 at 11:08 am, Kevin Walters wrote:
>Unfortunately, I deleted the file SP.dll. This does not cause the error to go away.
>I can't find a copy of the file to replace it and I have tried adding a blank text
>file with that name, but nothing works. Anyone want to donate a copy of the file
>or have any ideas?
>
[Reply or follow-up to this message]
|
re: sp.dll and user.ini
Thursday, June 20, 2002 at 7:15 pm
Posted by b.
(1 messages posted)
my antivirus just detected the JS.Exception.Exploit, which is a trojan that also
redirects your browser to jethomepage.com. after cleaning the trojan and editing
the registry, i rebooted and the registry was again changed. looking in C: i found
the ht.hta file. i've just deleted it and also edited the registry again removing
entries for these two files. i found info about this at http://www.geocities.com/newordersau/
no known antivirus solution i've checked has info about this files! i didn't reboot
yet, i just hope i don't have any problems, just in case i've made a false sp.dll
file the way you posted, many thanks.
On Wednesday, June 19, 2002 at 9:30 pm, Kevin Walters wrote:
>Sorry, everyone, once I found the fix, I should have posted it here... the answer
>is very simple, just open a text file type in "REGEDIT4" at
>the top and hit enter to add a new line and save it in your windows directory with
>the name "sp.dll".
>
>
[Reply or follow-up to this message]
| |
| |
Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread
| |
Return to the Windows 98 Discussion Forum
|
|
|
|
