Discussion Locked

Can't remove spyware dialer

0 helpful
13 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Dear all.

A user of our network (Windows 98) opened a spam message and his PC was infected by a dialer.

I scanned the PC with ad aware and spy bot but the problem remains. This malware wrote something to the registry and I can not get rid of it because every time the PCs boots it runs in start up.

Although in start up folder of Windows 98 I can not see something I suspect that this is a registry issue.

Any ideas where to look in the registry in order to remove this malware?

Thank you in advance.

13 replies

by walkerxp92

also if you have system restore enabled turn it off reboot run your antivirus & spyware removal... clean it up and then reboot again and turn system restore back on...

by blackcurrant

Hi

You can examine the follwing registry keys and see if they contain commands you do not recognise/associated with the dialler:

HKLM\software\microsoft\windows\currentversion\run
HKCU\software\microsoft\windows\currentversion\run

Also check the startup files autoexec.bat and config.sys.

Check the Load= and Run= lines in Win.ini

The last three can be edited with notepad.

As with all these things - you must have a secure backup of these files before you edit them in case you make an error or the machine crashes.

Good luck

by gralfus

Very often it is not enough to just run AdAware and Spybot, though they do remove a lot of problems. You need to run something like "HiJack This" in order to see all the programs that are being called by your operating system. By studying the output of Hijack This, you can see the legitimate programs and the ones that are giving you problems. There are forums that can help you interpret the output.

Also, the first poster implied that because this other program "found" lots of things that AdAware didn't find, that this other program was better. There are programs that find false positives just to show that they "find more" than other programs. So to sum up, just because it finds something doesn't mean that it really was a problem. Be careful what you delete. Hijack This doesn't automatically label something as spyware, so you do need to think about what the program does before you choose to delete it or not.

by lord ago 1

Here's a nifty trick. The thing is you have to know where to look for various spyware if your current programs can't get rid of it. This is doing it manually!! I got stuck with this several times. Worked pretty good for me!!This only works if you remember the day wherein the problem started.
First, start msconfig and uncheck whatever is listed that you should already know shouldn't be there. That will stop it from starting with windows. Do the same for anything found in Start/Programs/Start Up. Run your scanners. Note that said scannerS!! Never rely on any one virus/spyware scanner.Yeah, run both types, virus/spyware. Let them do what they can.
Next,use Start/Find files folders. Look for *.* CREATED(next tab)on that day. Set it to look in c:\windows. Just sift through those files and see which ones don't seem to be what you want. Delete the ones you dont want if you can.You also need a file viewer to see what they really are.I use WinBrowse. Do the same thing for c:\Program Files. From there search the registry for anything that you just unchecked in msconfig. Delete those. Reboot in DOS mode (or safe mode) and delete any other files that you couldn't already delete. Reboot and you should be all set.
Have Fun!!

by lord ago 1

Yeah, it's a lengthy process but it worked for me!! Keep in mind that there's only a few places that spyware can install itself. Registry, window folder and Program Files folder. These are the usual anyhow!! What would be better is to suggest some future prevention by installing blocking software. Things line MYIE2, a hosts file (OS dependant, and a firewall (if you wanna!!). With MYIE2, you can set it to block things like where the pics are coming from. Ad servers are where they come from and those things are completely loaded with spyware!!

This discussion is closed to new replies.