Dialer wont go away

Point value changed by question poster.

run both programs and your antivirus program in
safe mode.

check in the following registry if you see something that you don'r recognize and delete those keys

start , run , regedit
and the location of the key is

hkey\local machine\sofware

and for programs that startup whith windows.

hkey_local machine\software\microsoft\windows\current version\run (run once, and runonce_ex)

if you see the .exe at the right hand panel, look them up in windows explorer and delete the program or whole folder altogether.

then use spyblaster (http://www.javacoolsoftware.com/products.html) to protect you from getting infected again.

you can check an alternative browser like mozilla firefox

Success

Leopold

This is a variant of Cool Web Search.
It is possible that it was removed by Adware or Spybot but is coming back. I would run AdAware, and Spybot (update defs of course) and with Spybot make sure to Imunize and turn on the Tea-Timer feature. It will let you know when the reinfection is attempted.

Then delete this registry key:

HKEY_CURRENT_USER\software\websiteviewer

That should do it but as long as you are in "scan" mode you should check for everything else. Run CWShredder and HiJackThis.

(http://www.spywareinfo.com/~merijn/downloads.html)

I would not delete anything in HiJackThis unless you are really comfortable with it. It will list real windows setting that may OR MAY NOT have been hijacked. Just post the log.

Norton (Symantec) will also clean it, but you still have to remove the registry entry:

http://securityresponse.symantec.com/avcenter/venc/data/dialer.wsv.html

Good Luck,

razz

I'm fighting the same piece of s*** on a customer's PC. Contibuting to the problem are that something (perhaps CWS) is running IE continuouly in normal mode and I haven't been able to stop it using all the usual methods (msconfig, registry edits). So normal mode is useless. Safe mode is stable, but it's Win Me, so limited to floppy disk access for installation.

Have managed to install Ad-Aware SE and Spybot. Ad-Aware finds the files but locks up while deleting. Spybot is returning errors and hasn't been of much use.

CWShredder has been no help. Am using latest version.

If I find something that works, I'll add a comment. Would also like to know how you fare.

Dalton

Try going to the following site: http://www.mvps.org/winhelp2002/hosts.htm
Add the file into your Hosts file to try and get the stuff where it wont pop up or communicate outside. This might give you a chance to remove it then.

i had a stinker similar few months ago. it was my first exposure to these re-infecting malwares. why they are not called viruii is beyond me. anyhow. these guys are making a good point but let me emphasis it: part of the way it re-infects is little installer stub is left behind due to maybe spyware remover software is blocked or too ignorant to deleting it fully. stub left behind activates on reboot and goes to internet to get rest of malware and bam you got it again. so maybe you are staying connected to internet during the removal process or maybe you are not getting all the stubs out due to not having restore mode off or not having all profiles scanned, like that. or having another hd you are not scanning or something.
get a product like, gulp, i can't believe i am saying this: norton internet security and get it installed and fully updated. then unplug from internet and after it completes it's scans after couple reboots, see, in safe mode like they are telling you, see, and with system restore off. this is gonna take a while to do right as you know. then go back up on internet with shields up see the show. you will now get popups from norton internet security telling you somebdoy moving traffic. you can now move in to kill.
i would google 'mid-addle' and there is a guy with really good explanation who got po'd enuf to sniff out all the stubs. i think i found him by googling url of the website i was being hijaacked to (from fully patched box with maybe foxfire and firewall, see?) he has modest paypal presentation and i would pay him and email him see if he can help you sniff it out. you can feed him the data from the firewall maybe....

I can't tell you exactly how to remove the program. However, I can offer you some advice on how to limit the damage. The first thing I would do is go into your Firewall Program and enter the "program control" and see if you can locate the program there. In most cases you can. You want to go ahead and "X" out all "access" and "server" rights. This will generally slow or prevent the program from dialing out.

Although Spybot and Ad-aware may have not deleted the program, you should not merely count on these two programs for spyware removal. As a general rule Ad-aware will only remove and clean spyware and won't block or prevent the spyware from coming back to your computer. For this reason Ad-aware has limited value. Spybot is a little better, but it is insufficient on its own to fully block spyware.

I would recommend that you download the Free edition of PC Doctor. Although the free edition won't clean anything, in most cases it will give you the registry values that you can manually copy. After copying the registry values go into your registry and then manually delete them. I have used PC Doctor is this fashion successfully to remove spyware that no other program would get rid of. Also, two very good programs that you should immediately add to your computer are "spyware blaster" and "spyware guard". Both of these programs are blockers and can be downloaded from http://www.snapfiles.com/. Last week I heard that Microsoft has come out with a free spyware removal program that works quite well. I haven't tried it yet, but would appreciate you sending me a link to it if you are able to find it on here.

This should give you some tools to fix the problem. What firewall are you running? Having a good firewall to block outside calling is important.

Randal

Since we're dealing with a cool web variant, there is an stand-alone application for it. It is names CWShredder, and was designed by Merijn. Its about 300-400k in file size, and it, in my opinion, is the best for any cool web ir variant of it. Merijn's webpage: merijn.org

This question was closed by the author