Dialer program has taken over my computer (WXP)

[sandman45]

Several days ago, I found myself unable to use my dial up connection to the 'net. A dialer program called Desire had found its way onto my hard drive.
Desire will connect with a 900# and download pics to my computer. At another forum, someone said that I could fix the problem through the Registry rather than formatting the hard drive. How can I do this? Thanks.

That'll teach me to look at all those girly pics I guess.

[TonyKlein]

Could you post your startups, please?

Go to Start/run, and type Msinfo32, followed by OK.
Go to Software Environment/Startup Programs.
Click Edit/'Select all', and then 'copy'
Now paste the contents in your post.

Also, download <a target="_blank" href=http://patrick.kolla.de/spybotsd.html>Spybot - Search & Destroy</a>

It looks for spyware, but also targets dialers and other nasties, and it's freeware.

After installing, go to the Online tab, and search for and install all updates.

NOTE: Don't install the 1.0 program update, as that's the one you have already.

Next, go to the Settings tab &gt; File Sets, and uncheck 'System Internals' and 'Tracks' .

These aren't needed for our present purpose.

Finally, hit 'Check All', and have SpyBot remove all it finds.

[sandman45]

Here's my startups:


AdaptecDirectCD "c:\program files\adaptec\easy cd creator 5\directcd\directcd.exe" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AutoLogon All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
BuzMe c:\progra~1\ringce~1\buzme\bmui.exe All Users Common Startup
CARPService carpserv.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CMESys "c:\program files\common files\cmeii\cmesys.exe" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CPQEASYACC c:\program files\compaq\easy access button support\starteak.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
desktop desktop.ini NT AUTHORITY\SYSTEM Startup
desktop desktop.ini CPQ53253065619\Bob Ziegler Startup
desktop desktop.ini .DEFAULT Startup
desktop desktop.ini All Users Common Startup
DownloadWare "c:\program files\downloadware\dw.exe" /h All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
GStartup c:\progra~1\common~1\gmt\gmt.exe /startup All Users Common Startup
LXSUPMON c:\windows\system32\lxsupmon.exe run All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MediaLoads Installer "c:\program files\downloadware\dw.exe" /h All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Find Fast c:\progra~1\micros~3\office\findfast.exe All Users Common Startup
Microsoft Works Calendar Reminders c:\progra~1\common~1\micros~1\workss~1\wkcalrem.ex e All Users Common Startup
Microsoft Works Portfolio c:\program files\microsoft works\wkssb.exe /allusers All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Works Update Detection c:\program files\microsoft works\wkdetect.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
New.net Startup rundll32 c:\progra~1\newdot~1\newdot~1.dll,newdotnetstartup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Office Startup c:\progra~1\micros~3\office\osa.exe -b All Users Common Startup
PrinTray c:\windows\system32\spool\drivers\w32x86\2\printra y.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RealTray c:\program files\real\realplayer\realplay.exe systemboothideplayer All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Smapp c:\program files\analog devices\soundmax\smtray.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
srmclean c:\cpqs\scom\srmclean.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WCOLOREAL "c:\program files\compaq\coloreal\coloreal.exe" All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Thanks for the reply.

[TonyKlein]

Well, you do have tons of spyware, foistware, and other nasties there (New.Net, Gator, Downloadware, you name it)

Let's get rid of everything that shouldn't be there.

First, go to Tools > Internet options, and delete your temp. internet files, and your cookies.
Empty the contents of your Temp folder as well.

Go to Start/run, and type msconfig.
Uncheck EVERYTHING on the Startup tab, leaving only the following items checked:

AdaptecDirectCD
BuzMe - Internet Call waiting - (ONLY if you can't do without it; ALSO disable first to see whether it's OK)
(desktop desktop.ini NT AUTHORITY\SYSTEM Startup
desktop desktop.ini CPQ53253065619\Bob Ziegler Startup
desktop desktop.ini .DEFAULT Startup
desktop desktop.ini All Users Common Startup )

Click OK, close Msconfig, and reboot (important!)
REBOOT.


Now go to Software add/remove and remove New(dot)net application and Webhancer Agent.
You might also want to run this uninstaller: http://www.new.net/support/uninstall3_88.exe

Now download and install Refupdate Utility (http://www.jamcomputerservices.com/lavasoft/aaw.exe>Ad-Aware</a>).
This utility searches for, downloads and automatically installs the latest AAW reffile (the spyware definitions, so to speak).

Run the refupdate.exe installation file, and once installed, go to Start Menu>Programs, find the Lavasoft Refupdate entry and run it.
Click connect; it will open a connection to the internet to check and update the current signature file.

When that's completed, run Ad-Aware, have your drives and registry scanned for spyware, check all found files and reg keys, hit 'backup', then click continue, and have them all removed.

Reboot one last time.

As you don't have a virusscanner installed it's imperative to have your system scanned on line at <a target="_blank" href=http://housecall.antivirus.com/pc_housecall/>Trend Micro HouseCall</a> ASAP as well.


Good luck, Tony

[sandman45]

Thank you very much for the assistance.

[TonyKlein]

You're welcome.

Did it solve the problem?

[sandman45]

Yes it did. Thank you.

[TonyKlein]

Great! Thanks for letting us know.

[Hally]

Hi there Sandman45 I've been following your problem through this Forum & I'm keen to know if now that Tony has kindly remodelled your computers startup & rid you PC of Spyware & other Sharks, is your Computer "Faster Starting" now & does it run much <font color=blue>quicker in general now. . .</font color=blue> can you let us all know! Thanks Sandman45



<font color=purple>&gt;&gt;Hally&lt;&lt;
&lt;&lt;&lt;/images/forums/icons/smile.gif&gt;&gt;&gt;</font color=purple>

[TonyKlein]

I has to, Hally.

Everything you remove from startup, speeds the process up, as Windows won't need to find and execute the application.

Moreover, once it isn't running any more, it can't drain your System resources ('memory'), and it can't conflict with other active tasks, thus dramatically reducing the posibility of crashes, freezes, and all kinds of error messages occurring.

Cheers, Tony

[Hally]

<font color=blue>Hi Tony!</font color=blue> I'm sure thats true what you said, so with all the help you gave the guy above his computer should be running like a <font color=blue>"Scalded ***"</font color=blue> LOL


<font color=purple>&gt;&gt;Hally&lt;&lt;
&lt;&lt;&lt;/images/forums/icons/smile.gif&gt;&gt;&gt;</font color=purple>

[fire462]

Thanks Tony. I had the same problem as Sandman45 and was searching the net for a solution when I came across this great site and your answer to him. I too have got rid of the problem and learned a valuable lesson at the same time. Thanks again.

[wpearsall]

Windows 2000 SP 2.

How do u STOP a dialer downloading?

Somehow it downloaded on my dads machine, keep deling / uninstalling, and the next day, sure as hell, BACK AGAIN!

It started when he went to fortunecity.com

and since then, every page almost downloads it? It doesnt ASK if we wanna DL it, DOESNT give a security warning?

How can we at least make the security warning come up so it doesnt install?

Thanks

Wayne

[Mocha]

The discussion ended in this thread a month ago. You can check some recent posts (in fact, right below this one at the moment) for links to check out and info.

You can't really stop a dialer from installing, unless you have good security measures/settings in place. I posted a link to a site that has fix tools for various dialers.

Check here:
<a target="_blank" href=http://www.winguides.com/forums/showflat.php?Cat=&Board=brdVirus&Number=63608&page=0&view=collapsed&sb=5&part=>http://www.winguides.com/forums/showflat.php?Cat=&Board=brdVirus&Number=63608&page=0&view=collapsed&sb=5&part=</a>

Btw, if you aren't able to resolve you problem, it would be best to post a new message, rather than replying to someone elses...especially since it's not really active any longer.

[wpearsall]

OK Thanks. But i already Read through that, and it didnt seam to work ne ..... But since this was the "same subject" and it was @ the top of the list. i fealt it would have been better to post in this one then make another, where people may not know wot the hell i was on about :D

Tnx tho ...