XP question

[Soundguy]

I'm familiar with windows nt, 9x variants, and the inbetweens lke milenium.. etc ( and previous 3.x and older variants ).. as well as pc hardware, electronics.. etc. What I'm still learning on is XP..

My aunt came up with a problem and ran it by me.. here it is:

She has found a new icon on her desktop. When activated it starts a dialer ( not internet connection) presumable to dial an adult site.. or other questionable site.. etc. She has deleted the icon, and even used an uninstall option from the properties tab from the icon.. it always comes back after reboot, so I'm guessing there is some embedded software that is reinstalling it upon reboot if it discovers the icon deleted. (add/remove programs) does not list it. She is NOT on service pak2.

Any ideas on how to remove it? Does xp have an equivalent to msdiag to view tsr's? etc?

thanks

Soundguy

 

[JayC]

I don't have WinXP but I did run across a similar problem while removing things from a friend's computer. What you need to do first is disable the system restore feature. With that enabled the dialer will always return. I'm not sure how to disable the system restore feature because I never got to do it. The computer "died" on me before I had a chance. /forums/images/graemlins/crazy.gif

Here is an article on Microsoft's Knowledge Base that may help.

How to turn on and turn off System Restore in Windows XP

Good luck.

 

[KubotaSteve]

I just ran into a similar problem with my laptop. After purchasing registry mechanic and spyferret, the problem still was not corrected. It kept changing my homepage. It had something to do with the registry and there was an executeable file in there triggering it. I couldn't find it so I just reinstalled everything over.

 

[Inspector507]

You might get lucky by doing a search on the dialer name. If you find the registry entries listed, make note of them. Go into the registry editor and disable the ones pertaining to that dialer. But BE CAREFUL messing with the registry and back it up first.

 

[MossRoad]

Have you tried Spybot Search and Destroy or any of the other free spyware killers?

 

[GRUMPA]

I would be willing to bet that there is an executable by another name in there that when you re-boot will just make a new dialer program. Heres what I would do as I got this and more for my comp. Get SPYBOT search and destroy, update it and run it in "SAFE MODE". Thats of key importance there the safe mode part. Just tell her to keep hitting the f8 key just after the BIOS pop up and using the arrow keys (UP) go to safe mode and let it get to the desktop. Run spybot and then re-boot, that should take care of it for her. I'm on my wifes comp now and just from her going to a sewing site will at times pick up something like that. Beleive me its not a unique problem with just XP but with all windows programs.

 

[DannyD]

you could also start using advant (sp) browser and get away from ms.............but dont tell them I said so

 

[GRUMPA]

You can almost get the same results by opening up your browser and going to tools,internet options,hitting the security tab,custom level,and disable the first 5 things on the list 4 of which are active x. Thats how most like to get in.

 

[sendero]

You almost certainly have contracted an "adware" type program that does something like this:
Each time you reboot it checks to see if the dialer icon still exists. If it doesn't it creates it. The process probably dies at that point so you won't see it in task manager.

As others have said, the usual spyware removal programs will *probably* get rid of it.

Once you do, I recommend Opera (if you like the ultimate /forums/images/graemlins/smile.gif) or Firefox (if you like something that looks like IE but doesn't have 500 security holes) - make them the default browser and you will get about 99% fewer of these kinds of malware intrusions.

Both are free or have free versions.

 

[rlw]

Here's another approach. Download Startup Cop. It should identify the program that is creating the "dialer" upon startup of the operating system. It will allow you to disable or delete the program.
I've used this program with success in the past.