Dialer won't delete - help?

[Guy]

I've got a dialer that has installed itself on my computer that I can't get rid of.

Norton anti-virus can identify it - prvdi.exe, is the system file, Dialer.WSV the threat - but can't delete or quarantine it.

I've tried to delete it manually, but always get an error message 'Access denied - make sure the disk is not full or write protected and that the file is not in use'

Under Add Remove programs I can't find it - neither can I find it in the Registry.

Can anyone help?

 

[Alfie]

download all the latest patches from Microsoft.

You then need to install ad-aware se and run it with the latest pattern file.
Ditto spybot.

Then try the McAffe stinger. Its a free download

This process gets rid of most things I've found!

Good luck

 

[Guy]

Thanks Alfie, will give it a try

 

[Shude]

I managed to remove something like that from a customer's computer using knoppix, but you could equally do it using a windows 98 boot disc or something as long as you know where the files are.

I had a search online and it looks like a popular one!

 

[Mozzer]

I recently used Microsoft's beta spyware software and its cleaned an old PC of mine up a treat, deleted loads of things that I couldn't and is now guarding it at all times - really impressed.

http://www.microsoft.com/athome/security/spyware/software/default.mspx

 

[Mambo]

I recently used Microsoft's beta spyware software and its cleaned an old PC of mine up a treat, deleted loads of things that I couldn't and is now guarding it at all times - really impressed.

http://www.microsoft.com/athome/security/spyware/software/default.mspx

Yeah it cleaned up my machine nicely to

 

[pammy]

I find the combo of Adaware -se, Spybot Search and Destroy and Microsoft's Anti spyware do the trick nicely as they all seem to miss things the others ones get.

Good luck getting shut of this though - evil little thing that it is.

Are you on dial up? It's one beauty of cable broadband through the set top box

 

[Sp!ke]

tried deleting it in a DOS box?

 

[Guy]

Thanks to all for the help and support.

Still got it, unfortunately - all efforts to remove it appear to be successful, until I restart the computer, only to discover it is still there.

It installed itself last night - I had asked the PC to shut down, but didn't wait to watch and went to bed - this morning it was on a blank page something like TIBS downloader. Thought nothing much of it, but the computer was running slow - a restart resulted in invitations to go Adult surfing and more - nice SEX icon on the desktop - so far spent 3 - 4 hours trying to get rid...

Pammy - am on BT Broadband, never had this problem before...

Mozzer, thanks, the Microsoft spyware finds it, tells me it's deleted, but it's still there...

tried deleting it in a DOS box?

Spike, I can work OK on a computer when it's working, but basically have no idea about DOS, registry etc.
I have gathered from a bit of research that this thing disguises itself in a variety of guises and locations.

Thanks again to all, will keep trying and will let you know [one day soon I hope] how I get on.

 

[glojo]

Hi Guy,
Are you running WindowsXP?

If yes try:

click on 'Start' (bottom left)
Click on 'Run'
In the box that says open, type...
msconfig
click 'ok'
click on the top right hand tab 'Startup'
Check all this list for the auto dialer

The first line shows an abbreviated name. If needed drag open the second line to read where the file is.

If you find it. Untick it

This location shows all the programs that open are run on startup, I will cross my fingers for you, because going into the Registry is not the best of ideas unless you know what your doing.

Good luck,
John

 

[Steve_Perry]

You'll also probably find that the dialer is split into two separate files... One is the dialler itself, that you seem to be able to find and erradicate, the other will be something like a status check program that is run and re clones the dialler when it detects attempts at removal.

Totally agree with glojo's comments above, check what your system is running at start-up via the method John describes, and you can easily uncheckbox anything you think of as suspicious. Again, I echo John's comments about manual pruning of the system registry, be careful in there and back-up before changes just to be safe.

Good luck Guy.

*EDIT* The following sites maybe of help
http://castlecops.com/postt102259.html
http://labs.paretologic.com/spyware.aspx?remove=TIB Browser
S.

 

[rees_A]

Try using deep scan mode in MS anti spywhere if you haven't already tried...By default it only does a quick scan which doesn't remove everything from registry etc.

Alan

 

[Guy]

Again, thanks to everyone - John, tried your msconfig route, which appeared to work until restart....

Went for a short walk, had an idea - tried system restore, restored the machine to its status 24 hours ago - have run the MS anti-spyware and it seems to be gone. :bannana: :bannana:

No doubt I will post again in an hour when the bloody thing comes back!

Thanks again to everyone - your help is just another example of what makes this the best forum ever

Have a good Easter, each and every one of you

 

[glojo]

Well done,
The nitty gritty question though is how did it get there in the first place?

These diallers are crafty critta's and sometimes look like an official authorization request or a 'Trust this site'.

Plus they are located at some adult or Mp3 sites.

Good luck and hopefully we will not see the dialler again.
John

 

[Guy]

Well done,

The nitty gritty question though is how did it get there in the first place?

Plus they are located at some adult or Mp3 sites.

John

I'll go for mp3 if that's OK

Actually I suspect it was connected to an upgrade of MusicMatch Jukebox, [alternative culprit being the Department for Constitutional Affairs - I ruled that out] which popped up when I opened the program to listen to some music.

The sad fact is that at my age those adult sites are bad for the blood pressure not to mention the time spent 'cleaning up' the computer afterwards - even worse for the blood pressure!

 

[pluggers]

Just thinking that if it did come back again a possible way to do it would be to start your machine in "safe mode" so the dialer program wont load up and then delete it.It has worked for me in the past.

 

[Sp!ke]

I wouldnt hold your hopes up too high... Firstly, you need to switch off system restore before you clean anything (because the PC will keep a copy of the virus in the restore point.

This sounds more of a virus type thing than spyware... I'd go to www.antivirus.com and go to personal and do a free online scan.... but first, turn off system restore.

 

[SEM]

Couple of others to try Bazooka (free spyware killer) last resort "hijack this" scans your system for known pains and probs.. post this on the hijack sites someone usually finds the same problem/s and tell you what to manually remove.

http://www.download.com/Bazooka-Adware-and-Spyware-Scanner/3640-8022_4-10247783.html?pn=2&sb=0&v=0
http://www.tomcoyote.org/hjt/

SEM

 

[Guy]

I wouldnt hold your hopes up too high... Firstly, you need to switch off system restore before you clean anything (because the PC will keep a copy of the virus in the restore point.

This sounds more of a virus type thing than spyware... I'd go to www.antivirus.com and go to personal and do a free online scan.... but first, turn off system restore.

Spike, you were absolutely right and your advice was perfect

Thanks very much - first scan found them hiding, second - clean :bannana: and I even remembered to turn System restore back on

Feeling a great sense of achievement after a completely wasted afternoon and evening - couldn't have done it without all the help.

Thanks once again to everybody