Trojan Horse Dialer

[l5foye]

I recently discovered I have a Trojan Horse Dialer. While it is removed with AVG, it keeps returning which I suppose is the nature of the beast. Trying to trace it, I found it is in C:_RESTORE\TEMP along with a staggering 2000 odd files. When I went to delete these, I got a message 'Access denied;source file may be is use'.
How can I remove the trojan horse dialer for good and how can I delete the 2000 odd files in Restore\Temp?
All advice would be greatly appreciated though I should warn that I am a bit of an IT dummy. Thanking you.

 

[SEM]

I remember correctly you have to Stop the Restore procedure. Reboot, run avg, Reboot again, Start restore procedure.

Edit: Found this
http://www.windowsbbs.com/showthread.php?t=26192

 

[fuzzer]

safe mode can be handy at times like those

 

[Flash]

Its normally from visiting the "adult" sites that the Trojan Diallers are picked up from...

Excellent advise given above that should fix the problem.

Invest in some decent anti virus software such as Norton 2006 (it is really good). I used to have the free version of AVG Anti Virus BUT it failed to protect my PC from an attack of spy ware and I ended up having to re-build my entire PC and had tried everything to fix the problem before hand and excellent advise was given by our Forum.

 

[IanA2]

Its normally from visiting the "adult" sites that the Trojan Diallers are picked up from...

Excellent advise given above that should fix the problem.

Invest in some decent anti virus software such as Norton 2006 (it is really good). I used to have the free version of AVG Anti Virus BUT it failed to protect my PC from an attack of spy ware and I ended up having to re-build my entire PC and had tried everything to fix the problem before hand and excellent advise was given by our Forum.

Was that AVG Pro??

 

[Flash]

Was that AVG Pro??

To be honest I cannot remember the exact version - it was the latest home edition and was free and always kept up to date.

 

[masqueraid]

AVG is antivirus, the dialer is malware. They are very different and need different tools to detect/remove.

AVG for free protection from viruses, something like Spybot S&D or Adaware SE for free Malware detection and removal

 

[l5foye]

Thank you all for the advice. My troubles persist unfortunately. I'm on Windows ME and use Norton (which is up to date) and AVG. I cannot find a means of disabling Restore (wizard gives me 3 choices- cancel last restore, use a new one or go to an earlier one) . I was not trying Restore when trojan dialer came to light. Any ideas on how to delete files in C:_RESTORE\TEMP when I am denied access?
I have tried a no of internet sites and according to AVG, Ebay seems the worst offender for me getting malware.

 

[MartAD]

Difficult to know where the original trojan lay, but the easiest option is to boot in MSDOS and erase the entire _RESTORE folder. It (the folder) will regenerate itself after re-booting Windows.

Or

'CD' in MSDOS to _RESTORE/Temp and erase all via wildcard *.*.

You leave it and I can almost guarantee your 2,000 will be 20,000 then 50,000 in no time.

 

[PJH]

... I'm on Windows ME and use Norton (which is up to date) and AVG. I cannot find a means of disabling Restore .....

To disable System Restore on Winows ME Start>Run>msconfig click Startup tab and uncheck the entry for *StateMgr click Apply and OK
It will then prompt you to reboot.

Do the opposite to re-enable.

 

[l5foye]

Thank you for the advice. I liked the idea of using MSDOS and erasing the contents of RESTORE\TEMP. However ( and I feel a real dummy) after reading Microsoft Help, I did what it said to open MSDOS but all I got was a small black window which would not allow me to do anything. I tried putting MSDOS into Run but it said it did not recognise it .

 

[jimti]

Thank you for the advice. I liked the idea of using MSDOS and erasing the contents of RESTORE\TEMP. However ( and I feel a real dummy) after reading Microsoft Help, I did what it said to open MSDOS but all I got was a small black window which would not allow me to do anything. I tried putting MSDOS into Run but it said it did not recognise it .

you need to put msconfig into run (start button then run button) then click Startup tab and uncheck the entry for *StateMgr click Apply and OK as stated by PJH

 

[Ian B Walker]

Spyware Doctor will remove it once you have booted in safe mode.

 

[IanA2]

Are trojan dialers a problem if you are on broadband?

 

[blassberg]

i believe not but beware if you have a dial-up cable connected for back-up

 

[masqueraid]

i believe not but beware if you have a dial-up cable connected for back-up

Technically correct but if you have a dialler you should seriously consider that that's not the only problem that's arrived and update your security (as well as removing the trojan from both the live part of the PC and the system restore cache as described above).