HELP - can't remove dialer program!

[Mike]

Computer (got Windows XP) is infested with dialer programs "Dialer.Tibs" and "Dialer.WSV". These have been detected by both Norton AntiVirus and Spybot and neither program was unable to delete them. On a second try Spybot indicated that it had fixed the problem, but it was still there. Among other things, this thing has taken over my home page on Internet Explorer and puts up a bar of links on top of the page. Also went to Norton website and tried their solution in Safe Start mode but that disables the internet connection so cannot run the antivirus program then. My question is: what are my alternatives for getting rid of this stuff? Do I need to clear my hard drive and then restore with recovery cds. Will that even work? Any ideas will be greatly appreciated.

Thanks,
Mike

 

[guitarian]

a lot of the time these can be removed simply be running your spyware program (such as adaware, spybot or spysweeper) in safe mode. so restart, press f8 during the boot sequence (it can be a bit tricky) highlight and select the safe mode option.

in safe mode a lot of these programs aren't running and propigated allowing you to remove them easily. also ask google for a program called 'hijack this'. visit the website and read up about what it does. it's great for getting rid of browser hijacks mainly but may help in your case.

 

[Lorand]

In safe mode have you tried to delete C:\Program Files\PayPerViewDialDialer\HOTANDWET.EXE, the shortcut to it at the Startup folder and the registry key HKEY_LOCAL_MACHINE\Software\WebSiteViewer?

 

[Praetor]

Do I need to clear my hard drive and then restore with recovery cds

You dont have to but you're probably better off doing so (of course it depends on the throughness of your recovery cds ... most dont let you do anything useful ... ok im ranting......)

 

[Mike]

Thanks for the response so far, folks. I tried Guitarian's suggestion of running Spybot in Safe Mode with no luck. When I ran Spybot in regular mode it had picked up the TIBS and then indicated that it had fixed the problem. Now it doesn't even show it. Same with using the Norton Antivirus. I'll move on to "Hijack This."

Lorand, if I can figure out exactly how to do it, I'm going to try your suggestion next. I may have to ask you for more details if I get stuck.

And Praetor, I hope I don't have to get to that point but if I do, is that a sure cure for getting rid of this kind of thing?

Thanks again for all your help.

Mike

 

[Praetor]

And Praetor, I hope I don't have to get to that point but if I do, is that a sure cure for getting rid of this kind of thing?

Nothing is "sure" but its as sure as it gets

 

[Mike]

Well, I finally broke down and did a full system recovery which was a pain in the rear but worth it if everything stays cool.

Lorand, I did go to the safe mode and, although I didn't find the file you indicated under program files, I did find two files under Windows that I knew were part of the problem. I deleted them and thought everthing was OK. Changed back to my homepage and the next few startups it stayed there. Unfortunately, it all came back a short time later. I was so pissed I didn't want to screw with it anymore. If I'd had the patience and wasn't worried about things getting even worse I would have tried your suggestion of "Hijack This." I've seen where this has worked for others.

I know it's impossible to enforce but I still can't believe how these a..holes are allowed to get away with this kind of thing. One of the first programs I loaded after system recovery was Spybot. I'd only been two a few sites and already it found FIVE pieces of ad/spyware on my machine!

Anyway, thanks for everyone's suggestions. I only hope this is the end of it...for now.

Mike

 

[Lorand]

Not all entries found by Spybot are malwares. Usually they are just tracking cookies which won't harm your system. The only problem with these cookies is that they are dropped on computer without the user's consent.