124782.exe at c: root - virus?

[steve]

I have a 124782.exe file on c:\. It reappears minutes after it is
deleted by me. It launches Mozilla, a web browser, and goes to
http://www.dialeradmin.com/.

Is it a virus or spyware or what? How to stop it running by itself?
Deleting isn't working obviously.

 

[GTX_SlotCar]

It's a beast, but you can get rid of it. Took me about a week to figure it
out.
Are you using Mozilla as your default browser?
You'll need a HijackThis log so we can look at it.
If you want to see what I went through, do a search for GTX and you'll see
the thread.

Gary

 

[David H. Lipman]

1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (personal free version)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download sysclean.com and place it in that directory.
Dowload the signature files (pattern files) by obtaining the ZIP file.
For example; lpt200.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adware with the latest definitions.
3) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
6) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
7) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) If you are using WinME or WinXP, create a new Restore point
10) Please report back your results

Dave





| I have a 124782.exe file on c:\. It reappears minutes after it is
| deleted by me. It launches Mozilla, a web browser, and goes to
| http://www.dialeradmin.com/.
|
| Is it a virus or spyware or what? How to stop it running by itself?
| Deleting isn't working obviously.

 

[GTX_SlotCar]

Dave, when I had the 124787 dialer, I ran adaware se, a2, spybot1.3(new
beta), trojanhunter, about buster, AVG and probably some I've forgotten.
They deleted the file(s), but 124787 kept coming back. I also cleared all my
temp files, disabled sys restore, recycle bin and all that stuff and tried
the programs in safe mode. Basically, everything you'd ordinarily tell
someone to do.
Sometimes the only file I could find on the drive was 124787.exe, and other
times there was also an ms-dos shortcut file named 124787.(bat?). When
124787.exe runs, you can see (if you're fast enough) a command box open and
close.
The only thing that worked was fixing some entries with hijackthis.
I'm not an expert, just persistent, and that's what worked for me. I hope
you, or someone, can find a shortcut to getting rid of this for others, but
I couldn't. A google search for 124787.exe turned up nothing.

Gary

 

[Roger Wilco]

I have a 124782.exe file on c:\. It reappears minutes after it is
deleted by me. It launches Mozilla, a web browser, and goes to
http://www.dialeradmin.com/.

Is it a virus or spyware or what? How to stop it running by itself?
Deleting isn't working obviously.

Does this description fit?

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=117729

 

[GTX_SlotCar]

Does this description fit?

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=117729

Not for mine. I didn't have any of the entries mentioned on the web site.

 

[Chris]

Run hijackthis, save your log and paste the log into your next post.

hijackthis can be downloaded from
http://www.download.com/HijackThis/3000-8022-10307556.html?tag=lst-0-1

The log will be useful for us to indentify any problems.