Clever crackers on my PC

[Penster]

I have picked up a program called Clever Crackers on my PC. I immediately
shut the internet connection down because it was referring to use of a
premium rate number. I have tried Add-remove programs, but it is not on the
list.
It looks like a program which will dial up premium rate numbers. How do I
get rid of it?
Mick

 

[Beauregard T. Shagnasty]

Quoth the raven named Penster:

I have picked up a program called Clever Crackers on my PC. I
immediately shut the internet connection down because it was
referring to use of a premium rate number. I have tried Add-remove
programs, but it is not on the list. It looks like a program which
will dial up premium rate numbers. How do I get rid of it? Mick

Spybot S&D catches many/most of the rogue dialers.
http://www.safer-networking.org/

http://home.rochester.rr.com/bshagnasty/tips.html#spyware

 

[Penster]

I ran a search at Spybot and they don't know it. I ran Spybot on my machine
and it didn't pick it up!! What next?
Mick

 

[Tweek]

You should always run Spybot back-to-back with Ad-Aware:

http://www.lavasoftusa.com

Also, make sure of two things:

Make sure both Spyboy and Ad-Aware are using the most current files (use the
"look for updates" button)

Always run scans in safe mode. This means you'll have to run each spybot
program once to make sure they're updated, then reboot into safe mode before
scanning.

Good luck with this ever-worsening spyware problem.

: I ran a search at Spybot and they don't know it. I ran Spybot on my
machine
: and it didn't pick it up!! What next?
: Mick
: : > Quoth the raven named Penster:
: >
: > > I have picked up a program called Clever Crackers on my PC. I
: > > immediately shut the internet connection down because it was
: > > referring to use of a premium rate number. I have tried Add-remove
: > > programs, but it is not on the list. It looks like a program which
: > > will dial up premium rate numbers. How do I get rid of it? Mick
: >
: > Spybot S&D catches many/most of the rogue dialers.
: > http://www.safer-networking.org/
: >
: > http://home.rochester.rr.com/bshagnasty/tips.html#spyware
: >
: > --
: > -bts
: > -This space intentionally left blank.
:
:

 

[Ceily]

Pestpatrol seems to pick up what others don't. Doesn't hurt to try.
http://www.pestscan.com/

Ceily

I ran a search at Spybot and they don't know it. I ran Spybot on my machine
and it didn't pick it up!! What next?
Mick

 

[null]

I have picked up a program called Clever Crackers on my PC. I immediately
shut the internet connection down because it was referring to use of a
premium rate number. I have tried Add-remove programs, but it is not on the
list.
It looks like a program which will dial up premium rate numbers. How do I
get rid of it?

You may be able to defeat it by disabling Windows Scripting Host
(WSH). Try Symantec's NOSCRIPT which allows you to toggle WSH off and
back on:

http://www.symantec.com/avcenter/venc/data/win.script.hosting.html


Art
http://www.epix.net/~artnpeg

 

[Penster]

I have downloaded Ad-adware updated the files on it and Spybot, run them
both in safe mode and....nothing. It is still there. Where next?
Mick

 

[null]

I have downloaded Ad-adware updated the files on it and Spybot, run them
both in safe mode and....nothing. It is still there. Where next?

To your registry and startup axis. To the use of TrojanFinder (see my
web site). To looking for unusual running processes and registry run
entries.


Art
http://www.epix.net/~artnpeg

 

[Penster]

Art
I regret I am getting out of my depth here. I am at the 'Run Ad-adware in
safe mode' level but don't know much beyond that. The offending program is
not hidden from me, it is listed in my programs in the start menu but I
can't delete it because it is not listed in the add-remove programs menu.
What do I do to get rid of it? I am sure that the suggestions you make are
correct but they are probably too complex for me to carry out. Would I be
better deleting and reloading my hard drive or is that too drastic?
Mick

 

[Penster]

Thanks. I have done that, but the program is still there. Useful advice for
the future though (i'm learning all the time).
Mick

 

[null]

Art
I regret I am getting out of my depth here. I am at the 'Run Ad-adware in
safe mode' level but don't know much beyond that. The offending program is
not hidden from me, it is listed in my programs in the start menu but I
can't delete it because it is not listed in the add-remove programs menu.
What do I do to get rid of it?

Use your PC's Find function to locate the folder it's in. Then after
booting up into Safe Mode, cut and paste the file (move it) to some
temp folder. Then reboot normally and see if there's evidence of
Trojan activity.

Upload the file for av scanning here:

http://www.kaspersky.com/remoteviruschk.html

See if KAV identifies the Trojan.

Report back here how you made out and what you find.


Art
http://www.epix.net/~artnpeg

 

[Jan Il]

Thanks. I have done that, but the program is still there. Useful advice for
the future though (i'm learning all the time).

If you don't already have a firewall, download and install the Zone Alarm
Free. It may prevent the program from sending anything back to the
Internet, which it must be doing, at least until you can find out how to get
rid of it, and you may need to go onto the Internet to do that. Just
download and install it. Very user friendly.

Zone Alarm - Free
http://tinyurl.com/iwhb

Also, try the Process Explorer..just download and install it, then click on
the icon on the desktop. It will tell you what is running on your PC and
should tell you the file name and where it's located. Worth a try ...

Precess Explorer - Free
http://www.snapfiles.com/get/processexplorer.html

HTH

Jan

 

[nondisputandum.com - honest software - famous free]

I have picked up a program called Clever Crackers on my PC. I immediately
shut the internet connection down because it was referring to use of a
premium rate number. I have tried Add-remove programs, but it is not on the
list.
It looks like a program which will dial up premium rate numbers. How do I
get rid of it?
Mick

more tools to remove & protect:
http://www.nondisputandum.com/html/anti_spyware.html
http://www.nondisputandum.com/html/system_cleaner.html
greetz