Mystery dialer

[Richard]

I have a customer with Windows ME. Upon startup the Internet Dialer comes
up. You can cancel it, and it appears to go away. Then you see the light
on that line come on and soon the two little PC icons come sailing down from
the upper left of the screen to the "system tray" indicating that the
computer is connected to the ISP server. However, you can't browse or get
your email. Disconnect that connection and run the regular dialer and you
can get email and surf.

I have run Ad-aware, cleaned off 86 malware and spyware, run Spy-bot, found
no problems.
Check the background programs for auto update command, found none.
Check the "Scheduled tasks", found none.
Remove Norton 2003 antivirus (I was reporting errors and would not start),
including all Symantec files and registry entries.
Installed AVG, ran the scan and found no viruses.
Removed and reinstalled TCP/IP, no change
Removed and reinstalled the dialup connection, no change

Still this Mystery Dialer continues to periodically connect, but no web site
comes up, (the flying PC icons is an interesting touch)

I will be check the system in the safemode on 3/24/04, but could use any
guidance you might have.

Info: Computer is a Dell 833 MHz with 128 Meg Ram
OS is Windows ME from the factory. I have updated the computer to
IE and OE 6 with SP1
Temp Internet files and cookies have been cleared.
C:\windows\temp folder has be cleared.
Internet connection is via modem. Computer is networked to an
older PC in the back room
Internet Connection Sharing is used, but the second computer is
normally off.
When the 2nd PC is on, it does not have this Mystery Dialer
Problem. It uses Windows 98

 

[H Leboeuf]

See what the experts have to offer.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html

 

[Richard]

Thanks Henry, but the problem turned out to be a porno dialer virus that
Norton could not catch.
After I installed the AVG FREE it immediately found a "Dialer123" virus and
eliminated it. Problems solved. No more mystery dialing and shutdown
problems eliminated. Don't know why Norton 2003 and Ad-aware, both with
updates, could not find this virus, when AVG did.

See what the experts have to offer.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html

I have a customer with Windows ME. Upon startup the Internet Dialer comes
up. You can cancel it, and it appears to go away. Then you see the light
on that line come on and soon the two little PC icons come sailing down from
the upper left of the screen to the "system tray" indicating that the
computer is connected to the ISP server. However, you can't browse or get
your email. Disconnect that connection and run the regular dialer and you
can get email and surf.

I have run Ad-aware, cleaned off 86 malware and spyware, run Spy-bot, found
no problems.
Check the background programs for auto update command, found none.
Check the "Scheduled tasks", found none.
Remove Norton 2003 antivirus (I was reporting errors and would not start),
including all Symantec files and registry entries.
Installed AVG, ran the scan and found no viruses.
Removed and reinstalled TCP/IP, no change
Removed and reinstalled the dialup connection, no change

Still this Mystery Dialer continues to periodically connect, but no web site
comes up, (the flying PC icons is an interesting touch)

I will be check the system in the safemode on 3/24/04, but could use any
guidance you might have.

Info: Computer is a Dell 833 MHz with 128 Meg Ram
OS is Windows ME from the factory. I have updated the computer to
IE and OE 6 with SP1
Temp Internet files and cookies have been cleared.
C:\windows\temp folder has be cleared.
Internet connection is via modem. Computer is networked to an
older PC in the back room
Internet Connection Sharing is used, but the second computer is
normally off.
When the 2nd PC is on, it does not have this Mystery Dialer
Problem. It uses Windows 98