Instant Access Dialer

[tarun]

Instant Dialer and Instant Dialer C. are installed on my computer.
Ad-aware does not* detect them, and spybot hangs or gives me update errors after install.
Bazooka scanner gives me this (http://www.kephyr.com/spywarescanner/library/instantaccessdialer.c/index.phtml?source=app) and this (http://www.kephyr.com/spywarescanner/library/instantaccessdialer/index.phtml) which I follow (manual uninstall). Instant Access reinstalls itself (usually after 1 day).

* edit - ad-aware works in smart scan mode only and detects them but they return

[Big Booger]

turn off system restore, perhaps it's being stored there and then reinstalls itself using system restore.

[Curio]

You can download and run the updates for SpyBot manually from here http://www.spybotupdates.com/updates/files/spybotsd_includes.exe which is an exe file that installs the updates when you run it. These programs that keep re-installing themselves do so because they make changes to your system that are not obvious or they use an undetected dll or exe file to reload the software.

If you use the manual update for SpyBot and it still does not remove the Dialler please post back and I will try to help you out evn if it means infecting one of my own machines and working out the removal method. I enjoy that stuff anyway.

[tarun]

when i turned the computer on today, it just kept hanging after windows had loaded.
so i was forced to start in safe mode and use system restore. if i have trouble again ill turn off system restore. thanks.
curio - it downloads the updates and then waits for some more time before giving me a bad checksum error.

[tarun]

These weren't there before the system restore, but Mcafee would always start up.
http://img277.imageshack.us/img277/1331/reg8pi.th.jpg (http://img277.imageshack.us/my.php?image=reg8pi.jpg)
The computer starts up slower now. How come some of them say 'progra~1' and some say 'program files'?

[Curio]

Progra~1 is 8.3 format directory listing which is used by some programs for backward compatibility (with DOS presumably). I see they are all the McAfee ones which I believe is normal although I don't use McAfee.

Automatic startups are all over the place not just HKLM\software\windows\currentversion\run they are also in CurrentUser\...\..\run and DefaultUser\..\..\run for instance. To check them you really need to use something like AutoRuns.exe (http://www.sysinternals.com/Files/Autoruns.zip) from Sysinternals which will also reveal all of the ShellObjectDelayLoad and AppInnitDlls other tricky entries.

There is a filtering system built into AutoRuns and I suggest you set it to hide verified Microsoft entries and Empty locations - this greatly reduces the output you need to sift through.

Any entries that you want to check out can be put into the startup list database over at CastleCops (http://www.castlecops.com/StartupList.html) which will give you a reasonable idea as to their usefulness. This won't crack everything for you but will take you 90% of the way there for weeding out dodgy entries.

[tarun]

I'll try it. thanks

[Big Booger]

Tarun did you ever get this sorted?

[Aloone_Jonez]

On no someone's been using your PC to visit dodgy porn sites. :(

Have you tried searching the registry manually with Regedit for the filenames you posed in your link?

Also you could try searching your hard drive and renaming them to filename.bak, for example EGDial.dll to EGDial.dll.bak.

One way to help prevent this from happening again is to use a restricted account for Internet access (even more important if you let someone else use your machine) and by not using Microsoft Internet Explorer, although I doubt the latter is to blame in this case it sounds like someone clicked on an "access free porn with no credit card" link, however a restricted account should help prevent this sort of crap from installing.

[rohitk89]

On no someone's been using your PC to visit dodgy porn sites.He got you too, Tarun.

[tarun]

Tarun did you ever get this sorted?
Removed it with the Bazooka Adware and Spyware Scanner manual instructions and then managed to detected and removed it completely with Ad-aware. Didn't have to disable System Restore.

It just kept adding itself back to the registry startup items but never showed up in hijackthis! and msconfig.

Spybot still gives me problems.

On no someone's been using your PC to visit dodgy porn sites.
Oh, you have discovered my secret. Now everytime I masturbate I will remember you.

[Aloone_Jonez]

Good, I'll just have to imagine you as a gorgeous sexy girl.:D

[rik]

Oh, you have discovered my secret. Now everytime I masturbate I will remember you.

:eek:

You ain't right

[tarun]

Good, I'll just have to imagine you as a gorgeous sexy girl.:D
For $11000 (http://www.google.co.in/search?q=sex+change+operation+cost&start=0&ie=utf-8&oe=utf-8&client=firefox-a&rls=org.mozilla:en-US:official) you won't need to imagine.