coocy Posted April 26, 2005 Share Posted April 26, 2005 Hi Guys it's me again ,How you've been?I hope you can help me.I have a virus on my pc.When I run MS Antispyware it finds a virus called:LookingFor Dial.But when I remove it, it comes back after a few seconds. I also found out that it creates an html file in:C:\WINDOWS\Web\desktop.htmlOne way or another it removes my own wallpaper and puts its own wallpaper which says that I have virus on my pc. It has a link to http://topantivirus.biz/ . This has links to anti-virus programs.Don't know how to remove..so please help...Coocy Link to comment Share on other sites More sharing options...
TiXer Posted April 26, 2005 Share Posted April 26, 2005 Have you tried scanning you're computer with spyware removers in addition to virus programs? With Spybot Search & Destroy or Ad-Aware for example.. You can also try to remove it with Stinger, a McAfee virus program which is quite good.But if you can't remove it, why not just reinstall you're pc? Link to comment Share on other sites More sharing options...
nicodareus Posted April 26, 2005 Share Posted April 26, 2005 Try the applications listed by TiXer. If that fails, make a note of the location of the files and boot up with a disk like BartPE (http://www.nu2.nu/pebuilder/). Then manually remove the files from within PE. One of my friend's had a virus which Norton and another AV could not remove for some reason. I used BartPE to remove the file manually.Re-installing should be the last option when you have exhausted all other possibilities. Link to comment Share on other sites More sharing options...
rjz Posted April 27, 2005 Share Posted April 27, 2005 Remove it susing thos eprograms in safe mode. Youcould also check you run section in your registry as well as startup. Link to comment Share on other sites More sharing options...
coocy Posted April 27, 2005 Author Share Posted April 27, 2005 I have Panda Antivirus 2005, Spyware Doctor , Ad-Aware and Spybot Search & Destroy. All of them are updated BUT they didnt see the virus. Only Microsoft Anti Spyware and Ad-protect see it and called it: LookingFor.Which is a Dialer which dials premium numbers and puts a wallpaper on the desktop with links to http://topantivirus.biz/.When I remove the virus or dialer with either Microsoft Anti Spyware or Ad-protect ...it returns after a few seconds. Somehow by re-creating the deleted html file in:C:\WINDOWS\Web\desktop.html.Ill try Stinger Link to comment Share on other sites More sharing options...
nicodareus Posted April 27, 2005 Share Posted April 27, 2005 Removal instructions -- http://www.androidworld.com/prod91.htm Link to comment Share on other sites More sharing options...
coocy Posted April 27, 2005 Author Share Posted April 27, 2005 Thanx for your quick reply.Seems to me I have a big problem, because just a few minutes agoI tried : McAfee Stinger and Avast.Neither detected the LookingFor Dialer/virus.What to do ? Link to comment Share on other sites More sharing options...
bledd Posted April 27, 2005 Share Posted April 27, 2005 first, turn off System Restore when removing virus's as they stay in there.then download this 'beta'version of NOD32 virus scannerhttp://www.nod32.com/download/downbeta.htm-let it do an update, then do a full scan of your pc. Link to comment Share on other sites More sharing options...
Martin Zugec Posted April 27, 2005 Share Posted April 27, 2005 First post your HijackThis log (2moderators: shouldnt this be added to rules, if someone got problem with malware to post a log and ask?)... Link to comment Share on other sites More sharing options...
coocy Posted April 27, 2005 Author Share Posted April 27, 2005 I also Posted Hijack this log. And I tried what Tarun said.But Avast didnt clean the dialer!Hope someone will help with the right solution.Because I tried alot of Anti virus programs.I think this a New sort of virus. Link to comment Share on other sites More sharing options...
TomcaT Posted April 27, 2005 Share Posted April 27, 2005 You need to turn system restore off and run your spyware programs in Safe mode without network. ie NO internet connection. as has been suggested in the above posts. Link to comment Share on other sites More sharing options...
TiXer Posted April 27, 2005 Share Posted April 27, 2005 I suppose you've already tried the Trend Micro free online scan: http://housecall.trendmicro.com/This is quite good on removing some nasty buggers at least.. Link to comment Share on other sites More sharing options...
Martin Zugec Posted April 27, 2005 Share Posted April 27, 2005 2Coocy: I cant see that log... WHere did you post it??? Link to comment Share on other sites More sharing options...
matrix0978 Posted April 27, 2005 Share Posted April 27, 2005 www.lunarsoft.locias.com and check out the Malware Removal section Link to comment Share on other sites More sharing options...
coocy Posted April 28, 2005 Author Share Posted April 28, 2005 Well I am still trying to find out whats wrong.I found out that all the anti-virus programs will remove it , but it comes back. Even NOD32 didnt even detect it !!!!!???I think the Dialervirus starts up with the pc.I found this out:- in C\Windows\System32\lknfmkcp.exe and a svchosts.dll. Both with the same exact date and time: 25 april 2005 12:45 am.- in C\Windows\Prefetch\RUNDLL.32.exe-[some numbers and letters] This one ran several dates and times up till now. each time it has different letters and numbers and is bigger in size. All 3 unknown applications.But I still Don't know if I should just delete them. I know svchosts.dll is NOT the same as svchost.dll I do try all of your suggestions by the way. Thanks.I am now looking at this website http://www.f-secure.com/v-descs/googkle.shtmlBUT they dont say HOW to remove it. Permanently I mean.Coocy Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now