Peanuts

iTrader: (15)

I need to download a firewall to protect my home pc.

currently I have winpatrol, adaware and spybot S&D.

I also have a browser hijacker problem.

I went to download.com.com to get a free firewall and cannot do a download at work (bleedin websense).
theres a free one that rated 83% (?) and is about 8.xx meg
Can anybody please download a free firewall for me onto cd and maybe post it to me??
I will cover all costs, but cant do it at home because of the browser hijacker diverting my browser to premum rate .
Ive looked through win explorer (W98) but cant find where its hidden.
everytime spybot finds it and fixes it it just comes back next time I re connect to the web.
Im <----------------------------> this close to flinging the bloody thing out the window!
pm if you want discretion...

Andy

Scooby-Doo

I assume you mean the modem is hanging up and reconnecting to a premium rate number ???

If this is the case have a look for a program called dialer.exe

If it is the browser redirecting you to another website I doubt weather the firewall will help as the program is already on the PC.

Hope this helps

Chris L

Andy

Have you tried running Spybot? It is normally quite good at spotting and removing the dialers. What happens is that it will do a full scan and then asks you to reboot the PC. Spybot then runs a program in DOS to remove the dialer before Windows boots up. I would happily send you a CD with Sygate Personal Firewall on it, but you need to get your machine 'cleaned first'.

Chris

Peanuts

iTrader: (15)

thanks guys!

few more details for clarity...

before I start IE, I always look in the properties/connections to check there is no others dialers loaded.
Then when I start dial up its all hunky dory, connects to virgin.net
then after about 5 minutes a browser hijacker redirects the connection to a premium rate number which means I instantly (manually)disconnect the modem to stop costs.
the hijacker then puts a program on my desktop, strat menu and taskbar.
a right click on the taskbar/uninstall option removes it (so I thought) from the pc.
I then run adaware and spybot search and destroy to find any offending articles.
removal of these with the fix it now button.
quick explore of windows and its all clean.
reconnect and lo and behold five minutes or so later and its back.
I searched through the disclaimer and found a contact mail address, I have emailed them from a spare email address to get the bloody thing off my pc permanently.
I have disabled activeX controls (??) on the IE/content/security options.
dont really know what else to do.
everytime I look for the program its not there to be found then it loads itself up and redirects my connection.
**** really.

Andy

ozzy

Get a firewall ASAP. I'd recommend ZoneAlrm or Sygate

Stefan

ozzy

No prepare to receive lots of SPAM.

Stefan

martin_oleary

Andy,

What's the name of the file and shortcuts it creates? Have you looked in the run key in the registry (the part that tells windows what to load on startup) to see if it's loading itself up from there? (sorry don't have win98 to point you to the exact location of the regsitry)

suba

you might want to consider formatting your hdd and install the OS again. at least that would get rid of every single spyware/trojan/virus on your PC. once you have installed the OS, install anti-spyware, anti-virus and firewall, then connect up to the internet. install it in that order!

Peanuts

iTrader: (15)

the desktop item is called *adult-play* and the dialer is called XXXserver.
the first one was called *hotkiss*

Peanuts

iTrader: (15)

re: hdd formatting.
sounds like a good idea to me, not too sure where the W98 cd is though

Peanuts

iTrader: (15)

this sucks big time!!
I can only think its come onboard when mrs peanuts was using yahoo! groups and msn groups??

Peanuts

iTrader: (15)

seems Im not alone in this

martin_oleary

IT will be loading from a key in this part of your registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

IF you can identify which one it is (give me a list and I'll let you know which one if that helps) and just delete it. There'll still be some files on the disk relating to it, but without this entry it won't be able to load.

Peanuts

iTrader: (15)

thanks Martin, where will I be able to get the list to give you?

Andy

Scooby-Doo

I think Mrs Peanuts look at more than just the Yahoo groups when she is surfing alone

martin_oleary

Hi Andy,

I've sent you a PM.


Martin

Brendan Hughes

Tip that might help - when you get ZoneAlarm, it's about 4.5MB (IIRC), and it comes with the offer of trialling ZAPro for 15 days and if you don't pay up it reverts to ZA basic. In my and another's experience, DON'T trial Pro. Just carefully go through the set-up to choose ONLY the firewall, and not the other trial stuff that comes with Pro. I had real probs with it blocking all internet access until I re-installed ZA, to run only the basic ZA from the beginning without the Pro trial period.

Peanuts

iTrader: (15)

apparently people who use msn and outlook express are the most succeptible.

Peanuts

iTrader: (15)

martin, responded thanks
Andy

suba

find that windows 98 cd of yours and format your hdd!

Peanuts

iTrader: (15)

went through the resistry last night and deleted all values and keys that were spurious.
ran spybot S&D, adaware, hijackthis and zonealarm firewall and I think its gone!!

managed an hours surfing afterwards without any signs so fingers crossed

thanks for all your help

Peanuts

iTrader: (15)

will do boss

Peanuts

iTrader: (15)

I wouldnt mind but she ocviously deleted it before I got there

apparently using msn groups is the killer, especially when you register using a (pop3) dialler on outlook express.
after my research it also appears that there is a hole in the microsoft system that can allow less then scrupulous firms to get a program running without consent, its definately true of win98 and xp, a simple patch from microsoft will plug this loophole and mean that programs cannot run without consent.
blimey

Redkop

I had loads of trouble removing a dial up thingy called DialTop. Ad-Aware/SpySweeper would get rid of it for a while then it came back. I then ran Sophos Anti-Virus and it picked it up, but wouldn't delete/quarantine it to begin with. I rang the help desk at Sophos and was told to go to Processes in Windows Task Manager and highlight the prog and then 'End Process' then run Sophos again and sure enough Sophos deleted and shredded it. It has never returned in 5 weeks now