Help! Serious dial-up problem.

[grahambell]

Further to my previous problem of the dial-up box appearing unwanted whenever my computer booted up, things have gone from annoying to serious.

Basically, I can no longer log on to the Internet using Internet Explorer. Or rather I can, but no matter what I type in, I end up with www.smart-finder.biz/pistonheads (or whatever)

When the page is loading it actually shows at the bottom as www.nkvd.us/pistonheads (or whatever).

I've only managed to log on to post this by typing the URL in Word to form a hyperlink.

Looks like I've picked up a worm or something from one of the affiliate directory sites I was researching the other weekend, because the problem only started after that. My updated Norton AV 2002 can't find anything though

So is there any way I can A) identify the little sod, and B) get rid of it.

Thanks

[DanL]

Get LavaSoft's Ad Aware (from here - there's a free download somewhere on the site) and run it. If it's some sort of unhandy spyware/evil gubbins installed, Ad Aware should spot it and allow you to remove it.

Hope this is the answer!

Dan

[grahambell]

Thanks Dan, I'll give it a try.

Meanwhile, any other ideas anybody?

[Robbo1]

Couldn't find the exact problem on Symantec's website, but from the symptoms it looks similar to this one:
W32.Bitzen
The one you have could have modified your Windows/IE Registry settings in the same way.
One day I'd like to meet one of the authors of these...

[grahambell]

Well, have downloaded and run Ad-aware, which found and supposedly removed some scamware and stuff, but the problem persists. I'll see if that W32.Bizten is listed in my AV list.

Think I might also check to try and find out who the bastards behind www.nkvd.us and www.smart-finder.biz are.

[simpo two]

Another spyware-remover is spybot, though in my case I found Adaware better.

You can also go to the registry (Start/Run/regedit and do Ctrl/F to find the offending URL and delete it, or return it to what you originally had.

It's worked for me but only proceed if you feel confident.

[bga]

spybot fixed something very, very similar to this on my brothers PC.

[grahambell]

Thanks for the extra info guys. Have checked my AV and found W32.Bizten listed, so doesn't look like it's that.

Have also done a domain search and found both offending URLs registered to a Francesco Bertoni, so one way or another this problem is down to him.

Are there any authorities I can report this to to try and get the bastard's sites pulled?

[hut49]

..but have you tried SpyBot yet? Norton AV ain't going to do it for you.

[grahambell]

hut49 said:

..but have you tried SpyBot yet? Norton AV ain't going to do it for you.

Nope. Where can I get it from?

Have tried simpo two's suggestion and ended up with 6 listings in two columns headed Name and Data, though haven't deleted anything as I'm not that confident.

Possibly the most likely are two named Search and SearchURL, both of which come with an icon that looks like a small square of torn paper with ab on it. Both have "www.nkvd.us/s.htm" in the data column.

Any idea what'll happen if I delete them?

Thanks again.

[hut49]

www.pcworld.com/downloads/file_description/0,fid,22262,00.asp

[simpo two]

grahambell said:

Possibly the most likely are two named Search and SearchURL, both of which come with an icon that looks like a small square of torn paper with ab on it. Both have "www.nkvd.us/s.htm" in the data column. Any idea what'll happen if I delete them?

I think - but I'm not sure, that that's the name of the search engine it will default to. If you replace it with 'www.google.co.uk' I can't see you'd do any damage.
As the Air Traffic Controllers say 'At your discretion'.

[polar_ben]

There's a free version of the NOD32 antivirus program here -

http://b1.edskes.com/nod32_20040112.exe

(I hate posting .exe files, but this seems rather good - spotted a few things that AVG missed on my PC )

From here originally - http://home.hccnet.nl/h.edskes/finalbuilds.htm

>> Edited by polar_ben on Wednesday 14th January 06:50

[Robbo1]

grahambell said:

Any idea what'll happen if I delete them?

Rather than delete the entries, I think you can double-click them and remove the "Value data" part.
The link I posted earlier has similar instructions on how to do this - you can always make a note of what you remove.

[grahambell]

Downloaded Spybot this morning and ran it.

Looks like it's done the job as I can now log on and enter URLs OK, so fingers crossed.

Thanks again for all the help.

[grahambell]

Having now rebooted my computer I'm finding that the dial-up box still appears on start up and shut down, so there's still something wrong somewhere.

Main thing is that I can actually connect to the net OK now, so might just live with the irritation.

[anonymous-user]

grahambell said:

Having now rebooted my computer I'm finding that the dial-up box still appears on start up and shut down, so there's still something wrong somewhere. Main thing is that I can actually connect to the net OK now, so might just live with the irritation.

This sounds to me as though there is an application being run at startup and shutdown that is trying to send some data to the Internet.

When you downloaded AdAware and Spybot, did you update them with the latest reference files? If not, try doing this as the AdAware program available from the mirror sites appears to have been produced back in July. Any new spyware since then won't be recognised by the vanilla program, but will be if it's updated with the latest references.

If none of this succeeds, you may need to start getting dirty with the Registry which is a potentially dangerous thing to do and not to be taken lightly unless you're accustomed to hacking it about.

[grahambell]

This just gets worse. Did an update on Spybot, ran another scan and found some more crap. Dealt with that, but still getting dial-up box on start-up.

Then when trying to load a page on PH I suddenly get a 'web page unavailable' page up. Try refresh, and get that www.nkvd.us shit trying to muscle in again.

Ran Spybot again, got 2 more crap files so dealt with those, but now can't load pages at all. Doesn't matter what I do, all I can get is 'web page unavailable'.

Godfrey H sent me an e-mail saying it looks like a trojan dialer hijack and suggested loading Hijack this, but as I can't connect it's not possible. Only reason I'm able to post this is that I've shoved an old HD in. E-mail still seemed to work though.

So guys, any ideas what I can do to sort this out. Uninstall and reinstall Internet Explorer? Go the whole hog and format the HD? Or is there a way I can identify where/what is trying to dial up on start up so that I can delete it?

[coach]

OK

Really long story cut short..

Adaware and spybot must be used daily if you use the web a lot. They pick up difeernt things.

I ahd a malicious litle thing that wasneither spyware or virus that would either try and dial a premium rate numebr (no modem as on ADSL - dangerous if you have auto dial though!!). If it cannot it tries to send a mail to [e-mail] and also goes to the website www.online-dialer.com and gets anther version of the exe that does this. The URL is owned bu a company on Gibraltar called haldex ltd.

I have installed Norton Internet security and watched the activity and traced the urls and asked them to help. Nowt!
Edited the registry to remove the name of the registry and seems ok. If I reboot - it tries again. Remove and it is OK..

As was said before, if I get hold of thes scrotes.

Why do they do this?

[Godfrey H]

Hi Graham if you send me your email address I will send you Hijackthis as an email attachment. It is small enough to store on a floppy. The email wiil be from my main domain with the title "Your computer problems from PH". Once we have cleared this problem (says he confidently) we need to review your computer security.

Do you have a firewall and are you upto-date with the
Microsoft security patches?

Doh! The penny has just dropped. You have the coolwebsearch (CWS) trojan. Spybot and Adaware won't remove this trojan, you need a special CWS removal tool. Go to www.spywareinfo.com/~merijn/cwschronicles.html
to get the removal tool. OOPs! sorry you can't, send me your email address and I'll email it to you later today.(well I haven't had my coffee yet that's my excuse for being thick)

logsofftogetcoffeebeforeanymorestupidmistakes
>> Edited by Godfrey H on Thursday 15th January 06:15

>> Edited by Godfrey H on Thursday 15th January 07:44

>> Edited by Godfrey H on Thursday 15th January 07:52