dial up theft

G

Guest

Guest
Archived from groups: microsoft.public.win98.gen_discussion (More info?)

hi,

Somehow my dial-up is being used.
I have all obvious anti 'stuff', I update minimally once per week and
run them twice per week.
In the last few days I have noticed (and am now watching) my dial up
icon showing plenty of data going in and out, I am not happy.
Anyone out there know of a proggy that 'SpyBot' doesnt quite match up
to? Adaware is superb in what it does, so is SpyBot for 'dialer stuff',
but when I see my connection sending and recieving whilst I am not at the
controls of sending and recieving, then I have to think that something else
is afoot.
As a rider, I updated adaware & spybot less than 48hrs ago.
Hope there are many out there who despise this type of computer
hijacking and can help.
cheers.

...Rex..
 
G

Guest

Guest
Archived from groups: microsoft.public.win98.gen_discussion (More info?)

From: "Rex" <Rex@Hotmail.com>

| hi,
|
| Somehow my dial-up is being used.
| I have all obvious anti 'stuff', I update minimally once per week and
| run them twice per week.
| In the last few days I have noticed (and am now watching) my dial up
| icon showing plenty of data going in and out, I am not happy.
| Anyone out there know of a proggy that 'SpyBot' doesnt quite match up
| to? Adaware is superb in what it does, so is SpyBot for 'dialer stuff',
| but when I see my connection sending and recieving whilst I am not at the
| controls of sending and recieving, then I have to think that something else
| is afoot.
| As a rider, I updated adaware & spybot less than 48hrs ago.
| Hope there are many out there who despise this type of computer
| hijacking and can help.
| cheers.
|
| ..Rex..
|

Rex:

You can't just say -- "I have all obvious anti 'stuff'"
You *MUST* define what software and their respective versions.

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
(.LNK) file, a PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
remove
viruses, Trojans and various other malware.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode. This
way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
 

galen

Distinguished
May 24, 2004
1,879
0
19,780
Archived from groups: microsoft.public.win98.gen_discussion (More info?)

In news:egtDE6ZoFHA.3316@tk2msftngp13.phx.gbl,
Rex <Rex@Hotmail.com> had this to say:

My reply is at the bottom of your sent message:

> hi,
>
> Somehow my dial-up is being used.
> I have all obvious anti 'stuff', I update minimally once per week and
> run them twice per week.
> In the last few days I have noticed (and am now watching) my dial up
> icon showing plenty of data going in and out, I am not happy.
> Anyone out there know of a proggy that 'SpyBot' doesnt quite match up
> to? Adaware is superb in what it does, so is SpyBot for 'dialer
> stuff', but when I see my connection sending and recieving whilst I
> am not at the controls of sending and recieving, then I have to think
> that something else is afoot.
> As a rider, I updated adaware & spybot less than 48hrs ago.
> Hope there are many out there who despise this type of computer
> hijacking and can help.
> cheers.
>
> ..Rex..

In addition to David's advice you should add a firewall to the mix to see
what's going on:

Firewalls - Basics :
http://kgiii.info/windows/all/security/firewalls-basics.html

Galen
--

"Chance has put in our way a most singular and whimsical problem, and
its solution is its own reward."

Sherlock Holmes
 
G

Guest

Guest
Archived from groups: microsoft.public.win98.gen_discussion (More info?)

> You can't just say -- "I have all obvious anti 'stuff'"
> You *MUST* define what software and their respective versions.

Thanks David, I have all of your info ready for use.
First though, I will let you know what I have as per request.
I have:
1)Adaware, updated again today.
2)SpyBot Search & Destroy, also updated again today.
(footnote, neither were able to remove my problem)
3)Hijack This, current version.
4)CWShredder
5)Avast AntiV

I have searched all known startup viewers, (msconfig, ctr+alt+del, ATM, &
anything else which shows running process's).

I am guilty of one computer sin, and that is downloading a program for
casino
poker......... but only to watch a friend play. I also do admit that
my
problem started about the time I loaded it on (4 days ago) and have since
removed the damn thing.
I am not sure if it the offender but the coincidence is uncanny. If it is
the guilty
party then it has obviously buried itself in the registry, an area which I
am not
yet fully comfortable with man-handling.
Does this sort of problem come under the umbrella of the type of thing that
spybot is designated for; I believe it does and hence my question as to
whether there is a slightly more thorough program that will remove things
that
spybot might miss.
Cheers for assistance.

...Rex..
 
G

Guest

Guest
Archived from groups: microsoft.public.win98.gen_discussion (More info?)

From: "Rex" <Rex@Hotmail.com>

>> You can't just say -- "I have all obvious anti 'stuff'"
>> You *MUST* define what software and their respective versions.
|
| Thanks David, I have all of your info ready for use.
| First though, I will let you know what I have as per request.
| I have:
| 1)Adaware, updated again today.
| 2)SpyBot Search & Destroy, also updated again today.
| (footnote, neither were able to remove my problem)
| 3)Hijack This, current version.
| 4)CWShredder
| 5)Avast AntiV

OK. But you didn't state the versions. It is important becuase I run into many still using
Ad-aware6 and other older utilities.

Ad-aware should be SE v1.06
SpyBot S&D should be v1.4
HJT should be 1.99.1

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
 
G

Guest

Guest
Archived from groups: microsoft.public.win98.gen_discussion (More info?)

I found some more registry entries after a re-look.

***
HKEY_LOCAL_MACHINE\Software\Innoco\Casino\absolute\url
***

There are approximately 60 entries under \url, they all seem to point
to www's regarding 'absolutepoker'.

It is getting very annoying and I hope you know of a fix as every time I
go on the internet the 'traffic bytes' start moving in & out.
Just wait til I see my friend, I am going to give him heaps for asking me to
load the program just to watch him play.
Let me know if I should start a new post with the registry as the topic.
cheers.

...Rex..
 
G

Guest

Guest
Archived from groups: microsoft.public.win98.gen_discussion (More info?)

From: "Rex" <Rex@Hotmail.com>

| I found some more registry entries after a re-look.
|
| ***
| HKEY_LOCAL_MACHINE\Software\Innoco\Casino\absolute\url
| ***
|
| There are approximately 60 entries under \url, they all seem to point
| to www's regarding 'absolutepoker'.
|
| It is getting very annoying and I hope you know of a fix as every time I
| go on the internet the 'traffic bytes' start moving in & out.
| Just wait til I see my friend, I am going to give him heaps for asking me to
| load the program just to watch him play.
| Let me know if I should start a new post with the registry as the topic.
| cheers.
|
| ..Rex..
|

Pure Registry settings are NOT enough to create a DUN (Dial Up Networking) connection.

Have you executed the Multi AV Scanner utility ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm