Web Dialer Hotx Help !!! Wont Go Away

firebird350zzfirebird350zz
edited April 2005 in Science & Tech
I recently acquired a lovely web dialer. Actually, this came about after my nephew used my laptop for a weekend I was out of town. Anyway, its some sort of trash I don't want. It puts a icon on the desktop and in the start-up menu of a womans face. I have tried cwshredder, adaware and spybot. Spybot and adaware detect it and have to scan with a re-start to get rid of it. But, it comes back with a re-start. I went into regedit and erased some stuff that was in a web dialer folder. but a couple things deny access to erase them.
Any help out there would greatly be appreciated.
Thanks.

Comments

  • HawkHawk Fla Icrontian
    edited March 2005
    Sounds like you need to have a chat with the nephew about using your lappy for porn sites. Hotx is a foreign porn site. Anyway, Here's a site that has the webdialer removal tool. webdialer removal tool Download it, install and run it. Let us know if it works please. That way we can refer others with the same problem to the site.
  • verselloversello New
    edited March 2005
    I'd run hijackthis and post the log file here while you're at it.
  • firebird350zzfirebird350zz
    edited March 2005
    I will definately post the results of the help I get in here. As it is right now, I am at work and the computer is at home. Please look for my response later tonight. Thanks
  • firebird350zzfirebird350zz
    edited March 2005
    The info on the site you recommended wasnt helpful. The manual process to remove the dialer didnt match up. Must be for a different type of dialer. (I didnt find any matches in the registry).
    The spyware program on that site didnt get it either. Even though if found some other things that adaware and spybot didnt pick up on.
    What I ended up doing is running adaware again, it found some files associated with the dialer, but, of course with a reboot it would re-build itself. And or adaware wasnt able to delete them.
    So with the files adaware found I was able to track down the dialer hidden on the hard drive. Using Killbox I deleted all the files adaware couldn't.
    So far so good. I have rebooted 5 times and it hasnt come back.
    We'll see.
    I'll update in week.
    Thanks
    Firebird
  • HawkHawk Fla Icrontian
    edited March 2005
    Thnx for keeping us updated firebird. Sorry that peticular removal tool didn't work.
    Also, Sometimes you have to run adaware & spybot under safemode to remove parts that can't be removed after bootup to desktop.
    Killbox is a great tool too.
  • firebird350zzfirebird350zz
    edited March 2005
    Ok. It's back. I figured out the name of the menace. It's called : TIB or TIBS web dialer. Ive searched around and havent found a concrete way to eliminate it. Of course again I am at work and its on my laptop at home. If anyone knows about this turd please help. I will throw up a hijackthis list when I get home tonight. Thanks to everyone who helps
  • HawkHawk Fla Icrontian
    edited March 2005
    OK, Now that we know what it is.. 'THE TIBS PREMIUM RATE INTERNET DIALER
    Increase your Membership Web Site earnings by offering your visitors a great alternative to paying by credit card or check. Even if you don't have a Members' Area of your own you can use the Tibs dialer to generate extra income by offering access to our four content areas!'XXXXXXXXXXXx
    TIBS Dialer properties:
    • Hides from the user
    • Stays resident in background
    You better check that your nephew didn't use your credit card to access this site too.
    Here's a site that has a free removal tool or if you prefer the manual removal instructions are below. 2-Spyware.com
    Seems simple on the manual removal....
    TIBS Dialer manual removal:
    Kill processes: win.com
    Delete files: win.com
    Thats it.
    Also, Other programs to remove TIBS Dialer: eTrust PestPatrol Anti-Spyware $29.95
  • firebird350zzfirebird350zz
    edited March 2005
    I went to that site and checked out the manual removal. I didnt find a match to any of the items listed in the registry or on the hard drive. I bought the spyware tool and ran it. It found the TIBS and deleted it. But it said it had to run with at boot up to remove all of it. So I did that and it removed some stuff again. But, it came back again with the next reboot. Curiously, when adaware is run at boot up it fires up before the desktop shows, before the computers processes get going. With this spyware program, the computer fully booted up then it started running.
    I also inquired with my nephew as to what he did. He said he was just surfing the net and didnt notice anything out of the ordinary. He swears he wasnt checking out any porn. He's off my computer for good anyway.
  • firebird350zzfirebird350zz
    edited March 2005
    Is win.com the re-installer in this case ? Or would I be looking for a DLL in the registry.
    I'm assuming I need to find whatever is re-installing this junk and delete it.
  • HawkHawk Fla Icrontian
    edited March 2005
    win.com could be the reinstaller, but there could be other parts that keep reinstalling. It's hidden so you can't find it without something like Hijack This.
    Do you have ( Hijack This )?
    If not, download it from the site,( it's on the left and has a green light blinking next to it) open it, run it, and post your logfile here.
    There's a tutorial on how to use it there also. Once we get the logfile posted we can look through it and find the offending culprits for removal.
  • GnomeWizarddGnomeWizardd Member 4 Life Akron, PA Icrontian
    edited March 2005
    hijack this and post your log there isnt anything that hijack this cant do ( well that i have found yet )
  • HawkHawk Fla Icrontian
    edited March 2005
    Here's a statement at the tibs support site.
    We recently discovered that some hackers have been getting a piece of software onto users computers which in turn downloads and opens our software every time Windows or Internet Explorer is started.
    PLEASE NOTE IT IS NOT OUR SOFTWARE THAT NEEDS REMOVING TO STOP THIS HAPPENING RATHER THE HACKERS SOFTWARE WHICH IS NOT WRITTEN BY US NOR HAS ANYTHING TO DO WITH US AT ALL.
    We have created an uninstaller that a) removes ALL traces of our software and b) hopefully the hackers software.
    tibsystems.com/help/
    Try this one and see. Worst case is it doesn't remove it.... then we can try the hijack this.
  • firebird350zzfirebird350zz
    edited April 2005
    I finally eliminated it. I found the re-installer as win.com and used Killbox to boot it. Then I ran spybot and adaware which killed other associated files involved. After a week of rebooting and messing around and running adaware and sbybot over and over, its not picking up anything else. Sorry so late to post this. I was on vacation for 7 day cruise. Thanks for all the help out there. !!!!
  • HawkHawk Fla Icrontian
    edited April 2005
    Cool deal firebird, Thnx for letting us know. We always appreciate when someone lets us know the end results. :thumbsup:
    Hope you enjoyed the cruise!
  • abe-mellerabe-meller
    edited April 2005
    unfortunately, i have the same program on my computer. i have been following the thread, and have tried to delete the program with adaware and spybot, but the program keeps coming back. i downloaded killbox, but cant get it to do what i want. maybe im just not using it right. help?
  • FranticNMoodyFranticNMoody
    edited April 2005
    I really the same situation with my about blank B*tch...the garbage keeps coming back. Still I don't know why you can't delete programs on your computer that someone installed. My reads 'cannot delete file' file is writer protected..Why ? when it's been downloaded on my computer ? Strange. :rolleyes:
  • FranticNMoodyFranticNMoody
    edited April 2005
    Spyware is so friggen annoying!
  • HawkHawk Fla Icrontian
    edited April 2005
    FranticNMoody, Go back into the thread you've already started with primesuspect and ask him to walk you through it. He will take care of it if your patient and follow his directions.
  • FranticNMoodyFranticNMoody
    edited April 2005
    Hawk wrote:
    FranticNMoody, Go back into the thread you've already started with primesuspect and ask him to walk you through it. He will take care of it if your patient and follow his directions.
Sign In or Register to comment.