Some windows questions.

EyesOnlyEyesOnly Sweden New
edited February 2004 in Science & Tech
First i have a problem with the windows dialer program. Earlier it started every time i started windows, began dialing some number, failed and gave me some error message. I then wanted to uninstall it but couldn't find it in add/remove programs so i tried to delete it manually and did a search in the registry and deleted anything that seemed to belong to it. Well the file popped backed everytime i hit delete and i can't delete it.

Well since then which was before i joined s-m a few weeks ago something's been trying to start it but not found it yet as i said the files is still there. The strange thing is that it does this about half an hour after i turn on the computer so it's not at windows start. I've tried to find the referens in whatever file it might be in but haven't found it. After a while i got tired of trying and started ignore it. It's only bad if i listen to loud music since the error message comes out loud but since it does nothing else i haven't done anything about it.

Well now when i've found this site and also read the software forum to se if anyone else had this problem and thought that i should ask for help.

The second thing i would like to ask about if there's some way to install winxp pro without the folders in documents and setting being created. I want it in the windows folder as in win98. Is there some way to do this while installing windows.

EO

Comments

  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited January 2004
    You have spyware.

    Get:

    Spybot Search and Destroy 1.2 from www.download.com

    UPDATE it before you run it

    Then run it.
  • Straight_ManStraight_Man Geeky, in my own way Naples, FL Icrontian
    edited January 2004
    One. Diallers usually run from Dial Up Networking, and in the 98 family, one of two ways will usually bring that up (there is a third, but that involves a folder search):

    98 SE lets you get to this from Start|Run|settings then choose Dial Up networking.

    Also, there is an entry in 98 in the Start menu, in Start|Accessories|Communications.

    Now, there are other things that should from time to time try to dial out-- a Fax program that could not send a fax might try in a timed loop to resend things, as one example. If modem is online on a dialup, it cannot fax at same time, so a fax program might be wanting the line or tryign to dial out and use a busy modem. Some software that depends on dialup for data can do this also.

    Check dialup networking if you have ever had AOL, or changed ISPs. Yopu might have TWO dialups working, and old ISP software might be wanting to get online every once in a while.

    As to second part, with XP you move things you want all users to use into the Documents And Settings\All Users place you want it. Reason is, in 98 SE, and one reason it really stunk for security, is every hacker knew that programs run on 98 SE were typically run at full privileges unless someone had implemented Microsoft Family Login and had also exptensively hacked the registry. With XP, you have better security if you almost NEVER run a box as default user, and stick what you WANT to run in All Users or that user's area-- moving everything into one area would break this separation of what Widnows now controls in part to make it harder for viruses and trojans and give everything the privileges of the group of users that could access this area. Doing so would be nice for you and hackers everywhere, and not so nice once a hacker found your box and decided it might make anice remote run FTP server or web server.

    Sorry, the Windows for everything in XP is NOT recommended AT ALL, and would need massive registry hacking to do at all well.

    John.
  • EyesOnlyEyesOnly Sweden New
    edited January 2004
    Well i have already tried spybot and it didn't work. I'm not sure it's spyware. I've got no faxprogram installed and i removed the previous dial-up conncetion i had so i don't think it's to blame. As for moving folders i did move the desktop and temp folders. Never thought it could be a security risk. I'll try to change it back some day.
  • EyesOnlyEyesOnly Sweden New
    edited January 2004
    Ok thanks to an app called startup mechanic from www.openwares.org i found out that it was caused by something called the makecallvirus. but neither norton nor spybot detected it so the question is. how do i remove it. The program scans what starts with windows and tell you what the program does if it's known. The makecall virus was featured under a tab called harmfull and i was instructed to deactivate it. Since then i've made severll reboots but the box hasn't popped up like before.

    So problem solved but i wan't to know how to remove it and why the other apps didn't detect it.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited February 2004
    Troj/Makecall-A makes call requests (for numbers within the UK) using the installed call-control program, if one exists, without the user's knowledge.

    Troj/Makecall-A copies itself to the Windows system folder as SHAREDPREM.EXE and adds an entry to the registry to run itself on system restart at:

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run "sharedprem"="%System%\sharedprem.exe"
    I would delete the file "SHAREDPREM.EXE in C:\Windows, then run regedit and delete the registry value noted above.

    Norton claims to have had it in their definitions since April 1, 2003. (A good day for a trojan, I guess...) :)
  • Straight_ManStraight_Man Geeky, in my own way Naples, FL Icrontian
    edited February 2004
    EyesOnly wrote:
    Ok thanks to an app called startup mechanic from www.openwares.org i found out that it was caused by something called the makecallvirus. but neither norton nor spybot detected it so the question is. how do i remove it. The program scans what starts with windows and tell you what the program does if it's known. The makecall virus was featured under a tab called harmfull and i was instructed to deactivate it. Since then i've made severll reboots but the box hasn't popped up like before.

    So problem solved but i wan't to know how to remove it and why the other apps didn't detect it.

    Norton works by using definitions and active scanning. IF anohter virus turns off active scanning, or manages to essentially disable active scanning by norton, then you have no protection except by manually running Norton. There are viruses that have and can do this to the Norton 2002 and back. you get a one year virus subscription with Norton if the def feed system at Symantec does not detect or think you have apirated copy or hacked copy. The servers there can turn off def feeds (DRM). I would say for now you want BitDefender or F-Prot paid or Norton 2003 or later, legitimate versions.

    If you have NAV 2003, I think you have a compromised Norton. Either NAVAP has been set not to run at startup (this is the base of your Norton scanning engine), you have old or partial defs, or you do not have uptodate defs. If NAVAP cannot start or BSODs box at startup, your active scanner is virus (probably worm) compromised or you have a corrupt install or updating is not happening right. I would uninstall Norton and clean registry of Norton keys (walk through the manual uninstall process for your version) and reinstall it, unless you are outside the one year def update time frame.

    IF you are outside that or have a NAV (Norton AV) that is pre 2003, I would uninstall and possibly move to N-Prot. N-Prot is better at European and Scandinavian and Far Eastern viruses, and knows trojans better than NAV in terms of what it knows. It also protects itself better than Norton unless you run Norton in high protection mode, whihc enables heuristics that stop attcks on Norton and core system attacks and can do so in many cases even before defs are out for soem viral attacks.

    If you pay for virus defs, you are not gettign program updates beyond first year with Norton that are not fixes to the old version due to major problems with it. In 2004, not enough 2002s are subscribed for the 2002 to get major retrofits to get it up to the level of 2004 program hueristics, module name changes to avoid compromizing by old viruses, and other things like that. You are just getting defs. If a virus hits before defs are sent to you, then defs cannot protect you unless they recognize part of older viral code stuck into the newer virus and then the killing might not be complete with newer viruses\trojans\worms.

    To be honest, I think you have an active-scan disabled or limited scan depth Norton and possibly older defs also. And I think there is more than one virus on the box.

    Since you are online, you might want to grab a free N-Prot snapshot download and scan, but do not rely on a fixed definition set for long for real protection.

    http://www.nprot.com/ and get the trial version, which is typically is updated to defs current to time when put up for trial download for free (yes, you get to tell them your email to do this). Every trial I have grabbed from them has had def sets current to last 7-10 days as far as def dates. I have grabbed a few to check, they put a new download for trial up with defs about every 3-4 def update cycles (I get on average 3-4 def updates every week to nine days).

    IF it will not load and you want to not relaod box, I wold do an online scan if nprot will not load. It is compact, and should load unless your O\S is majorly corrupt but you would see other things.

    John D.
  • EyesOnlyEyesOnly Sweden New
    edited February 2004
    Well it did fix it. Thanks prof. But now i've got an even bigger problem. Almost all files on c: are gone. The bootfiles appear to be there as well as all folders but no others including hijackthis and that other app. I did have some nice pics in there too as well as a list of stuff. All that is gone. Could this be related to morpheus. I installed it earlier then closed it and started scanning for adware. It was at this time that i noticed it. I've got nav running but so far nothing. I didn't even download anything with morpheus. Oh and i did try to call my cellphone using dialer. It failed. Could be because i've got broadband. Anyways HELP. I'm seriously pissed now especially at those who recommended morpheus even though i'm not sure that's the problem.

    :mean: :mad2: :mad2: :scratch::rant::rant::rant::rant::rant::rant::rant::rant::rant::rant::rant::rant: :shakehead :shakehead :grumble::grumble::grumble: :banghead: :banghead: :banghead:

    And i didn't delete the files manually, that i know.
  • MJOMJO Denmark New
    edited February 2004
    Hmm it seems that you have to load your machine with anti-spyware/trojan utillities.
    If only there was one program to detect and remove everything. :sigh:
    My list of anti-spyware/trojan utillities contains: Spybot, Adaware, HijackThis and now Startup mechanic.
    On top of that you need AV and maybe a good FW.
    That is too much, isn't it?

    Is Sygate Personal Firewall any good?
  • GobblesGobbles Ventura California
    edited February 2004
    as of yet Morpheus 4.0 does not contain any registered spyware...


    Gobbles
  • EyesOnlyEyesOnly Sweden New
    edited February 2004
    MJO wrote:
    Hmm it seems that you have to load your machine with anti-spyware/trojan utillities.
    If only there was one program to detect and remove everything. :sigh:
    My list of anti-spyware/trojan utillities contains: Spybot, Adaware, HijackThis and now Startup mechanic.
    On top of that you need AV and maybe a good FW.
    That is too much, isn't it?

    Is Sygate Personal Firewall any good?

    I don't know if sygate's any good cause i use norton. Morpheus is gone and so are still the files. I've got all those apps installed and have run them all. BTW it was HijackThis and CWShredder that got deleted. Can any of them have deleted themselfes. I noticed that hijack creates backup files and since i ran it while it was still in c: there should be some but there isn't.

    I really need to know what happened so i know what to do the next time.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited February 2004
    EyesOnly wrote:
    ...now i've got an even bigger problem. Almost all files on c: are gone. The bootfiles appear to be there as well as all folders but no others including hijackthis and that other app. I did have some nice pics in there too as well as a list of stuff. All that is gone. Could this be related to morpheus...
    First step I would do is disconnect from the Internet temporarily and do the full virus/trojan/spyware cocktail, in safe mode if possible.

    Try not to make an unnecessary changes to your drive. You may be able to salvage things with an unerase program if the deleted files are not overwritten.

    I'm not familiar with morpheus, but have a poor opinion of all of those types of programs. Sooner or later you ending up paying anyway. (TANSTAAFL!) How is the shared folder set up in morpheus?
  • EyesOnlyEyesOnly Sweden New
    edited February 2004
    I've done that scan, though not in safe mode it came out with nothing. I've since then backed up all my stuff and prolly overwritten the files. They weren't that important anyway but i don't want it to happen again. Have uninstalled morpheus and are just using shareaza which sometimes makes me happy i have nav. I'll try to not use it to much since i know the risks i'm taking. The shared folder in morpheus was c:\shared stuff which had several folders in it. I didn't share c: directly that i know and i have never had anything like this happen before and norton has always worked so i don't know how it could have been a virus.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited February 2004
    I've used Norton for years, but every study of A-V programs shows that they all miss some. You might want to disable Norton and try another program, maybe the free version of AVG.
  • EyesOnlyEyesOnly Sweden New
    edited February 2004
    No thanks. Call me lazy but i don't fell like it. BTW i ran security checkup from nortons site and serach for both firewall leaks and viruses. Nothing was found. I figured that since that runs from the web and isn't relying on what i have installed then if nav on my comp is corrupt then running it from the web might help.

    I also went to pcpitstop.com and used their virus search (based on panda antivirus) but it didn't find anything either so i doubt that avg would help. Could this have been caused by a failing harddrive.
Sign In or Register to comment.