Dialer that Ad-Aware cannot remove

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Are you running Ad-aware SE v1.06 with fully updated definitions? Have you
tried scanning in Safe Mode?

Check for Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to
use. It will help you to both identify and remove any hijackware/spyware.
**Post your files to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or
http://aumha.net/viewforum.php?f=30 for expert analysis, not here.**

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

Mian Ali wrote:
> Hello,
>
> I ran ad-aware yesterday and it found registry entries for dialer. I
> allowed
> it to remove these entries and ran the Ad-aware again and again it found
> the
> same entries.
>
> I ran Spybot Search and Destroy, it did not find any dialers. Everytime I
> run Ad-Aware, it finds the same entries. The details of the entries are:
>
> HKEY User\default\software\microsoft\windows\current version\run\ " "
>
> HKEY Local_Machine\default\software\microsoft\windows\current
> version\run\"
> "
>
> I am using Windows 98 and IE 6 sp1 and using cable network. (Not on
> dial-up)
>
> How do I remove these registry entries. I look for them using regedit but
> cannot find them.
>
> I will appreciate any help to remove these dialers. Any other spyware
> remover that can remove these. I also have spyware blaster installed.
>
> Thanks
> Mian

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks Ben. Here is part of the log file between lines:

---------------------------------------------------------------------

Ad-Aware SE Build 1.06r1
Logfile Created on:Friday, July 08, 2005 10:00:25 AM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R53 07.07.2005
..
..
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Dialer Object Recognized!
Type : RegValue
Data : Wildflics
TAC Rating : 5
Category : Dialer
Comment : ""
Rootkey : HKEY_USERS
Object :
..DEFAULT\software\microsoft\windows\currentversion\run
Value :

Dialer Object Recognized!
Type : RegValue
Data : Wildflics
TAC Rating : 5
Category : Dialer
Comment : ""
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\run
Value :

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 2
Objects found so far: 2


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 2


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 2



Deep scanning and examining files...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 2

Disk Scan Result for C:\WINDOWS\SYSTEM
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 2

Disk Scan Result for C:\WINDOWS\TEMP\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 2


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
7275 entries scanned.
New critical objects:0
Objects found so far: 2


------------------------------------------
Log file is a long one.
Thanks.
Mian


"Ben Myers" <benjmyers@mindR-E-M-O-V-Espring.com> wrote in message
newsG7hAR9gFHA.3940@tk2msftngp13.phx.gbl...
If you are using AdAware version 6, see if you have a
"C:\Program Files\Lavasoft\Ad-aware 6\Logs" folder. If
so, please repost with the contents of the most recent log.

Ben

"Mian Ali" <mianali15@hotmail.com> wrote in message
news:#bITnj8gFHA.3316@TK2MSFTNGP14.phx.gbl...
> Hello,
>
> I ran ad-aware yesterday and it found registry entries for dialer. I
allowed
> it to remove these entries and ran the Ad-aware again and again it found
the
> same entries.
>
> I ran Spybot Search and Destroy, it did not find any dialers. Everytime I
> run Ad-Aware, it finds the same entries. The details of the entries are:
>
> HKEY User\default\software\microsoft\windows\current version\run\ " "
>
> HKEY Local_Machine\default\software\microsoft\windows\current
version\run\"
> "
>
> I am using Windows 98 and IE 6 sp1 and using cable network. (Not on
dial-up)
>
> How do I remove these registry entries. I look for them using regedit but
> cannot find them.
>
> I will appreciate any help to remove these dialers. Any other spyware
> remover that can remove these. I also have spyware blaster installed.
>
> Thanks
> Mian
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks PCR. When I check the registry using regedit the first line in Run is

(Default) (value not set)

I do not see " " marks or blank anywhere.
Mian

"PCR" <pcrrcp@netzero.net> wrote in message
news8gSk3AhFHA.3568@TK2MSFTNGP10.phx.gbl...
> | HKEY Local_Machine\default\software\microsoft\windows\current
> version\run\"
>
> You mean this key...?...
>
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
>
> Go to it in RegEdit, &...
>
> This could be a problem with the "(Default)" line at one of the
> Startup registry keys. They should all look like this...
>
> (Default) (value not set)
>
> If it shows a blank line or just quotes in (Default), R-Clk it, & select
> "Delete". After the Delete, it will immediately come back just like
> this...
>
> (Default) (value not set)
>
> | HKEY User\default\software\microsoft\windows\current version\run\ " "
>
> You mean...?...
>
> HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
>
> Try the same there, then, unless it self-corrects after doing the first.
>
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net
> "Mian Ali" <mianali15@hotmail.com> wrote in message
> news:%23bITnj8gFHA.3316@TK2MSFTNGP14.phx.gbl...
> | Hello,
> |
> | I ran ad-aware yesterday and it found registry entries for dialer. I
> allowed
> | it to remove these entries and ran the Ad-aware again and again it
> found the
> | same entries.
> |
> | I ran Spybot Search and Destroy, it did not find any dialers.
> Everytime I
> | run Ad-Aware, it finds the same entries. The details of the entries
> are:
> |
> | HKEY User\default\software\microsoft\windows\current version\run\ " "
> |
> | HKEY Local_Machine\default\software\microsoft\windows\current
> version\run\"
> | "
> |
> | I am using Windows 98 and IE 6 sp1 and using cable network. (Not on
> dial-up)
> |
> | How do I remove these registry entries. I look for them using regedit
> but
> | cannot find them.
> |
> | I will appreciate any help to remove these dialers. Any other spyware
> | remover that can remove these. I also have spyware blaster installed.
> |
> | Thanks
> | Mian
> |
> |
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Here is the User default registry entry:
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

Her is the Local_Machine registry entry:
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

Other entries in RUN:

"ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SRS Applet"="SrsTray.Exe"
"DXM6Patch_981116"="C:\\WINDOWS\\p_981116.exe /Q:A"
"Adaptec DirectCD"="C:\\PROGRA~1\\ADAPTEC\\DIRECTCD\\DIRECTCD.EXE"
"Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"IntelliType"="\"C:\\Program Files\\Microsoft
Hardware\\Keyboard\\type32.exe\""
"SideWinderTrayV4"="C:\\PROGRA~1\\MICROS~1\\GAMECO~1\\COMMON\\SWTRAYV4.EXE"
"StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
"LVComs"="C:\\WINDOWS\\SYSTEM\\LVComS.exe"
"VetAlert"="C:\\PROGRA~1\\CA\\ETRUST~1\\ETRUST~1\\VETMSG.EXE"
"CaAvTray"="\"C:\\Program Files\\CA\\eTrust EZ Armor\\eTrust EZ
Antivirus\\CAVTray.exe\""
"CAVRID"="\"C:\\Program Files\\CA\\eTrust EZ Armor\\eTrust EZ
Antivirus\\CAVRID.exe\""
"FineReader7NewsReaderPro"="\"C:\\PROGRAM FILES\\ABBYY FINEREADER 7.0
PROFESSIONAL EDITION\\ABBYYNEWSREADER.EXE\""
"NvMediaCenter"="RUNDLL32.EXE
C:\\WINDOWS\\SYSTEM\\NvMcTray.dll,NvTaskbarInit"
"Zone Labs Client"="\"C:\\Program Files\\CA\\eTrust EZ Armor\\eTrust EZ
Firewall\\ca.exe\""

Thanks
Mian

"PCR" <pcrrcp@netzero.net> wrote in message
news:u42kRDChFHA.272@TK2MSFTNGP15.phx.gbl...
Hmm. Can you Export that key using "Registry, Export Registry file" & post
it? The other one too. Do any of the items have a blank name?


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"Mian Ali" <mianali15@hotmail.com> wrote in message
news8CdWuBhFHA.576@tk2msftngp13.phx.gbl...
| Thanks PCR. When I check the registry using regedit the first line in Run
is
|
| (Default) (value not set)
|
| I do not see " " marks or blank anywhere.
| Mian
|
| "PCR" <pcrrcp@netzero.net> wrote in message
| news8gSk3AhFHA.3568@TK2MSFTNGP10.phx.gbl...
| > | HKEY Local_Machine\default\software\microsoft\windows\current
| > version\run\"
| >
| > You mean this key...?...
| >
| > HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
| >
| > Go to it in RegEdit, &...
| >
| > This could be a problem with the "(Default)" line at one of the
| > Startup registry keys. They should all look like this...
| >
| > (Default) (value not set)
| >
| > If it shows a blank line or just quotes in (Default), R-Clk it, & select
| > "Delete". After the Delete, it will immediately come back just like
| > this...
| >
| > (Default) (value not set)
| >
| > | HKEY User\default\software\microsoft\windows\current version\run\ " "
| >
| > You mean...?...
| >
| > HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
| >
| > Try the same there, then, unless it self-corrects after doing the first.
| >
| >
| > --
| > Thanks or Good Luck,
| > There may be humor in this post, and,
| > Naturally, you will not sue,
| > should things get worse after this,
| > PCR
| > pcrrcp@netzero.net
| > "Mian Ali" <mianali15@hotmail.com> wrote in message
| > news:%23bITnj8gFHA.3316@TK2MSFTNGP14.phx.gbl...
| > | Hello,
| > |
| > | I ran ad-aware yesterday and it found registry entries for dialer. I
| > allowed
| > | it to remove these entries and ran the Ad-aware again and again it
| > found the
| > | same entries.
| > |
| > | I ran Spybot Search and Destroy, it did not find any dialers.
| > Everytime I
| > | run Ad-Aware, it finds the same entries. The details of the entries
| > are:
| > |
| > | HKEY User\default\software\microsoft\windows\current version\run\ " "
| > |
| > | HKEY Local_Machine\default\software\microsoft\windows\current
| > version\run\"
| > | "
| > |
| > | I am using Windows 98 and IE 6 sp1 and using cable network. (Not on
| > dial-up)
| > |
| > | How do I remove these registry entries. I look for them using regedit
| > but
| > | cannot find them.
| > |
| > | I will appreciate any help to remove these dialers. Any other spyware
| > | remover that can remove these. I also have spyware blaster installed.
| > |
| > | Thanks
| > | Mian
| > |
| > |
| >
| >
|
|

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

I don't see what I was looking for in there, which was a blank name. Can
it be in the corresponding "minus" key...

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-

That should also read...

(Default) (value not set)

....& any other item should have a name!


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"Mian Ali" <mianali15@hotmail.com> wrote in message
news:%239gWa3ChFHA.576@TK2MSFTNGP15.phx.gbl...
| Here is the User default registry entry:
| REGEDIT4
|
| [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
|
| Her is the Local_Machine registry entry:
| REGEDIT4
|
| [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
|
| Other entries in RUN:
|
| "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
| "TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
| "SystemTray"="SysTray.Exe"
| "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
| "SRS Applet"="SrsTray.Exe"
| "DXM6Patch_981116"="C:\\WINDOWS\\p_981116.exe /Q:A"
| "Adaptec DirectCD"="C:\\PROGRA~1\\ADAPTEC\\DIRECTCD\\DIRECTCD.EXE"
| "Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp"
| "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM\\NvCpl.dll,NvStartup"
| "nwiz"="nwiz.exe /install"
| "IntelliType"="\"C:\\Program Files\\Microsoft
| Hardware\\Keyboard\\type32.exe\""
|
"SideWinderTrayV4"="C:\\PROGRA~1\\MICROS~1\\GAMECO~1\\COMMON\\SWTRAYV4.E
XE"
| "StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
| "LVComs"="C:\\WINDOWS\\SYSTEM\\LVComS.exe"
| "VetAlert"="C:\\PROGRA~1\\CA\\ETRUST~1\\ETRUST~1\\VETMSG.EXE"
| "CaAvTray"="\"C:\\Program Files\\CA\\eTrust EZ Armor\\eTrust EZ
| Antivirus\\CAVTray.exe\""
| "CAVRID"="\"C:\\Program Files\\CA\\eTrust EZ Armor\\eTrust EZ
| Antivirus\\CAVRID.exe\""
| "FineReader7NewsReaderPro"="\"C:\\PROGRAM FILES\\ABBYY FINEREADER 7.0
| PROFESSIONAL EDITION\\ABBYYNEWSREADER.EXE\""
| "NvMediaCenter"="RUNDLL32.EXE
| C:\\WINDOWS\\SYSTEM\\NvMcTray.dll,NvTaskbarInit"
| "Zone Labs Client"="\"C:\\Program Files\\CA\\eTrust EZ Armor\\eTrust
EZ
| Firewall\\ca.exe\""
|
| Thanks
| Mian
|
| "PCR" <pcrrcp@netzero.net> wrote in message
| news:u42kRDChFHA.272@TK2MSFTNGP15.phx.gbl...
| Hmm. Can you Export that key using "Registry, Export Registry file" &
post
| it? The other one too. Do any of the items have a blank name?
|
|
| --
| Thanks or Good Luck,
| There may be humor in this post, and,
| Naturally, you will not sue,
| should things get worse after this,
| PCR
| pcrrcp@netzero.net
| "Mian Ali" <mianali15@hotmail.com> wrote in message
| news8CdWuBhFHA.576@tk2msftngp13.phx.gbl...
| | Thanks PCR. When I check the registry using regedit the first line
in Run
| is
| |
| | (Default) (value not set)
| |
| | I do not see " " marks or blank anywhere.
| | Mian
| |
| | "PCR" <pcrrcp@netzero.net> wrote in message
| | news8gSk3AhFHA.3568@TK2MSFTNGP10.phx.gbl...
| | > | HKEY Local_Machine\default\software\microsoft\windows\current
| | > version\run\"
| | >
| | > You mean this key...?...
| | >
| | > HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
| | >
| | > Go to it in RegEdit, &...
| | >
| | > This could be a problem with the "(Default)" line at one of the
| | > Startup registry keys. They should all look like this...
| | >
| | > (Default) (value not set)
| | >
| | > If it shows a blank line or just quotes in (Default), R-Clk it, &
select
| | > "Delete". After the Delete, it will immediately come back just
like
| | > this...
| | >
| | > (Default) (value not set)
| | >
| | > | HKEY User\default\software\microsoft\windows\current
version\run\ " "
| | >
| | > You mean...?...
| | >
| | > HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
| | >
| | > Try the same there, then, unless it self-corrects after doing the
first.
| | >
| | >
| | > --
| | > Thanks or Good Luck,
| | > There may be humor in this post, and,
| | > Naturally, you will not sue,
| | > should things get worse after this,
| | > PCR
| | > pcrrcp@netzero.net
| | > "Mian Ali" <mianali15@hotmail.com> wrote in message
| | > news:%23bITnj8gFHA.3316@TK2MSFTNGP14.phx.gbl...
| | > | Hello,
| | > |
| | > | I ran ad-aware yesterday and it found registry entries for
dialer. I
| | > allowed
| | > | it to remove these entries and ran the Ad-aware again and again
it
| | > found the
| | > | same entries.
| | > |
| | > | I ran Spybot Search and Destroy, it did not find any dialers.
| | > Everytime I
| | > | run Ad-Aware, it finds the same entries. The details of the
entries
| | > are:
| | > |
| | > | HKEY User\default\software\microsoft\windows\current
version\run\ " "
| | > |
| | > | HKEY Local_Machine\default\software\microsoft\windows\current
| | > version\run\"
| | > | "
| | > |
| | > | I am using Windows 98 and IE 6 sp1 and using cable network. (Not
on
| | > dial-up)
| | > |
| | > | How do I remove these registry entries. I look for them using
regedit
| | > but
| | > | cannot find them.
| | > |
| | > | I will appreciate any help to remove these dialers. Any other
spyware
| | > | remover that can remove these. I also have spyware blaster
installed.
| | > |
| | > | Thanks
| | > | Mian
| | > |
| | > |
| | >
| | >
| |
| |
|
|

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Thanks Ben for the information. Hopefully it is a flase alarm. I also have
latest definition (ie. July 7, like other who are detecting these dialers)
and that's when these two entries showed up. I will wait till new definition
and then run it again.

Also thank PA Bear and PCR for your responses.
Mian


"Ben Myers" <benjmyers@mindR-E-M-O-V-Espring.com> wrote in message
news:ux5CEWFhFHA.2572@TK2MSFTNGP10.phx.gbl...
It may be a false alarm. See
http://www.broadbandreports.com/fo [...] ~mode=flat

Ben

"Mian Ali" <mianali15@hotmail.com> wrote in message
newsv1y8qBhFHA.2632@TK2MSFTNGP09.phx.gbl...
> Thanks Ben. Here is part of the log file between lines:
>
> ---------------------------------------------------------------------
>
> Ad-Aware SE Build 1.06r1
> Logfile Created on:Friday, July 08, 2005 10:00:25 AM
> Created with Ad-Aware SE Personal, free for private use.
> Using definitions file:SE1R53 07.07.2005
> .
> .
> Memory scan result:
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
> New critical objects: 0
> Objects found so far: 0
>
>
> Started registry scan
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
>
> Dialer Object Recognized!
> Type : RegValue
> Data : Wildflics
> TAC Rating : 5
> Category : Dialer
> Comment : ""
> Rootkey : HKEY_USERS
> Object :
> .DEFAULT\software\microsoft\windows\currentversion\run
> Value :
>
> Dialer Object Recognized!
> Type : RegValue
> Data : Wildflics
> TAC Rating : 5
> Category : Dialer
> Comment : ""
> Rootkey : HKEY_LOCAL_MACHINE
> Object : software\microsoft\windows\currentversion\run
> Value :
>
> Registry Scan result:
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
> New critical objects: 2
> Objects found so far: 2
>
>
> Started deep registry scan
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
>
> Deep registry scan result:
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
> New critical objects: 0
> Objects found so far: 2
>
>
> Started Tracking Cookie scan
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
>
>
> Tracking cookie scan result:
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
> New critical objects: 0
> Objects found so far: 2
>
>
>
> Deep scanning and examining files...
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
>
> Disk Scan Result for C:\WINDOWS
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
> New critical objects: 0
> Objects found so far: 2
>
> Disk Scan Result for C:\WINDOWS\SYSTEM
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
> New critical objects: 0
> Objects found so far: 2
>
> Disk Scan Result for C:\WINDOWS\TEMP\
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
> New critical objects: 0
> Objects found so far: 2
>
>
> Scanning Hosts file......
> Hosts file location:"C:\WINDOWS\hosts".
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»
>
> Hosts file scan result:
> »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
> 7275 entries scanned.
> New critical objects:0
> Objects found so far: 2
>
>
> ------------------------------------------
> Log file is a long one.
> Thanks.
> Mian
>
>
> "Ben Myers" <benjmyers@mindR-E-M-O-V-Espring.com> wrote in message
> newsG7hAR9gFHA.3940@tk2msftngp13.phx.gbl...
> If you are using AdAware version 6, see if you have a
> "C:\Program Files\Lavasoft\Ad-aware 6\Logs" folder. If
> so, please repost with the contents of the most recent log.
>
> Ben
>
> "Mian Ali" <mianali15@hotmail.com> wrote in message
> news:#bITnj8gFHA.3316@TK2MSFTNGP14.phx.gbl...
> > Hello,
> >
> > I ran ad-aware yesterday and it found registry entries for dialer. I
> allowed
> > it to remove these entries and ran the Ad-aware again and again it found
> the
> > same entries.
> >
> > I ran Spybot Search and Destroy, it did not find any dialers. Everytime
I
> > run Ad-Aware, it finds the same entries. The details of the entries are:
> >
> > HKEY User\default\software\microsoft\windows\current version\run\ " "
> >
> > HKEY Local_Machine\default\software\microsoft\windows\current
> version\run\"
> > "
> >
> > I am using Windows 98 and IE 6 sp1 and using cable network. (Not on
> dial-up)
> >
> > How do I remove these registry entries. I look for them using regedit
but
> > cannot find them.
> >
> > I will appreciate any help to remove these dialers. Any other spyware
> > remover that can remove these. I also have spyware blaster installed.
> >
> > Thanks
> > Mian
> >
> >
>
>

Archived from groups: microsoft.public.win98.gen_discussion (More info?)

Just to let you know that it was a false alarm. Ad-Aware has released new
definition with the same date i.e., SE1R53 07.07.2005 but with problem
fixed. I ran Ad-Aware with updated definition and it did not detect any
dialer.
Mian

"PCR" <pcrrcp@netzero.net> wrote in message
newseEoCRLhFHA.572@TK2MSFTNGP15.phx.gbl...
> You are welcome. Doesn't seem to be what I thought. I hope it's a false
> alarm as Myers suggests. OK, bye.
>
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net
> "Mian Ali" <mianali15@hotmail.com> wrote in message
> news:%23%23HfXIIhFHA.3312@TK2MSFTNGP10.phx.gbl...
> | Thanks Ben for the information. Hopefully it is a flase alarm. I also
> have
> | latest definition (ie. July 7, like other who are detecting these
> dialers)
> | and that's when these two entries showed up. I will wait till new
> definition
> | and then run it again.
> |
> | Also thank PA Bear and PCR for your responses.
> | Mian
> |
> |
> | "Ben Myers" <benjmyers@mindR-E-M-O-V-Espring.com> wrote in message
> | news:ux5CEWFhFHA.2572@TK2MSFTNGP10.phx.gbl...
> | It may be a false alarm. See
> |
>
http://www.broadbandreports.com/fo [...] ~mode=flat
> |
> | Ben
> ...snip
>
>