Tip: Run a free scan for common Windows errors ad

re: PestPatrol/ Trojan Horse Dialer Monday, April 14, 2003 at 9:33 pm Posted by Ms. Eagle (33507 messages posted) There have been other ME users who posted that they got a message the trojan dialer was in the restore temp files. If that's the case, it's dormant, but you can delete the restore folder. No program can remove anything from your system restore folder. If your _RESTORE files are corrupted, boot from your boot diskette, and at the DOS prompt: A:\}DELTREE C:\_RESTORE This will delete all of the temp files. Then Windows ME will create a new folder and a few empty dat files. [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Monday, April 14, 2003 at 10:27 pm Posted by Mike (10 messages posted) Thanks, I'll give that a try. On Monday, April 14, 2003 at 9:33 pm, Carol wrote: > >There have been other ME users who posted that they got a message the trojan dialer >was in the restore temp files. If that's the case, it's dormant, but you can delete >the restore folder. No program can remove anything from your system restore folder. > >If your _RESTORE files are corrupted, boot from your boot diskette, and at the DOS >prompt: > >A:\}DELTREE C:\_RESTORE >This will delete all of the temp files. Then Windows ME will create a new folder >and a few empty dat files. > > > [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Tuesday, April 15, 2003 at 8:29 pm Posted by Mike (10 messages posted) Sorry, I must be doing something wrong because when I type in that command it says bad command or prompt. I'm not familiar with using DOS at all so I may need some further instructions. On Monday, April 14, 2003 at 10:27 pm, Mike wrote: >Thanks, I'll give that a try. > > [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Tuesday, April 15, 2003 at 8:32 pm Posted by Mike (10 messages posted) Sorry, I must be doing something wrong because when I type in that command it says bad command or prompt. I'm not familiar with using DOS at all so I may need some further instructions. On Monday, April 14, 2003 at 9:33 pm, Carol wrote: > >There have been other ME users who posted that they got a message the trojan dialer >was in the restore temp files. If that's the case, it's dormant, but you can delete >the restore folder. No program can remove anything from your system restore folder. > >If your _RESTORE files are corrupted, boot from your boot diskette, and at the DOS >prompt: > >A:\}DELTREE C:\_RESTORE >This will delete all of the temp files. Then Windows ME will create a new folder >and a few empty dat files. > > > [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Tuesday, April 15, 2003 at 8:48 pm Posted by Ms. Eagle (33507 messages posted) That's one nice thing about DOS, if you don't get it right, it just gives you bad command or filename. You most likely are not typing it just right. Just try again, but you need to type it exactly as shown, with the slashes going the right direction. Note the space after deltree before the C:(deltree C). It doesn't matter whether you use upper or lower case, such as at the A:\}deltree c:\_restore A:\}DELTREE C:\_RESTORE [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Tuesday, April 15, 2003 at 10:03 pm Posted by Ms. Eagle (33507 messages posted) Mike, If you still have problems with that command, you can follow MS instructions on getting rid of older restore points. This is all assuming that's where the Trojan is. Antivirus Tools Cannot Clean Infected Files in the _Restore Folder: http://support.microsoft.com/default.aspx?scid=KB;en-us;q263455 Checkpoints That You Create After September 8, 2001 Do Not Restore Your Computer: http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B290700 [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Wednesday, April 16, 2003 at 11:45 am Posted by Mike (10 messages posted) I tried all those things but they aren't doing anything. I'm still experiencing the same problems. This leads me to believe that the virus is not in the restore files. Is there anything else I can try? On Tuesday, April 15, 2003 at 10:03 pm, Carol wrote: > >Mike, > >If you still have problems with that command, you can follow MS instructions on getting >rid of older restore points. This is all assuming that's where the Trojan is. > >Antivirus Tools Cannot Clean Infected Files in the _Restore Folder: > >http://support.microsoft.com/default.aspx?scid=KB;en-us;q263455 > >Checkpoints That You Create After September 8, 2001 >Do Not Restore Your Computer: > >http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B290700 > > [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Wednesday, April 16, 2003 at 12:59 pm Posted by Ms. Eagle (33507 messages posted) Well, Mike, in my first response, you'll notice that I said others had a "message" that it was in their restore files. You've not said anything about how you know you have this trojan or given any info. on messages you've gotten. Run an online virus scan. Other than that, I've no idea what to suggest. All you've told me is you have a trojan you can't get rid of. Panda Active Scan Trend Micro Housecall [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Friday, April 18, 2003 at 10:46 am Posted by Mike (10 messages posted) Okay then, sorry for my vagueness on the topic. Like I said I don't have much info on this subject, but here is what I do know: Alright well about two weeks ago I started up my computer like I normally do, but instead of my normal background, the "Restore Active Desktop" screen came up as if I hadn't properly shut down my computer last time, even though I did. When I clicked on the button my computer froze. I restarted the computer and the same thing happened. ScanDisk wasn't detecting anything. I didn't have any AV software on my computer at the time, so I downloaded one called AVG. It detected a virus but couldn't remove it. It did not have any information on this either. I downloaded another AV and this one detected it but couldn't remove it either. The only information it had was that it was a "Trojan Dialer Virus." I tried a few online virus scanners, but none detected it. I used my AVG again and located the infected files. I deleted the files, but I still have the same symptoms that I had before. These symptoms include: when I try to run internet explorer my system freezes; if I try to click on a folder or anything on my desktop it freezes; if I try to move an icon on my desktop or delete one my computer freezes; at random times whatever program I am running will stop responding. I can still use some things such as AOL, AIM, and Kazaa. Now that I deleted the two infected files(which were located in the Recovery folder of Spybot) none of the AVs detect it, even though I still have the same problems. If there is any other information that could help, ask me. Can you think of any reason why I still am having problems even though I deleted the files? [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Saturday, April 19, 2003 at 8:48 pm Posted by Mike (10 messages posted) Any suggestions?? On Friday, April 18, 2003 at 10:46 am, Mike wrote: >Okay then, sorry for my vagueness on the topic. Like I said I don't have much info >on this subject, but here is what I do know: > > > Alright well about two weeks ago I started up my computer like I normally do, but >instead of my normal background, the "Restore Active Desktop" screen came up as if >I hadn't properly shut down my computer last time, even though I did. When I clicked >on the button my computer froze. I restarted the computer and the same thing happened. >ScanDisk wasn't detecting anything. I didn't have any AV software on my computer >at the time, so I downloaded one called AVG. It detected a virus but couldn't remove >it. It did not have any information on this either. I downloaded another AV and this >one detected it but couldn't remove it either. The only information it had was that >it was a "Trojan Dialer Virus." I tried a few online virus scanners, but none detected >it. I used my AVG again and located the infected files. I deleted the files, but >I still have the same symptoms that I had before. These symptoms include: when I >try to run internet explorer my system freezes; if I try to click on a folder or >anything on my desktop it freezes; if I try to move an icon on my desktop or delete >one my computer freezes; at random times whatever program I am running will stop >responding. I can still use some things such as AOL, AIM, and Kazaa. > >Now that I deleted the two infected files(which were located in the Recovery folder >of Spybot) none of the AVs detect it, even though I still have the same problems. > > If there is any other information that could help, ask me. > > Can you think of any reason why I still am having problems even though I deleted >the files? [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Thursday, June 26, 2003 at 7:51 am Posted by Jose Vainstein (1 messages posted) Ok. following your instructions I got rid of the infected files and the _restore folder. Now, I CANNOT USE SYSTEM RESTORE. Please tell me, how can I crate the _restore folder? On Tuesday, April 15, 2003 at 8:48 pm, Carol wrote: > >That's one nice thing about DOS, if you don't get it right, it just gives you bad >command or filename. You most likely are not typing it just right. Just try again, >but you need to type it exactly as shown, with the slashes going the right direction. > >Note the space after deltree before the C:(deltree C). It doesn't matter whether >you use upper or lower case, such as at the A:\}deltree c:\_restore > >A:\}DELTREE C:\_RESTORE > > > > > [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Friday, July 18, 2003 at 7:57 pm Posted by Mr.T (1 messages posted) I was thinking the same thing that there might be a virus in the _restore folder of my computer but then I relized that I could not edit the folder because it is protected and when I scanned it it would seem like an eturnity for it to get passed that folder but.besides that I have kazaa and I think I downloaded a virus cause my computer crashed and lots of important files were deleted I found a hoax virus but I know that did not cause that much damage, now I need to find a way to get sound blaster and directx to work I try to reinstall them but there still useless blah blah blah can someone help me out? p.s. I got my computer out of safe mode but I can't play games and I have no sound. [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Sunday, August 17, 2003 at 3:05 pm Posted by Don (1 messages posted) Yup, I've got exactly the same problem. It's in C:\_restore\temp and I can't get rid of it. On Friday, July 18, 2003 at 7:57 pm, Mr.T wrote: >I was thinking the same thing that there might be a virus in the _restore folder >of my computer but then I relized that I could not edit the folder because it is >protected and when I scanned it it would seem like an eturnity for it to get passed >that folder but.besides that I have kazaa and I think I downloaded a virus cause >my computer crashed and lots of important files were deleted I found a hoax virus >but I know that did not cause that much damage, now I need to find a way to get sound >blaster and directx to work I try to reinstall them but there still useless blah >blah blah can someone help me out? p.s. I got my computer out of safe mode but I >can't play games and I have no sound. [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Friday, August 22, 2003 at 6:03 am Posted by Jenn (1 messages posted) I have followed all your instructions to get rid of the Tojan Horse, and it got rid of most my infected files but there is still one infected is there something else I can try. [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Sunday, August 24, 2003 at 3:38 pm Posted by Fred Weckwarth (1 messages posted) I have a few question.1 Do you know what the folder -Restore does? 2 Does not DELTREE delete the whole folder? 3 What does the "{" do and isn't there another bracket required? On Tuesday, April 15, 2003 at 8:29 pm, Mike wrote: >Sorry, I must be doing something wrong because when I type in that command it says >bad command or prompt. I'm not familiar with using DOS at all so I may need some >further instructions. > > [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Monday, August 25, 2003 at 9:42 am Posted by Gillian (1 messages posted) I have just read you message and would like to know if I do this will I lose everything on my compuer? I look forward to hearing from you to get rid of this nasty pest. Many thanks Gillian On Monday, April 14, 2003 at 9:33 pm, Carol wrote: > >There have been other ME users who posted that they got a message the trojan dialer >was in the restore temp files. If that's the case, it's dormant, but you can delete >the restore folder. No program can remove anything from your system restore folder. > >If your _RESTORE files are corrupted, boot from your boot diskette, and at the DOS >prompt: > >A:\}DELTREE C:\_RESTORE >This will delete all of the temp files. Then Windows ME will create a new folder >and a few empty dat files. > > > [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Monday, August 25, 2003 at 5:34 pm Posted by Ms. Eagle (33507 messages posted) No, you won't lose everything. It'll just clear out your ME System Restore volume. Keep in mind, that deltree is a very powerful command, so type that line as shown in my post. In other words, anything typed after the word deltree will be permanently deleted. [Reply or follow-up to this message] re: PestPatrol/ Trojan Horse Dialer Tuesday, August 26, 2003 at 8:07 pm Posted by Steve (1 messages posted) Thank You sooooo much for the info in the web pages Now I understand... Thanks again.... Steve On Tuesday, April 15, 2003 at 10:03 pm, Carol wrote: > >Mike, > >If you still have problems with that command, you can follow MS instructions on getting >rid of older restore points. This is all assuming that's where the Trojan is. > >Antivirus Tools Cannot Clean Infected Files in the _Restore Folder: > >http://support.microsoft.com/default.aspx?scid=KB;en-us;q263455 > >Checkpoints That You Create After September 8, 2001 >Do Not Restore Your Computer: > >http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B290700 > > [Reply or follow-up to this message] You're very welcome Thursday, August 28, 2003 at 1:35 am Posted by Ms. Eagle (33507 messages posted) I'm glad it was of help and thanks for posting! Carol [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows Me Discussion Forum