Need help removing hidden porn from hard drive

I have a friend who picked up a porn file off the internet and can't
seem to get rid of it.

He's running win95 and everytime he boots, it places a shortcut on the desktop called "celebrity" and launches a dialog box promoting this adult site, ready to connect if you accept the terms.

I've tried everything I know to get rid of it but it keeps coming back.

1 It's not in the startup folder
2 I found a folder under a different name on the c drive containing the shortcut and associated files and deleted them, but on bootup they are back again.
3 I checked the win.ini
config.sys
autoexec.bat
Still can't find anything.
I looked at the "Load=" and "run=" lines in the win.ini file and saw nothing.
I would appreciate any help I can get.

Why take chances - Nuke the whole install.Reformat and reinstall.
Otherwise; who knows?
Check and delete the contents of C:\windows\temporary internet files
also: C:\windows\temp

Tried looking in Control Panel > Add/Remove Programs?

It may also be hiding in the registry. [Reg editing can seriously frag your OS. Do so at your own risk.[/b] You might right click on the shortcut after boot-up and select properties. Note the filename and anything else that looks relevent. Then try Start > Run > regedit. That will bring up the registry editor. Click on Edit, then Find (or Search, I forget which). Type in the filename and see what reg entries it brings up. You might delete the reg key if it finds one. Then search and delete again.

Don't know if this will work, but I'd give it a shot.

start - accessories - system tools - "system information"
then the "tools" menu and ( aarrgghh - i'm on w2000 now ) :)
it's there under tools i know it - it should be called "system config" or something like that -- it allows you to control all places that startup up stuff can hide
from config.sys thru to the registry { where it will be :) }

don't try to "run" "sysedit" though -- you'll get some ugly old dos / windows 3.1 type config that'll almost surely cause a mistake

look through that "tools" list or wait till someone with your exact same version of windows can give you the exact link

it easy with the proper utility -- you can check and uncheck each item

"god" -- may be right :) if it's well behaved :rolleyes: it may be in the add/remove software control panel

Other solutions: go to:
http://www.sysinternals.com

Get a free program called "Process Explorer".
Run it (Select to "view dlls" from View menu) it will show running processes.Find the the item in question and highlight it, and right click to view properties.Then you will see the path to the folder it came from.Then eliminate it.
Or get the program called "Regmon" there and you can see the Registry key it came from.

Otherwise you might try "Ad-aware" from:
http://tomcoyote.com/lsindex.html
It is a "spyware killer" and may detect the problem for you.

Quote:

---

Originally posted by dave-harper
start - accessories - system tools - "system information"
then the "tools" menu and ( aarrgghh - i'm on w2000 now ) :)

---

Nice one, dave. I didn't even think of that one. :rolleyes:

It's msconfig on the post-95 Windows. Start > Run > msconfig, or Start > Programs > Accessories > System Tools > System Information. Don't know if that's right for 95, though.

Go to this site and download Regcleaner:

http://www.jv16.org/

When you run it make sure you check "show all software" under "options"

Terrific program.Before you run it you may want to use the find utility to locate the executable and delete(??)Hmm, I think...

Unfortunately, there is no msconfig in win95, though there are third party utilities that do the same. I'm going to suggest a couple of other approaches, though.

Assuming your friend is using IE5 or IE6, go to internet tools and view the settings in the temporary internet folder portion of the general tab. Then select View Objects and look at the ones last accessed on the date he he restarted the system. If one of the objects is recognizable as being involved, uninstall it. If not sure about some of the objects, rightclick and examine their properties.

Another place to check is display properties, assuming your friend is using Active Desktop. Look on the web tab and see if anything is checked. Uncheck.

It is possible that a installer (or trojan) installed a fille that looks around for the folder and files that you keep deleting and rebuilds them during windows startup process, assuming you are deleting them and removing them from the recycle bin before restarting. (Should be trying to delete while in Safe Mode, for that matter).

You'll have to be a little more specific about the folder name and the files you've been deleting if you need to pursue this further.

And on the eighth day God said, "OK Murphy, you take over."

a number of these things are called "dialer.exe" -- search / find for that and if you rename it dialer.EX ( drop the "e" ) it will disable it for now------then you can reboot and make sure there is no problem
check "my computer" "dial up networking" to make sure it hasn't already done something there

IF you feel comfortable in the registry-----from what you did before you should be careful enough

"start" "run" "regedit" ---------- then "edit" "find" the string "runonce" --- you can then press F3 to keep finding
in the left side you will see the sections like ( Run , RunOnce , RunOnceEx , and i'm sure RunServices and RunServicesOnce )

the one you probably want is the second occurrence ---- it is in the HKEY_LOCAL_MACHINE section and then go up a bit to the "RUN" part

You should see about half a dozen references to little utilities that usually show up as system tray icons near the clock

write down the directory paths and the filenames that are on the RIGHT hand side
Never modify or delete anything on the left side window unless you like to re-install windows [or you graduate from regedit school :) ]

search / find on the hard drive for the most suspicious ones and you should be able to seperate the one you're looking for from the proper utilities that were there before.

Remember to think twice act once because this is the guts of windows

Do you have everything you might need if the hard drive had to be reformated ---- one of the latest viruses ---- it's the only way to eliminate it ---- as the scouts say ---- be prepared :)

You can always cut twice and patch together...;)

now now we have to be nice to this ( i think ) yankee because they took a whoopin today

http://www.thinkquest.org/images/fla...all/canada.gif

You can download msconfig.exe and run it on Win 95.
http://www.techadvice.com/specs/files_dl.asp?fnid=174

Look in your favorites folder. Also try the control panel>internet settings>homepage. Just a thought. Good luck JIFFYPROGASM

you didn't give the exact key for regedit.

it is in Win98 and win95

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]

Registy editting is easy enough, just make sure you export the whole thing, or use the scanreg facility in win98 (now thats a lot of help you your freind using Win95)

The question must be asked, where did your "freind" get the file :D but then again, who are we to judge :D

stefan

dave harper

What was it, 5-2?LOL

:D

what no mention of the last time - 50 years ago :rolleyes:
i hope we at least got a lot of silver and bronze in the intervening half century :)
well the fifth one was on an empty net i'm sure

thanks jdt -- it is the one i remember that has pages for all the startup -- from config thru to the registry and allows you to check/uncheck ?

Doc -- on w2000 here if i "find" ( run ) it takes 237 F3's before i get to the right section.

Accessing the registry and removing the key that is causing the problem wil probably solve the boot issue; apart from this, my advice is to get a good erasing app like Eraser and erase the d**n dialer from your PC. If it has created a dial-up connection in your PC, remove it too and check your other connections to see if their phone numbers remain unchanged.

**Edited for language - Imperion1**

I'm completely overwhelmed by all the response. I'm pretty hopeful one of these solutions will work.

I won't see my friend again until sat so I'll report back then.
Thanks for all the help.

This whole thing kinda sounds like a virus to me. Have you ran a virus checker thingy?

Hrm - so which site was your "friend" surfing?

;)

If you find a registry entry for this "Porn" file, after you remove it, Will probably be in RUN or RUNONCE, search for the executable file it calls and delete it!

goto www.lavasoftusa.com
download Ad-aware, install.. and your problem should disappear

Good news!!
I downloaded a free utility called Startup Manager from
www.answersthatwork.com , which is basically a third party msconfig but more userfriendly, if thats possibly.
It displays everything that loads at startup with the option to disable, enable or delete.

Foutunatey there were only about 15 lines in the file and the first one I disabled solved the problem. When I was absolutely sure I had the correct file I deleted it.

FYI
The registry entry load a file called "cams.exe" located on drive c.
Cams then creates another folder called showtime containing "dialer.exe" and some other files and then launched it.

Thanks for all the help.

Please forgive our rudeness here mykeowl.......

WELCOME to SYSOPT!!


Guys let's have a little courtesy for our new friends, who knows one day YOU might need them!?!;)