HELP! WebSiteViewer dialer virus screwed up my puter!

Question

shalloys 0 Newbie Poster

22 Years Ago

i was surfing the net and my connection cut out, my modem started beeping and then i couldnt reconnect. I realised a dialer had kicked in and unplugged my modem. It left like a folder in program files called "WebSiteViewer" which i had to delete from dos. Im pretty computer illeterate and my computer has lots of spyware on it. The main problem is i wanna get rid of it all, or as much as possible. All the registry keys i consider suss all recreate themselves everytime i delete them (such as the web home page). this is my hijack this log:
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.EXE
C:\WINDOWS\REG33.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\EZULA\MMOD.EXE
C:\PROGRAM FILES\COMMON FILES\GMT\GMT.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACK\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.html
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [CMESys] "C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.EXE"
O4 - HKLM\..\Run: [Reg32] C:\WINDOWS\reg33.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -

Now i tried deleting somne of these (the C:\WINDOWS\secure.html ones) and they recreate themselves. so which ones should i remove from here which are bad and also how do i keep them deleted. also how can i get rid of all my spyware and stop dialers and that???
Your help would be great, i hope you feel pity towards your lesser mind computer friend and assist me!

cybersecurity virus-malware

2 Contributors
1 Reply
189 Views
8 Hours Discussion Span
Latest Post 22 Years Ago Latest Post by TallCool1

Dani AI

Generated 6 Months Ago

This is a classic dialer/persistence case. reported the modem being taken over, a leftover program folder and a homepage/registry value that keeps reappearing. ’s suggestion to run an up-to-date anti-spyware scan and to block future ActiveX installs is a good starting point, but persistence means more than one pass with a scanner is usually required.

Immediate, prioritized steps (safe order):

Physically disconnect the modem/phone line to avoid tolls and stop further dialing. Work offline while cleaning.
From a known-clean computer, download removal tools to removable media. Do not transfer unknown executables from the infected machine.
Boot the infected PC into Safe Mode (press F8 at startup) so fewer malicious components run. Run a full antivirus scan, then an up-to-date anti-spyware scan, then a second-opinion scanner.
Use startup/process utilities (Autoruns/Process Explorer or similar) to find what is recreating settings: examine Run/RunOnce entries, Scheduled Tasks, Services and browser helper objects. Export or back up the registry before changing anything.
Check the hosts file and Scheduled Tasks; some dialers use tiny helper processes to rewrite homepage/registry at boot. Disable suspected startup items, reboot, and observe which setting returns.

Cleanup and follow-up:

After apparent cleanup, change all online passwords from a clean machine and check phone/ISP bills for strange charges. Clear or disable System Restore during cleaning (restore points can hide infected files) and then re-enable it after a clean baseline.
If the infection keeps returning or the system is unstable, back up personal data only (documents, photos) — do not back up program files — then perform a clean OS reinstall. This is often the fastest sure fix.

Caution: edit the registry and delete startup items only after backing up. If uncertain about any entry, seek someone experienced rather than removing critical system components.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

TallCool1 81 Practically a Posting Shark Team Colleague · Answer 1 · 2004-04-03T20:53:29+00:00

I was surfing the net and my connection cut out, my modem started beeping and then I could'nt reconnect. I realised a dialer had kicked in and unplugged my modem. It left like a folder in program files called "WebSiteViewer" which i had to delete from dos. Im pretty computer illiterate and my computer has lots of spyware on it. The main problem is I wanna get rid of it all, or as much as possible. All the registry keys i consider suss all recreate themselves everytime I delete them (such as the web home page).

First I would download and run . Make sure that you follow the directions for updating the data file before running the program. It will automatically remove the eZula and Gator crap on your system. Re-run HijackThis, then delete what remains of the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.html

O4 - HKLM\..\Run: [CMESys] "C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.EXE"

O4 - HKLM\..\Run: [Reg32] C:\WINDOWS\reg33.exe
This is what keeps reinstalling the weblinks.

O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe

O4 - Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe

These 4 aren't really nasty, just totally worthless resource hogs:

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
Not needed anymore. Never useful to begin with.

O4 - HKLM\..\Run: [LoadQM] loadqm.exe
Microsoft "trickleware" background downloader.

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
No need for this. Can also be disabled from within WinAmp. By the way, make sure that you have the newest version 5.03

O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
Useless.

Once you are all cleaned up, download and install SpywareBlaster, a utility that blocks malware installation via ActiveX--the main vector that makes Internet Explorer so much more vunerable than Mozilla.