Help with "Win32:Dialer-360 [Trj]"

[Ulrik]

I just re-installed Windows Xp Home Edition complete with service pack 2 etc.

Avast detect "Win32:Dialer-360 [Trj]" and I can deleate the file. However it keep coming back and every time it come back it block my internet connection and launch some popups. If I disconnect my internet connection before startup it works fine, but as soon (within 1-3 minutes) as internet is re-connected the virus comes back.

Does anyone have a tip for me how to clean out this virus?

Thanks!

// Ulrik

[Lisandro]

However it keep coming back and every time

I can make some suggestions (hope they can help in anyway...):

1. Have you tried to delete the temporary Internet files? To do this go to Internet explorer >Tools > Internet options > Delete files > Click delete all offline content (just to be sure) > click ok. It might take some time to delete them.

2. Disable (and enable it after) System Restore: Start > Control Panel > System > System restore > Disable > Click Apply > Enable it again > Click Ok

3. Schedule a boot-time scanning: Start avast! > Right click the skin > Schedule a boot-time scanning > Select for scanning archives > Boot

[DavidR]

Do you have a dial-up connection?

What was the filename, where was it found
  example (C:\windows\system32\infected-filename.xxx)?

If you haven't already got this software, download, install, update and run it.
1. Ad-Aware
2. Spybot Search and Destroy
3. Spywareblaster

4. Download HijackThis.zip - HiJackThis Tutorial

[Ulrik]

Thank you both! I will try you suggestions asap!

I have ADSL 0.5 Mbps connection.

The file Avast keep finding is named sweden.exe and is located in either the C:/ promt or in the C:/windows/system32/config/systemprofile/.......temporary internet files/... and so on (I don't have the exact path here now).

[DavidR]

With an ADSL connection and not dial-up you are immune to the major payload of the dialer trojans, connection to premium rate telephone numbers.

The path should be in the avast virus chest if you sent it there, it should show the original path.

The boot-time scan and other options given by Technical should be a good start, followed by the other Anti-Adware/Spyware tools (all freeware), hijackthis gives a good indication of exactly what is running on your system.

[Ulrik]

Yesterday night I tested your suggestions.

Now, Avast does not not find any more viruses, and thewindows firewall stay ON all times (earlier it automatically turned OFF on OS startup!, I guess the virus have/had something to do with it).

But one big problem still remains... The internet connection only last for about 2-5 minutes after startup (or login) of Windows. After this time neither Explorer or Firefox can access internet. However, if I go to the command promt I am able to ping internet. I get no other warnings or error messages at all.

When I turn off/on the computer, or even only log out/in I can access internet for another 2-5 minutes again.

Could this still be a result of the virus or is this something completely else?

I am starting to loose hope...

Gratefull for any help you can provide me! THANKS!

// Ulrik

[Lisandro]

Ulrik, can you disable WebShield avast provider to see if you can connect after that 2-5 minutes period?
Do you use any other firewall than Windows internal one?

[DavidR]

Do you do an automatic email check-up?

I have just read something similar but this may not be your problem but worth a check 'Hand up after sending and receiving.'

This image is for OE.