1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Getting rid of Trojan Dialer 9.N

Discussion in 'Virus & Other Malware Removal' started by Nestor Keleb, Sep 9, 2004.

Thread Status:
Not open for further replies.
  1. Nestor Keleb

    Nestor Keleb Thread Starter

    May 29, 2004

    This is my first post on this web site.

    I'm running Windows XP on a 500 MHz Pentium 3. I'm using Ad-aware, Spybot S&D and Hijack This as anti-adware programs and AVG as an antivirus program.

    AVG reports that the Trojan Dialer 9.N has been found in a file called C:\windows\dstart.exe and suggests I run AVG for Windows to deal with it. When I run AVG, it finds the Trojan and recommends I stick it in the virus vault, which I do.

    And, as long as I don't connect to the internet, the Trojan Dialer 9.N doesn't resurface. But, as soon as I connect to the internet again, AVG reports that it's found Trojan Dialer 9.N in C:\windows\dstart.exe, and right away I know I'm infected again because I find a folder called "inetdata" in the Windows folder and my home page gets changed to 0WebSearch.

    I've removed this Trojan Dialer 9.N several times now using AVG, but each time it comes back as soon as I connect to the internet.

    I've tried looking for a program called dstart.exe in the Windows directory, but can't find one. Also, I'm not very computer savy and I'm not sure if I'd be deleting anything I need by deleting the dstart.exe program. AVG says it finds the Trojan in that file, but I don't know if that file was supposed to be there and the Trojan somehow got into it, or the whole file shouldn't be there in the first place.

    Any help would be very much appreciated.

    I should say I haven't updated Ad-aware, Spybot S&D or Hijack This because I don't want to connect to the internet with the computer that has the Trojan on it. I have a KVM switch, and I'm using a 100MHz first generation Pentium to access the internet now, including posting this thread.
  2. dvk01

    dvk01 Moderator Malware Specialist

    Dec 14, 2002
    First Name:
    go to http://www.thespykiller.co.uk/files/HijackThis.exe and download 'Hijack This!'.
    make sure it is placed into it's own folder, not a temporary folder. Then doubleclick the Hijackthis.exe.
    Click the "Scan" button, when the scan is finished the scan button will become "Save Log" click that and save the log.
    Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.
    It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,
    so do NOT fix anything yet.
    Someone here will be happy to help you analyze the results.
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/271932

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice