Can't get rid of Program 123946.dlr/.exe and Com.exe HELP!!!

[turbostangman]

My issues were as follows......

I was parusing the web the other night doing searches and got directed to some disguised porn sites (invasive pop-ups) you know the kind.

I activated my pop-up blocker and closed all windows group, IE locked up and I had to do a manual close through the Task Manager.

I reopened IE and began browsing again. I noticed a small window that kept poppig up that said "Already Running!!!!". I closed it and then about a 1/2hr later it would pop back up. I closed it again. I found this out to be associated with the com.exe.

2hrs went by and then a window popped up "123946.dlr has encountered a problem and needs to close" I immediately recognized the ".dlr" and then closed the window. I then heard my modem dialing!!! I am on Cable so this wasn't right!!!

I reached over and unplugged my phone jack (which I keep attached for business purposes).

I then ran my Norton Prof. after uploading the live update. It found 7 viruses along with a trojan. All were either repaired or quarantined. I then ran Ad-Aware and went to bed.

I turned the monitor on and Ad-aware found 71 objects.

(Note: I run Norton and Ad-aware religiously once a week)

I opened IE and noticed my homepage was now going to this "here4search.com" I had been Hijacked!!

I was able to remove this by DLing SPybot S&D.

I went into program files and found it's main directory which is C:\programfile\web viewer In this folder was five files. 123946.exe, 123946.dlr, another .dlr file, a .ddd file and Broderbund file. I tried deleting them all but it would not allow me to delete the 123946.exe or 123946.dlr file.

I did a search and all I could find for 123946.exe was in German or something, no good!!

I then went to msconfig, boot.ini, Safe mode and rebooted.

I could then delete all the files in the C:\programfile\web viewer and the folder itself. I also deleted all shortcuts to that folder on my desktop and under program files. I then went into regedit and looked for 123946.exe and .dlr. I removed all files associated with that folder. I also did a search for just 123946 and it came up with a bunch of Binary files. I was affraid to remove those due to not knowing what they were and fear of messing something up.

I restarted my computer and my homepage problem was fixed and I thought I had the 123946.exe licked also. Then I go into my program files from the start window and the ICON IS BACK!!! I go and look under program files and it is there AGAIN!!!!

What am I missing? I ran CWShredder and AD-aware and it doesn't help because this is a program file.

I tried removing it again in safe mode and then COMPLETELY cleaning out my temporary internet folder. Didn't help. As soon as I connect to the internet about 10 minutes later it is back in my program files.

Has anyone ever dealt with this "Com.exe before? How do I get rid of that?

I also found I was infected with troj_lolaweb-c and went to symantecs site and they ahd nothing on it. I was able to find it on sophos.com and was able to remove it I beleive.

What should I do? Someone Please help!!!

[Geekgirl]

You gave it a good shot, you may still have a virus
*edit
Run Housecall


Then Download and install: HiJackThis.



Run it and post a copy of the Log File here.

Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. This is where it will save the backup files needed if there's a problem.

[turbostangman]

[Geekgirl]

Make sure you use the newset version of HJT, I gave you the link.
The only hit I got from 123946.dlr was some software called Wheres James Software. That must be wrong, I search some more.

Anyhow Run HJT and post your log for brad to look over, hes our best.

[turbostangman]

[Geekgirl]

[turbostangman]

[Geekgirl]

[turbostangman]

[turbostangman]

[Geekgirl]

Here ya go

[turbostangman]

[turbostangman]

[Geekgirl]

Dont get pissed, it takes too many muscles to frown

here


*edit
read this too

[turbostangman]