Coulomb Dialer keeps coming back

Hi everyone. Got another mystery: Coulomb Dialer (porn dialer) keeps resurrecting in my system. I got rid of it two days ago with Adaware, it was installed in PeoplePC (which we haven't used since January) as "atlbrowser". I ran Adaware again last night (keep in mind that there hasn't been any suspect activity on the internet in between scans, except my son plays free on-line games which I monitor closely) and Adaware found Coulomb Dialer again in System Volume Information/RP32/A0005902.exe
I have tried to access it this time instead of just removing it so that I can eliminate the source if possible.
Any ideas?

Hi Jennifer,

When it comes to diallers, A-Squared is my tool of choice. You need to download it, update it thenreboot into safe mode and run it.

Actually I would update all your scanners (AV and all) and run them in safe mode ;)

Here is the link: http://www.emsisoft.com/en/software/free/

Are you running a firewall?

Also get Spybot Search & Destroy. Go into "advanced" and run the "immunise" function. Be sure to update it first.....

http://www.safer-networking.org/en/index.html

Use it to scan also. Finally you should try EWIDO http://www.ewido.net/en/

It has recently been taken over by Grisoft (AVG) but I still think that the on demand scanner is still free.



:)

Turn system restore off before scanning.. The "System Volume Information" is part of the System Restore functionality.. That's also the reason why it keeps coming back..

dumb question - how do I turn system restore off?

Quote:

---

Originally posted here by jenniferaloette
dumb question - how do I turn system restore off?

---

Right click on "My Computer".. Choose "Properties".. Tab "System Restore"..

It is Windows XP?

Otherwise this is a little site I sometimes use:

http://www.pchell.com/virus/systemrestore.shtml

;)

Yep - windows XP.
One more question - how does the system restore status cause Coulomb to come back? And install it in another location?

Okay, I found the turn-off, but if I choose it, all restore points will be deleted. What if I screw something up? (very likely)

Jennifer, there really isn't anything to "screw up"

You just turn off the restore function and run your scanners..................then make a manual restore point of your clean system.

;)

AFAIK...existing restore points wont be deleted....Not with XP pro anyway.

Turning it off will free up the files...for the AV to scan.

When done scanning (which should be done in safe mode...then again in normal mode) you can turn it back on...


MLF

Thanks so much everyone!

Jennifer,

I forgot to mention, but Morgana~ was on the ball. When you are done, and have created a new, clean, restore point..................please delete all the others, as they will still have the bad stuff in them.

As for why it reappears in different places. That is part of its "stealthing"...................if it always went and did the same thing it would be far more easily blocked and detected?

To be perfectly honest with you, this pr0n thing is a bit of a mystery to me. Sure, I know how it gets fired around the internet, but who gets it and who does not is a real connundrum. I can safely say that in the last 10 years I have never had one of my machines pick any of this stuff up.

Yet I know young kids, businesses, young mothers, old ladies who have gotten it??????????????

Even my Parish Priest :D who was most embarassed.................

Good luck and let us know if you need any more help. I know it isn't the bleeding edge of security, but I have always felt that security begins at home with the family?

Thanks SO much everyone - all done.

Now, if it resurrects again, I'll be back - fair warning.

You all are wonderful!

Take Nihils advice and delete all your old restore points....and create a new one.

It maybe hiding in one

MLF

Gotcha!