I got a dialer on here the other day. Norton detected it after it was already on my computer. It is called Dialer.OneOnOne. I went to Symantec's site and printed out the instructions for deleting the file. It says to go into safe mode to delete all files with that name, but even in safe mode, it will not delete. I cannot find a forum at symantec to ask WHY I can't delete this stupid dialer. The only support option I can find it is to call them and pay $29.95 for help. I just paid $40 for this Norton 2004 and cannot get tech assistance? This makes me mad. I hope someone here can help tell me how to delete this file. Anyone had this problem? Please any help would be greatly appreciated. I don't want to wind up with a $1000 phone bill.

Dianna

Go and download both Spybot Search and Destory and Ad-Aware. Once that is done, update both of them and run a scan. NAV 2004 will detect some spyware/dialers, etc but does a poor job of cleaning them. Spybot or Ad-Aware should be able to take care of the problem.

Also, Symantec has been charging for their support for a long time. You pay 40bucks for the software but that is it. Symantec would go broke if they offered free virus removal support.

KTTD

No, I will not fix your computer

How did Norton report the file, in use or protectected? If it is in use can you see it running in the task manager, and can you terminate it while you are in the safe mode? If it is protected did you turn off system restore and then restart the computer and the use Norton to detect/clean/reapair the file. After the system is clean you can turn system restore back on.

Kevin, I installed AdAware last night and it did not pick it up. I have tried syybot before and cannot figure out how to operate it. Duh.....I be computer stupid on stuff like that sometimes.

How can I tell if it is running in the taskbar?

Dianna

You use the ctrl/alt/delete keys at the same time to open it. Spybot and Adaware needs to be updated right agter you install them. Sometimes you have to select a different download mirror(I use EON Australia) it is the selection right next to check fot updates button at the top of the screen. To run Spybot select check for problems and it will scan just like Adaware, with sometimes a few hang ups to do large files that are being scanned, be patient! I select fix everything that Adaware/Spubot finds, but be a little cautious. Both programs keep things in th erecovery folder should you have a program that requires spyware.

hi decogsof4,
did you remove all the entries in your registry and reboot, and in your windows directory?
such as:

HKLM\..\Run: [1on1]
C:\WINDOWS\1on1.exe -n
C:\Program Files\Voyager100Test\fts.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run and look in the righthand pane for the below value
"Image"="rundll32:\\WINDOWS\\image.dll,Install"

if no joy, after all of this why don't you post your hijackthis log here so we can take a look at what you got hanging around your machine. lots of good people here to help you.
all the best,
murve

Okay, I went online and used housecall's free virus scanner, after Ad Aware didn't find anything. It found 4 infected files and called them java something or other. I clicked on them to let it clean them and it said they could not be cleaned, as they were in use. I believe that must be why Norton wouldn't delete it. I looked at the path to the files and it all went to Java Cache files. The 1on1 dialer Norton found was in Java cache, too. I went into my java console and cleared the cache. I did another system scan and it is not picking up anything now. I have not gone into the registry, as I don't think the file ever executed itself and I am not computer literate enough to try going into XP's registry right now. I did print out the instructions and it sounds like I could mess up big time by doing that. I hope this dialer is gone now.

Dianna

Here's the Uninstall URL:

Here is an URL to remove or uninstall dialer for Edvan
Solutions.
http://213.33.90.36

Go to "DOWNLOAD UNINSTALLER" and place the program on
your desktop, then double click on it to run.

Can someone help me? I have this 1on1 dialer and whatever I delete it just wont go away. I have XP

Here is my hijack log

Logfile of HijackThis v1.97.7
Scan saved at 11:33:00, on 19/04/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Ramsey01\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BTinternet
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {BECD7FB6-D67E-4104-A8AD-0DBC10251438} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXE
O4 - HKLM\..\Run: [Runner] C:\WINDOWS\svchost.exe /i
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &SearchIt Toolbar search - res://C:\Program Files\IEToolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{60A9E80F-DE7F-4D46-830F-A3AFC7409C5B}: NameServer = 194.74.65.69 194.72.9.38