Hi,

My PC just recently downloaded a small program. It's an Italian program, and when it installed itself, it was nowhere to be found, so I thought it deleted itself.

I was wrong. Today, I started getting small popups about dialer.exe, and with Italian description saying the program would be terminated. I checked my processes, and I found small things called Win**.tmp.exe, with on the **s, several numbers and symbols. I also checked my temp-folder, and I found the Win**.tmp.exe files there, with globes as icons. Now, I'd like to know how to get rid of this form of Spyware.


Thanks in advance.

Have you tried deleting the items you have found? Do you have Microsoft's Defender installed and have you tried using it to detect and clean the spyware?

I've tried deleting them, but other files keep coming back.
...Defender? No?
And yes, I've tried spyware romvers, to no avail. They're really bugging me, and I've got a feeling this problem could get a lot worse.

Thanks for posting your fix!

Sorry, go to strike_kin post as it shows what fixed the problem on his system.

I had the same problem I ran HJT and the file that was on line 020 eg. of mine winzlo32.dll I renamed the file to winzlo32.dll.bak for the time being.
Rebooted my computer and the win##.tmp.exe files no longer load.

Went to my Windows\Temp Dir Deleted all files with no problem.

Then I went and deleted the winzlo32.dll.bak from System32 dir.

This has stopped the problem so far and no other win##.tmp or win##.tmp.exe have been re-populated.

I don't know if this is a solution as it's only been 1 hour since I have done this.

However I have posted my steps in a thread I created and I'm still working with Jabuck and waiting for his response after my first HJT post.

My computer is running 100% faster now after making the above changes.

I also ran ccleaner and cleaned out all the other crap in my computer.

I then ran HJT again and on line 020 it said winzlo32.dll file missing I checked the box and hit the fix checked button.

Ran HJT again and the error on line 020 is now gone. I hope for good.

All the best.