Removing pop up porn login.

My cousin and his church both are plagued with a porn log-in icon that appears at startup. It is called "Live Show". Deleting it at startup, all references and unknowns in the registry and all registry RUN entries as well as unknown entries in the system files fails to keep it from re-appearing. It creates a folder on C drive and the pop-up reappears at each restart after each "cleaning". My cousin and the church both have AOL and Office 2k but other than that no other mutual programs. Apparently the porn thing has "modified/embedded itself" into some standard Windows or program file. Has anyone seen this or have any suggestions other than say a format and re-install??

------------------
A conclusion is the place where you got tired of thinking.

Well moke, it's starting from somewhere....but who knows where?

What I would try if I couldn't find it would be to try Startup Cop and disable this thing. You can get it here.

Hi moke:
Two thoughts. Have you looked under add/remove programs?
Secondly, under internet options and then connections tab, are there any errant entries there?

Daizy

------------------
Hope this helps.

Moke, The 2 links below may be of some help in soving the problem. http://www.cexx.org/startup.htm
http://www.spywareinfo.com/hijacked.html

Thanks for the input folks. It will take a while to make use of your ideas/suggestions as my cousin and his church are in Il. while I am in Or. I just returned from a visit and had been working on the problem off and on for three weeks while in Il.

------------------
A conclusion is the place where you got tired of thinking.

Hi Moke.. It would probably also be worth while to do a file search for any .vbs files on the HD.. They are often used to initialize these kinds of autorun/hard to delete dialers. If one is being run at startup
it may easily be missed because it could have a different name than the actual porn dialup prog.

You're probably seeing some form of the "webdialer" trojan. Some of the AV/trojan programs detect this, but I forget which. I don't think Ad-Aware does.
http://forums.techguy.org/showthread...ight=webdialer

see also...
http://forums.techguy.org/showthread...ight=webdialer

------------------
What the Dormouse said
http://forums.techguy.org

[This message has been edited by Rog (edited 05-24-2002).]

Suggestions:

Have them d/l and install SpyBotSearch&Destroy from here: http://patrick.kolla.de/software/fil...sd.preview.zip
(That's a direct d/l link to the latest beta, which is very stable - just got through testing it on my WinME and W98SE boxes).

Get HTAstop, from here: http://www.nsclean.com/htastop.html and
DSOstop2 from here: http://www.nsclean.com/freebies.html

Depending on the OS's involved, check the spywareinfo site closely, link-wise, for applicable reg hacks that may help also. HTH Pete

------------------
Compaq 7110US,1.3GHz Athlon,256MB RAM,WinMe, IE5.5,Opera6.02 build 1056.

Thanks to all for your input. It will take some time to try all the ideas out as my cousin is a novice and will need lots of coaching. Thanks again!

------------------
A conclusion is the place where you got tired of thinking.