How to Remove Trojan Horse Dialer 17

Trojan Horse Dialer 17 is a malware program that uses your computer to place telephone calls. It is typically installed on a computer without the user's knowledge, being bundled with "free downloads" or as part of a program received through a peer-to-peer file-sharing program. After installation, the program starts with your system start-up and silently dials expensive, pre-programmed pay-per-minute telephone numbers once your machine has been inactive for an extended period of time, remaining connected as long as possible. This dialer typically is set to dial into adult websites. Most Trojan Horse Dialer 17 victims do not notice the dialer installation until they receive an exorbitant telephone bill.

Difficulty: Moderately Challenging

Instructions

1. Back up the Windows Registry. It contains extensive information about how your computer runs. Because removal of the virus requires extensive changes to the Windows Registry via the Registry Editor, it is important to do this prior to beginning the virus removal process.

2. Turn off System Restore while this fix is being implemented if the operating system of the infected computer is either Windows Me or Windows XP.

3. Restart the computer in safe mode and log in as an administrator. Press "F8" after the first beep occurs during start-up, before the display of the Microsoft Windows logo. Select the first option, to run Windows in "Safe Mode", from the selection menu.

4. Remove any malware files from the computer. Go to "Start," "Control Panel," then "Add/Remove Programs." Remove any programs referencing "New.Net" or "NewDotNet." If none are listed, continue to Step 5. The malware program does contain hidden files that may not be deleted as part of the software removal process. In this case, it is likely that the Trojan will reappear upon reboot. It is important to follow the outlined removal process completely to avoid recurrence of the Trojan.

5. Use the Windows Search tool to determine if "NewDotNet" exists on the hard drive. Go to "Start," "Search," "All Files and Folders." Type "NewDotNet*.*" in the "All or Part of the File Name" section. Select "All Local Hard Drives" from the "Look in:" drop down list for the best results. Click "Search." Repeat the search process for "New.Net*.*".

6. Use the Windows Task Manager to end any New.Net processes that are running. Press "Ctrl+Alt+Del" to open Task Manager. Select the "Processes" tab, select "NewDotNet.exe" and "End Process."

7. Click on "Start," "Run," type "msconfig" and press "Enter." Remove checkmarks next to any "New.Net" entries on the "Startup" tab. Save changes and exit to the desktop.

8. Click on "Start," "Run," type "regedit" and press "Enter." Press "Ctrl+F," type "newdotnet" in the search field and delete all related entries. Exit the Registry Editor.

9. Use the Windows Search tool to locate and remove all temp files associated with the virus. Go to "Start," "Search," "All Files and Folders." Type "*.tmp" in the "All or Part of the File Name" section. Select "All Local Hard Drives" from the "Look in:" drop-down list for the best results. Click "Search." Right-click on each occurrence of the file and select "Delete" from the shortcut menu.

10. Reboot the PC normally.

11. Repeat the above steps or try using a free automatic removal program, such as from Trend Micro or AVG listed in References if Trojan Horse Dialer 17 still resides on the computer. If the files have been successfully removed, System Restore may be reactivated. To turn on System Restore within Windows Me, click "Start," "Settings" and "Control Panel." Double-click on the "System" icon and select "File System" from the "Performance" tab. Left-click on the "Troubleshooting" tab and remove the check from the "Disable System Restore" box. Click "OK". To turn on System Restore within Windows XP, log in as an administrator and click "Start." Right-click on "My Computer" and select "Properties" from the shortcut menu. Check the "Turn on System Restore" option for each drive on the "System Restore" tab. Left-click "Apply" and "Yes" to confirm when prompted. Click "OK."

Tips & Warnings

• Install a reputable antivirus application on your computer system and keep updates current to prevent virus activity. Since dialer viruses function via a computer modem, disconnect your modem if you do not use it.
• Manual removal of Trojan Horse Dialer 17 may be difficult, as the removal process requires knowledge of the operating system command prompt and registry editor. In addition, different versions of this malware rename and relocate various file components. If not performed properly, your computer system might experience permanent damage. There are also similarly named programs that may legitimately use similarly named program files. Consequently, manual removal might be best for experienced users. Less experienced users might want to consider using an automatic spyware removal application, such as that offered by Trend Micro or AVG.

References

• Housecall Trend Micro
• AVG Free Virus Removal