windows explorer illegal operation

Stumped. Trying to help a friend get rid of some pop up **** that comes on as a window everytime she boots up the PC. It is some dial up service called live xxx shows and creates a folder on the C drive called ecommece. I have deleted the folder, cleaned the registry, and everytime I reboot the PC, the folder is recreated and the pop up window comes up. I tried to go into temporary Internet files to delete them, but I get an illegal operation window regarding windows explorer everytime I try to open the folder. (At times, this illegal operation in windows explorer comes up at bootup, will not close, and you can't get into windows explorer or my computer or start up menu). I have tried to to this through windows explorer and internet explorers internet options tools. Any idea how to work around this. OS is windows 95.
Thanks

 

Go download Spybot Search and Destroy version 1.1 Rel4 from this page:
http://www.lurkhere.com/~nicefiles/index.html

Before installling, read thorugh the FAQs at http://security.kolla.de/index.php?lang=en&page=knowledgebase/faq

particularly:
Are there any problems using Spybot-S&D 1.1 under Windows 95?
http://security.kolla.de/index.php?lang=en&page=knowledgebase/faq/faq011

Next go online and update the program before running the check. All items in red should be deleted!

If that doesn't help I found the following searching http://groups.google.com on (note spelling) ecommerce folder dialer which you may find helpful (note that that the latest version of Internet Explorer installable on Windows 95 is IE5.5sp2!)

=============copy/paste==========
From: Nexus (Nexus@comcast.net)
Subject: Re: Please help.
Newsgroups: microsoft.public.windowsupdate, alt.comp.virus
Date: 2002-12-01 10:25:53 PST

Hi Planz,
I tried spybot & novasoft. However they were able to find it but not able to change the registry. So I contacted the company support email that I posted in my mail and got the answer back and it worked. See below for their reply.

Hello,

LiveShows dialer software is only distributed from adult entertainment
web sites.

IF YOU HAVE RECEIVED THE SOFTWARE BECAUSE OF AN EMAIL MESSAGE OR IN A CHAT ROOM RATHER THAN VIA A DIRECT DOWNLOAD THEN IT IS VERY LIKELY THAT THE SOFTWARE HAS BEEN ILLEGALLY ALTERED TO CAUSE IT TO RE-INSTALL EVERY TIME YOUR COMPUTER RESTARTS. THE FOLLOWING PARAGRAPH IS THE ONLY REMEDY WE CAN OFFER FOR THIS SITUATION.
PLEASE SEND ANY INFORMATION YOU CAN REGARDING THE LOCATION YOU OBTAINED THE SOFTWARE FROM SO THAT WE CAN PURSUE AND PROSECUTE THOSE WHO ARE VIOLATING OUR SOFTWARE AGREEMENT. EMAIL ANY INFORMATION TO dk_tek@hotmail.com

*** ALTERED SOFTWARE ***
If the software appears to re-install on your computer every time you start it, this is because someone has illegally tampered with the software. In order to remove the software you will need to consult a person who is familiar enough with your operating system to remove the offending registry key that causes this behaviour.

The reason this has happened to you is because you are not using the
latest verson of Internet Explorer. Versions of Internet Explorer prior to version 6 have a well known security hole which allows web sites to execute
malicious code on your computer. As long as you run an older version of
Internet Explorer you will remain vulnerable to this security hole. Please go to www.microsoft.com and upgrade to the latest version of Internet Explorer.

We have recently received further information regarding the changes
that the software makes to your computer. Specifically, it adds a registry key which causes the dialer to
re-install itself every time your computer starts. If you are not familiar with the REGEDIT application please have a friend or colleague make this change.

The registry key that must be removed is:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run ->
SystemTasks
************************

Instructions for Removal of Dialer Software
===========================================

If the software is on your computer it is because you clicked 'Yes'
when you were asked if you wanted to download and install the software.

Liveshows software does not:

a) Automatically install (or re-install) on your computer.

b) Change any of your computer system (registry) settings.

c) Do anything that you are not aware of.


Un-installation is simple. You need to do only three things:

1. Click on the desktop icon (the icon the prgram created) with your right mouse button and select 'delete' from the popup menu. This will remove the desktop icon.

2. On your start menu, click on the menu item that the program created
with your right mouse button and select 'delete' from the popup menu. If you have an older version of windows
(e.g. Windows 95) you might not have the option to 'delete' from the
popup menu. If this is the case, follow the next instructions. Otherwise move on to instruction 3.

a) Click on the Start button at the bottom left hand corner of your screen.

b) Highlight the settings menu, then click on 'Task Bar & Start Menu'

c) Click on the 'Advanced' tab.

d) On the 'Advanced' tab there is a 'Advanced' button - click on it.

e) In the two-paned window, click with the right hand mouse button on
the icon the program created - you should see the icon .. it looks the same as the desktop icon you deleted earlier. Select 'delete' from the popup menu.

** IMPORTANT ** DO NOT DELETE THE ICON THAT IS TITLED 'Programs' AS THIS WILL DELETE YOUR ENTIRE PROGRAM MENU!

3. Go to 'My Computer' and double click on your C: drive. Click with the right mouse button on the folder titled 'ecommerce' and select 'Delete' from the popup menu. The dialer software is stored in this folder, so deleting c:\ecommerce will remove the program entirely from your computer.


If you have any other enquiries which are not related to uninstallation of dialer software please email dk_tek@hotmail.com.

Regards,

Dialer Support

============end c/p===========

 

Hello cjjh,

Go here http://www.spywareinfo.com/yabbse/ - register and post your problem undr Trojan/Spyware removal. The people on the board will give you the tools and step by step instructions to get rid of your malware. Your not going to be able to do this by yourself.

Regards - Charles

 

Thanks for all the information. Very Helpful in taking care of the problem and warning people to update IE to 6.X

 

Hi, and thanks for posting back.

I'm glad you got the problem taken care of. I'm curious, though. Did your friend get rid of the ecommerce dialer using Spybot SD, or some other way ?

PS: IE5.5sp2 is the most recent version of Internet Explorer that you can run in Windows95 but with it you can get the latest security updates.