-----Original Message-----
From: Roger@Dodger.Org <jolly@roger.com
Newsgroups: alt.windows98
Date: January 29, 1999 7:31 PM
Subject: Auto Dial at Powerup .. BackOriface.Trojan - Great Story

AutoDial - Finally Fixed .. A long ordeal.

After exhausting many hours of Sherlock Holmes I stumbled on the problem.

Read On:  This is a good one.

I've read articles - Windows 98 Posts and searched Microsoft to no avail.

This week my wife discovered that MS Word 97 was not reacting correctly to her
knowledge and it appeared I might have a virus similar to one running rampant
on some workstations at her place of employment.  The suggestion was to
download a 30 day trial of Norton Anti Virus V5.0 which would repair the Word
virus. Yes it did after updating to the latest Virus Definition File.  It found
many instances of W97M.Class virus within recent documents I have accessed.

The Plot Thickens: .. Along with W97M.Class .. Two instances of
Bloodhound.Excelmacro virus were detected and cleaned and a nasty
BackOriface.Trojan attached to WINDLL.DLL was also found.  Bloodhound was cured
but nothing could repair my WINDLL.DLL .. Norton could only quarantine the
file.

Now that I'm feeling better .. I try to Shut Down .. Not to happen .. Hangs
forever and Power Off is my only option.  Upon powering on .. Norton detects a
new instance of BackOriface.Trojan attached to WINDLL.DLL and this goes on and
on.

I searched AltaVista for WINDLL.DLL and the first hit was Bardon.Com and a
wonderful little BackOriface Eliminator routine.  Upon running it my machine
not only is cured of BackOriface.Trojan, it now once again Shuts Down .. and
the Point of this story .. My Auto Dial Disaster is OVER.
Dah.. BackOriface wants you do be connected to the Internet.

Thanks for all the Help and I hope my adventure points out some of the strange
results of viruses.


From earlier Help ..
I have done all of the below and more and still upon power up AutoDial occurs.

1. If you are using the Personal Web Server, disable the task MS-DTC
with MSCONFIG.EXE. If you need the DTC driver, set the internet
connection to "Connect via a LAN" in the Control Panel  Internet
Connection.
2. The IE may dial your ISP if you have set up subscriptions, which
are scheduled for an update and the PC is not on at the update time.
3. The IE may dial your ISP, if you have a shortcut to an Internet
site or the IE itself in
* the WIN.INI
* the StartUp submenu
* the Registry

keysHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
4. There is a known problem with this on systems with lexmark
printers. Read more in the Microsoft Knowledge Base
(http://support.microsoft.com/support), article "Modem Attempts to
Dial When Windows 95 Starts" (ID: Q175312) and "Dial-Up Networking
Connection Tries to Dial Automatically" (ID: Q202072). Send mail to
mshelp@microsoft.com, using "Q175312, Q202072" as the subject, to
recieve these texts via e-mail.
5. This problem also seems to occur when with certain Microsoft
software. In the Registry, search for the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE and change the value of the
subkey "EnableRemoteConnect" to "N".

--
(tm)