Ted Posted January 10, 2004 Share Posted January 10, 2004 I have a new Dell. I went to a Battlefront Mirror site to download the patches for CMBB. I must've clicked on a pop-up window and now I get this blasted web-based golden casino program open and running whenever I start my computer. I've deleted the casino foler. Searched and deleted anyhting with the word casino or golden in it. I've ran regedit and deleted the H_Key and deleted anything with casino in it. BUT IT KEEPS COMING BACK! I was so desperate I've emailed this Golden Casino place and asked how to remove this program but I figure all I'll get is an increase in spam now that they have my email address. I can't find anything "casino" in any of my start folders but I look at a setuplog and I have this: *** Installation Started 01/10/04 08:43:36 *** Product Name: Golden Palace Casino NEW Added Registry Entry Root Key = HKEY_LOCAL_MACHINE Key = Software\Golden Palace Casino PT Added Registry Entry Root Key = HKEY_LOCAL_MACHINE Key = Software\Golden Palace Casino PT Name = mdart Value = advertisercode Added Registry Entry Root Key = HKEY_LOCAL_MACHINE Key = Software\Golden Palace Casino PT Name = sinstaller Value = profile Created Directory: c:\casino Created Directory: c:\casino\Golden Palace Casino Copied File: c:\casino\Golden Palace Casino\blocker.exe Copied File: c:\casino\Golden Palace Casino\casino.exe Copied File: c:\casino\Golden Palace Casino\casino.hlp Copied File: c:\casino\Golden Palace Casino\directsounddriver.dll Copied File: c:\casino\Golden Palace Casino\fileinfo.dat Copied File: c:\casino\Golden Palace Casino\gdigraphdriver.dll Copied File: c:\casino\Golden Palace Casino\replacer.exe Copied File: c:\casino\Golden Palace Casino\wavesounddriver.dll Is there anything I can do short of reformatting my hard drive? Thanks for your help in this off topic situation. 0 Quote Link to comment Share on other sites More sharing options...
mike8g Posted January 10, 2004 Share Posted January 10, 2004 Try out Spybot S&D ! This nice tool detects and removes any spyware, dialers etc. from your system. It's shareware and you can get it here: http://www.safer-networking.org/ Marcus [ January 11, 2004, 06:38 AM: Message edited by: mike8g ] 0 Quote Link to comment Share on other sites More sharing options...
Ted Posted January 10, 2004 Author Share Posted January 10, 2004 OK I'll give it a try. I've been using ad-ware and running that. I'm not sure if it's the same thing or not. 0 Quote Link to comment Share on other sites More sharing options...
brooktrout Posted January 11, 2004 Share Posted January 11, 2004 Could this be it: http://www.pestpatrol.com/pestinfo/c/casinoxosetup.asp Maybe the setup program that is running on startup has the hidden attribute set? Do you have "show hidden files and folders" set in your folder view options? Do you have anything in your startup folder that is suspicious or possibly this thing has setup a scheduled task to run at system startup. Go into control panel\scheduled tasks and check if that is the source. 0 Quote Link to comment Share on other sites More sharing options...
Ted Posted January 11, 2004 Author Share Posted January 11, 2004 I ran the spybot and deleted everything they suggested. I checked out the pestpatrol website and it doesn't seem to be the the casinoxo trojan. But, the bloody casino hasn't started on my machine since running the spybot so, fingers crossed, maybe it's gone. Thanks for your help in this. Ted 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.