What are ldr.exe, dl11.exe and hooks.dll ?
When I use internet explorer on my NT 2000 O/S PC, a dos window pops up running ldr. exe. Three files appear on C:\, ldr. exe, hooks. dll and dl11. exe, and a process starts 124794. dlr. Both 124794.
When I use internet explorer on my NT 2000 O/S PC, a dos window pops up running ldr.exe. Three files appear on C:\, ldr.exe, hooks.dll and dl11.exe, and a process starts 124794.dlr. Both 124794.dlr and dl11.exe try to access the internet. I can kill the process and remove the files a dozen time each day, whenever I use IE, they reappear. I've searched my registry for reference to each of these items but found nothing. I have Symantec 8.X running with the latest virus defs, but a scan finds nothing. I have blocked these items access to the internet with Zone Labs, but I want to be rid of them completely.
Help ;(
Help ;(
Participate on our website and join the conversation
This topic is archived. New comments cannot be posted and votes cannot be cast.
Responses to this topic
Its a Trojan Dialer program.
See this thread on removing it:
http://computercops.biz/postp340623.html
See this thread on removing it:
http://computercops.biz/postp340623.html
I just got rid of that bugger. Close internet explorer. Bring up the Task Manager and kill the process 124794.dlr (if it is there), then remove three files from C:\ hooks.dll, ldr.exe and dl11.exe.
Then edit the registry, do a search for websiteviewer, you should find an entry HKEY_CURRENT_USER/software/websiteviewer/
Delete the websiteviewer entry.
Then go to C:\Program Files\websiteviewer\ and delete the entire directory (4 files, 124794.dd, 124794.dlr, 124794.exe and 124794.ico).
Then edit the registry, do a search for websiteviewer, you should find an entry HKEY_CURRENT_USER/software/websiteviewer/
Delete the websiteviewer entry.
Then go to C:\Program Files\websiteviewer\ and delete the entire directory (4 files, 124794.dd, 124794.dlr, 124794.exe and 124794.ico).
