TROJ_DLOADER.CI creates the folder WebSpecials in the Program Files directory and adds webspec.dll to the registry startup keys.
In addition to Herk's recommendations, try the following:
Check to see if WebSpecials is listed in Add/Remove Programs in Control Panel. Is so uninstall the program from there. If its not listed, then do the following:Download and scan with Sysclean Package.
1. Create a new folder on drive "C:\" ("C:\New Folder") and rename it Sysclean
2. Place the sysclean.com inside that folder.
3. Then download the latest Virus Pattern Files [lptXXX.zip].
4. Extract the lptXXX.zip
pattern file into the same folder you created for sysclean.com.
5. Close all open applications and DISABLE
your current anti-virus software. Some anti-virus programs such as Avast will alert you to a virus attack when running sysclean so it's best to disable them first.
6. Open the Sysclean folder and double-click on sysclean.com
7. It will take some time to complete. Be patient and let it clean whatever it finds.
8. Exit when done and re-enable your anti-virus program.
If your running Win XP/2000, download and scan with Ewido Anti-Malware v3.5
in "SAFE MODE
".Ewido Install and Scan Instructions
While still in safe mode browse to and delete the following folder:
<- this folder
Reboot in normal mode and perform this online Virus scan
:[Watch the Address bar in IE. You may receive alerts that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then Click Install ActiveX component.]Trend Micro Housecall Scan