Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Want To Update How To Remove Deluxecommunications


  • Please log in to reply
1 reply to this topic

#1 pbwebguy

pbwebguy

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:07:46 PM

Posted 10 December 2006 - 10:09 PM

There is a thread on the board discussing the removal of this PITA software. The thread is:

http://www.bleepingcomputer.com/forums/t/66364/how-to-remove-deluxecommunications-uninstall-instructions/

After several hours of banging my head against the wall and trying to follow the instructions on this board (unsuccesfully, I might add) I came up with a way to beat this damn program.

The program installs itself in the c:\Program Files\DeluxeCommunications directory. There are 3 files in that directory, the primary file of concern is dxc.exe. I tried removing the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run that starts up the dxc.exe but it immediately re-adds the registry entry.

What I had to do was to boot from my trusty Bart PE recovery CD. You can download Bart PE from http://www.nu2.nu/pebuilder/download/. This program is used to build an ISO of a bootable Windows CD. There are a bunch of plugins but you will really only need a few default ones (command prompt, file manager).

After creating the Bart PE boot disk you need to reboot your computer off of the cdrom. Each machine is a bit different on how to boot from cd. Sometimes you have to go into your bios setting to change the boot order. I was fixing a Dell Latitude laptop and had to press F12 to select CD rom.

Once you boot up, there are a number of files that will need to be deleted. The spyware program constantly writes to the \windows\system32\hikmp.ini file what I believe is the installer file. You can run the command prompt and enter the following commands:


cd \windows\system32
del hikmp.ini
del tcppip.exe
del dxclib*
del pmkih.dll

cd \program files\deluxecommunications
del *.*


In order to trick out the program I created a new program in the deluxecommunications folder and write protected it. This way when it went to reinstall itself, the installer fails. In order to do this, enter the following commands while still in the c:\program files\deluxecommunications directory:


copy con dxc.exe


Press Ctrl-Z, this will create a file zero bytes in size.

Now to write protect it:


attrib +r +s +h dxc.exe


You can now quit out of Bart PE and restart your computer. When it boots up a DOS window will most likely appear which is the spyware loader trying to start dxc.exe but it will fail.

Now you can run the HijackThis to remove the registry entries or use Spybot Search & Destroy and/or AdAware which should be able to remove it from there.

BC AdBot (Login to Remove)

 


#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,504 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:08:46 PM

Posted 11 December 2006 - 04:05 PM

DeluxeCommunications is generally not that hard to remove. The problem you had was that you also had a case of Vundo, which can be much more difficult to remove, as well as a sprinkling of other malware. For a guide on removing vundo you can visit this link:

http://www.bleepingcomputer.com/forums/t/18610/how-to-remove-winfixer-virtumonde-msevents-trojanvundob/




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users