[Resolved] Your System Is Infected on NonChangable Walpaper

Please help I am running Windows XP, I have a virus that changed my Desktop Color to Green and Displays a Warning Box Saying: YOUR SYSTEM IS INFECTED! Systen has been stopped due to a serious malfunction. Spyware activity has been detected. It is recommended to use spyware removal tool to prevent data loss. Do not use the computer before all spyware removed. Symptoms: The desktop Properties will not allow me to change wallpaper. Also the TaskManager has been disabled. There is also a White X in a red circle in the taskbar tray that every 30 seconds or so flashes Click here to protect your computer from spyware. I have been reading your forums and I have The hijack.log the DDS.txt and the Attach.txt . Please let me know how to proceed to fix this nasty little virus.

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems. I'd be grateful if you would note the following:

• Logs from malware removal programs (DDS is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
• Please make sure to carefully read any instruction that I give you.
  Reading too lightly will cause you to miss important steps, which could have destructive effects.
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
  Because of this, you must reply within five days. I will post a reminder should you seem to fail to do this, however, if you fail to reply within five days then,
  unless I have been notified of your absence in advance, the topic shall be closed!
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I am checking over your log, I will post back shortly with instructions.

Ok thanks for the Prompt replay waiting for your instructions

Hello thunderdart,
Sorry for the delay. This is a crazy time of year for all of us Malware Fighters. A lot of us are getting prepared for the holidays that are just around the corner.

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Under Custom Scan paste this in
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  /md5stop
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• You may need two posts to fit them both in.

Scanning with GMER
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Please make sure you include the following items in your next post:
1. The logs that were produced after running OTL. (OTL.txt & Extras.txt)
2. The log that was produced after running GMER.
3. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Hello thunderdart! It's been several days since I last posted instructions for you to complete. Do you still require assistance in getting your computer cleaned up? Thanks, SweetTech.

Thanks SweetTech for your reply. Sorry I could not wait had to get My Machine Backup and running… I current have my machine running (sort-of) I removed the virus, fixed the Wallpaper go task manager to work. But when I did my final virus scan it removed the file used to logon to windows. So all my machine did was try to logon then logoff. I fixed that by creating a Linux Boot CD to look at the registry to fine the name of the file that was deleted. Then I used UBuntu (I have a Dual-Boot system) to access the windows NTFS Drive and copy the orginal file on top of the virus name file. When I finally was able to logon still have problems with networking. Currently my network connection works with google chrome browser But will not work with FireFox or IE 7. So that is the last problem I am having after 6 days of hard work…. If I can't get IE7 or FireFox to Work I will open a new POST here So again thanks for your replys and you can close this Case ThunderFart

Okay. Thank you for letting me know. I will ask that this thread be closed. SweetTech.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.