Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:
Temporary Files
Temporary Internet Files
Recycle Bin
—————————————————————————
Reboot into safe mode
Disconnect from the net and Close ALL OPEN PROGRAMS.
Run 'SpSeHjfix'. and click on "Start Disinfection".
When it's finished it will reboot your machine to finish the cleaning process.
The tool creates a log of the fix which will appear in the folder.
Repeat the process above until you get a log like this - 'not infected'
Then run CW-Shredder - hit the FIX button.
3-26-05 18:08:05) SPSeHjFix started v1.1.0
(3-26-05 18:08:05) OS: Win (4.10.2222)
(3-26-05 18:08:05) Language: svenska
(3-26-05 18:08:07) Disinfect started
(3-26-05 18:08:07) Bad-Dll(IEP): (not found) <——
(3-26-05 18:08:07) Bad-Dll(IEP) in BHO: (not found) <——
(3-26-05 18:08:07) UBF: 4
(3-26-05 18:08:07) UBB: 2
(3-26-05 18:08:07) UBR: 17
(3-26-05 18:08:07) Bad IE-pages:
(3-26-05 18:08:07) Stealth-String not found: <——
(3-26-05 18:08:07) Not infected->END <——
Reboot and post a fresh HJT log and the log that was created by 'SpSeHjfix'.
Thanks, MrC
Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane.
Highlight it, CTRL C and paste it in your next reply.
It's going to take a while to scan and if you get a pop-up to buy the program, just X it out.
Hola MrC.
Here are the results of mwav scan.
Is the registry the same as run REGEDIT? If so then I am somewhat familiar with it. Tried to "tweak" something there today–couldn't get it to do what I wanted.
Also, FYI, have run the following, many times!, within the last 24 hrs:
Aluria spyware
Killbox
Trojan Hunter
Noadware
PC BugDoctor
Xoftspy
I once had a dog named MrB.
Thanks,
Sharyde
File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wldr.dll infected by "Trojan-Downloader.Win32.Agent.le" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\5HOYo.exe infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\9juBvaPs.exe infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\JWgFa.exe infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\pgS9gk3.exe infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Application Data\Qualcomm\Eudora\attach\catworld.DOC.zip infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Application Data\Qualcomm\Eudora\attach\thats_hard.xls.zip infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\5HOYo.exe infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\9juBvaPs.exe infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\JWgFa.exe infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\pgS9gk3.exe infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\My Documents\My eBooks\Sculptor\Sculptor.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{E62628F1-4B50-47DF-BABA-B7C9C9DA5831}\RP58\A0008394.exe infected by "Trojan.Win32.Agent.ct" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\wldr.dll infected by "Trojan-Downloader.Win32.Agent.le" Virus. Action Taken: No Action Taken.
Is the registry the same as run REGEDIT? If so then I am somewhat familiar with it. Tried to "tweak" something there today–couldn't get it to do what I wanted.
Yes - Good!
We may be able to get this trojan but the damage it caused is another problem.
Lets do this:
Download and unzip the KillBox to a folder.
Now open up the KillBox and copy and paste each one of these in and hit delete, if the file exists, it will appear in blue under the window.
(The KillBox has a 'delete on reboot' or 'replace on reboot' (use dummy), use them if needed.
When using delete on reboot or replace on reboot - you can add multiple files.)
C:\Documents and Settings\Lombard\Application Data\Qualcomm\Eudora\attach\thats_hard.xls.zip
C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\5HOYo.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\9juBvaPs.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\JWgFa.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\pgS9gk3.exe
C:\WINDOWS\system32\wldr.dll
EDIT: also run this online virus scan, make sure you set it to auto-clean:
Good morning MrC.
1) OK, have run Housecalls; 4 files infected with WORM SOBER 1: 2 (non cleanable) files were deleted: 2 (cannot access) were unable to delete because were currently in use: File C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt; File C:\Documents and Settings\Lombard\Local
Settings\Temp\message_text.txt
2) Updated nwave scan below.
3) Blue screen with security warning message is still there.
4) Desktop/Properties still show only 2 tabs.
5) Still unable to access IE.
Eagerly awaiting your reply,
Sharyde
________________________
File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\!Submit\wldr.dll infected by "Trojan-Downloader.Win32.Agent.le" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\My Documents\My eBooks\Sculptor\Sculptor.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{E62628F1-4B50-47DF-BABA-B7C9C9DA5831}\RP58\A0008394.exe infected by "Trojan.Win32.Agent.ct" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E62628F1-4B50-47DF-BABA-B7C9C9DA5831}\RP59\A0010541.dll infected by "Trojan-Downloader.Win32.Agent.le" Virus. Action Taken: No Action Taken.
This one is a false detection and we won't worry about it
File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.
———————————————————————————————-
These we have to get rid of:
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
———————————————————————————————–
The KillBox creates a folder called !submit that stores copies of any file that you delete, when we are done you can delete that folder (!submit)
File C:\!Submit\wldr.dll infected by "Trojan-Downloader.Win32.Agent.le" Virus. Action Taken: No Action Taken.
———————————————————————————————–
These two are from your 'system restore files', which means they are infected too.
File C:\System Volume Information\_restore{E62628F1-4B50-47DF-BABA-B7C9C9DA5831}\RP58\A0008394.exe infected by "Trojan.Win32.Agent.ct" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E62628F1-4B50-47DF-BABA-B7C9C9DA5831}\RP59\A0010541.dll infected by "Trojan-Downloader.Win32.Agent.le" Virus. Action Taken: No Action Taken.
———————————————————————————————–
Make a backup of the registry first:
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
Hilight "My Computer" > on top choose File > Export > call RegBackup > save
Now you will have a copy of the registry.
If you are not sure about doing any of this, don't do it, ask any questions first.
———————————————————————————–
Removing autostart entries from the registry prevents the malware from executing at startup. In this procedure, you will need the name(s) of the file(s) detected earlier. (SeeBelow for file names)
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
In the right panel, locate and delete the entry or entries whose data value is the malware path and file name of the file(s) detected earlier.
Again in the left panel, double-click the following:
In the right panel, locate and delete the entry or entries whose data value is the malware path and file name of the file(s) detected earlier.
Close Registry Editor.
Files to look for:
C:\WINDOWS\System32\wldr.dll
C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt
C:\DOCUME~1\Lombard\LOCALS~1\Temp\5HOYo.exe
C:\DOCUME~1\Lombard\LOCALS~1\Temp\9juBvaPs.exe
C:\DOCUME~1\Lombard\LOCALS~1\Temp\JWgFa.exe
C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt
C:\DOCUME~1\Lombard\LOCALS~1\Temp\pgS9gk3.exe
C:\Documents and Settings\Lombard\Application Data\Qualcomm\Eudora\attach\catworld.DOC.zip
C:\Documents and Settings\Lombard\Application Data\Qualcomm\Eudora\attach\thats_hard.xls.zip
C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\5HOYo.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\9juBvaPs.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\JWgFa.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\pgS9gk3.exe
C:\WINDOWS\system32\wldr.dll
—————————————————————————————–
Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for:
If you find the files, click on them, and then click End Process => Exit the Task Manager.
Now open up the KillBox and copy and paste each one of these in and hit delete, if the file exists, it will appear in blue under the window.
C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt
C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt
If you are unable to delete a file………..
The KillBox has a 'delete on reboot' or 'replace on reboot' (use dummy), use them if needed.
When using delete on reboot or replace on reboot - you can add multiple files.
Also see if you can find and delete these two files:
wp.exe and wp.bmp
They may be located in 'C'
"C:\wp.exe"
"C:\wp.bmp".
———————————————————————————
Open up the registry and search for and delete any reference to wp.exe
Go to Start > Run > Type REGEDIT > Enter > on the top choose EDIT > Find > wp.exe
———————————————————————————-
Fix registry settings to allow control panel tabs to be visible:
Hi, I'm really concerned now–have been unable to locate most of what needs to be deleted! The good news is that at backup registry was successfully made!
OK, an update
Searched for the following files in: HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run and HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run
There are neither DOCUMENT nor WINDOWS files. The files that are there are mostly PROGRAM files.
I did find one WINDOWS file in HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run which read C:\WINDOWS\System32\cftmon.exe
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt .pif infected by "Email-Worm.Win32.Sober.i" Virus. Action Taken: No Action Taken.
———————————————————————————————–
The KillBox creates a folder called !submit that stores copies of any file that you delete, when we are done you can delete that folder (!submit)
File C:\!Submit\wldr.dll infected by "Trojan-Downloader.Win32.Agent.le" Virus. Action Taken: No Action Taken.
———————————————————————————————–
These two are from your 'system restore files', which means they are infected too.
File C:\System Volume Information\_restore{E62628F1-4B50-47DF-BABA-B7C9C9DA5831}\RP58\A0008394.exe infected by "Trojan.Win32.Agent.ct" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E62628F1-4B50-47DF-BABA-B7C9C9DA5831}\RP59\A0010541.dll infected by "Trojan-Downloader.Win32.Agent.le" Virus. Action Taken: No Action Taken.
———————————————————————————————–
Make a backup of the registry first:
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
Hilight "My Computer" > on top choose File > Export > call RegBackup > save
Now you will have a copy of the registry.
If you are not sure about doing any of this, don't do it, ask any questions first.
———————————————————————————–
Removing autostart entries from the registry prevents the malware from executing at startup. In this procedure, you will need the name(s) of the file(s) detected earlier. (SeeBelow for file names)
Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry or entries whose data value is the malware path and file name of the file(s) detected earlier.
Again in the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry or entries whose data value is the malware path and file name of the file(s) detected earlier.
Close Registry Editor.
Files to look for:
C:\WINDOWS\System32\wldr.dll
C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt
C:\DOCUME~1\Lombard\LOCALS~1\Temp\5HOYo.exe
C:\DOCUME~1\Lombard\LOCALS~1\Temp\9juBvaPs.exe
C:\DOCUME~1\Lombard\LOCALS~1\Temp\JWgFa.exe
C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt
C:\DOCUME~1\Lombard\LOCALS~1\Temp\pgS9gk3.exe
C:\Documents and Settings\Lombard\Application Data\Qualcomm\Eudora\attach\catworld.DOC.zip
C:\Documents and Settings\Lombard\Application Data\Qualcomm\Eudora\attach\thats_hard.xls.zip
C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\5HOYo.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\9juBvaPs.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\JWgFa.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\pgS9gk3.exe
C:\WINDOWS\system32\wldr.dll
—————————————————————————————–
Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for:
0Dtf.message_text.txt
message_text.txt
wp.exe
wp.bmp
If you find the files, click on them, and then click End Process => Exit the Task Manager.
Now open up the KillBox and copy and paste each one of these in and hit delete, if the file exists, it will appear in blue under the window.
C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt
C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt
If you are unable to delete a file………..
The KillBox has a 'delete on reboot' or 'replace on reboot' (use dummy), use them if needed.
When using delete on reboot or replace on reboot - you can add multiple files.
Also see if you can find and delete these two files:
wp.exe and wp.bmp
They may be located in 'C'
"C:\wp.exe"
"C:\wp.bmp".
———————————————————————————
Open up the registry and search for and delete any reference to wp.exe
Go to Start > Run > Type REGEDIT > Enter > on the top choose EDIT > Find > wp.exe
———————————————————————————-
Fix registry settings to allow control panel tabs to be visible:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"WallpaperStyle"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
Then remove this other entry:
"Wallpaper"=reg_sz:"c:\wp.bmp"
and
The following keys (if present) must have their values changed to 0 (hex) or deleted:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
NoDispBackgroundPage
NoDispSettingsPage
NoDispScrSavPage
NoDispAppearancePage
Be careful and good luck, let me know how you make out and what works, MrC
This post has been edited by MrCharlie: Yesterday, 04:07 PM
——————–
Hi, I'm really concerned now–have been unable to locate most of what needs to be deleted! The good news is that at backup registry was successfully made!
OK, an update:
Searched for the following files in: HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run and HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run
There are neither DOCUMENT nor WINDOWS* files listed. The files that are there are mostly PROGRAM files.
*I did find one WINDOWS file in HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run which read C:\WINDOWS\System32\cftmon.exe
C:\WINDOWS\System32\wldr.dll
C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt
C:\DOCUME~1\Lombard\LOCALS~1\Temp\5HOYo.exe
C:\DOCUME~1\Lombard\LOCALS~1\Temp\9juBvaPs.exe
C:\DOCUME~1\Lombard\LOCALS~1\Temp\JWgFa.exe
C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt
C:\DOCUME~1\Lombard\LOCALS~1\Temp\pgS9gk3.exe
C:\Documents and Settings\Lombard\Application Data\Qualcomm\Eudora\attach\catworld.DOC.zip
C:\Documents and Settings\Lombard\Application Data\Qualcomm\Eudora\attach\thats_hard.xls.zip
C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\5HOYo.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\9juBvaPs.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\JWgFa.exe
C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\pgS9gk3.exe
C:\WINDOWS\system32\wldr.dll
——————————————————————————–
Am unsure about what action to take on these:
File C:\System Volume Information\_restore{E62628F1-4B50-47DF-BABA-B7C9C9DA5831}\RP58\A0008394.exe infected by "Trojan.Win32.Agent.ct" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E62628F1-4B50-47DF-BABA-B7C9C9DA5831}\RP59\A0010541.dll infected by "Trojan-Downloader.Win32.Agent.le" Virus. Action Taken: No Action Taken.
———————————————————————————
The following are not listed in Task Manager
0Dtf.message_text.txt
message_text.txt
wp.exe
wp.bmp
———————————————————————————-
I tried to delete the following files once again in KillBox but nothing blue appeared. However, I did add them to 'delete on reboot'.
C:\DOCUME~1\Lombard\LOCALS~1\Temp\0Dtf.message_text.txt
C:\DOCUME~1\Lombard\LOCALS~1\Temp\message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\0Dtf.message_text.txt
C:\Documents and Settings\Lombard\Local Settings\Temp\message_text.txt
An aborted attempt was made to 'reboot now' because the following message appeared and I thought it better to talk first before taking action:
'PendingFileRenameOperations Registry Data has been removed by External Process'
Also, have not deleted !submit folder
———————————————————————————
Successfully deleted (yahoo!)
"C:\wp.bmp"
Did not find
"C:\wp.exe"
———————————————————————————
How do I 'fix' this. In Edit Binary data?
"WallpaperStyle"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
Did not delete this until further notice.
"Wallpaper"=reg_sz:"c:\wp.bmp"
————————————————————————-
Value changed to 0 in:
NoDispBackgroundPage
NoDispAppearancePage
These not listed:
NoDispSettingsPage
NoDispScrSavPage
——————–
Should I send another mwave scan? How about Hijackthis?
Thanks, MrC. for your time and patience.
Sharyde
Hi MrC,
I just read a great book called Spyware Secrets Exposed and it has me thinking that perhaps the best solution is to start fresh, reformat my hard drive, and install what I need inorder to avoid, as much as possible, this happening again. I'm more freaked-out than ever about spyware and how difficult it is to get rid of. Apparently many are designed to change names/mutate inorder to avoid detection with the goal of infiltrating as many files as possible thereby ensuring their survival! (Uhhggg…All those sci-fi movies are beoming all too real!) Also, thought I'd download the Firefox browser to use instead of IE. What do you think? I could really use your guidance.
Thanks,
Sharyde
I'm with you, if it's not too much of a problem - start fresh and install all the correct protection.
The damage this infection has done is severe and the time we would have to invest in it to recover (and we really don't know if that's possible) is not worth it at this point.
This is a brand new infection and there's not too much info on it.
Let me know and I'll give you some 'preventive maintenance' to help keep you safe.
Whew, I feel relieved! The opportunity to start fresh is comforting. I would appreciate any preventative maintenance tips you can provide.
Here is an elementary question: (PC's are new ground for me as for years I've worked on a Mac–which, by the way, has never given me problems!) How do I back up stuff? Can I simply make a copy onto a CD?
Although I am the Adminstrator, I don't recall having issued myself a password. What if I did and I don't remember. Would I still be able to reformat and have future use of my computer?
If I get stuck can I still contact you for help?
Thanks again,
Sharyde
MrC, a couple of quick questions.
1) Are the terms "reinstalling the operating system" and "reformatting the hard drive" interchangeable?
2) I want to be able to reconnect to my ADSL line after reformatting and am concerned about how to reconfigure/reinstall all the relevant data. Would they have installed a card in my computer?
In Network Connections 3 icons are displayed. Here are details:
ADSL
Device type: Network adapters
Manufacturer: Intel® Corp. (Intel®/Wireless 2200BG network connection)
Location: PCIbus 2, device 2, function 0
I have recorded the IP address and Subnet mask. It was manually configured.
1394 Connection
Lan or high-speed internet
Enabled
1394 Net Adapter
Local Area Connection
LAN or high-speed internet
Network cable unplugged
Realtek RTL8139 C+Fast
Ethernet NIC
Your help would be much appreciated.
Sharyde
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
