Desktop Hijacked!

Hi Skywalker45

Thankyou for letting me know that my PC is now clean!

Just a couple of small problems, before you go though!…

Ok… Current situation is that I have a grey desktop which refuses to allow me to do anything to change it.

I still have a grey desktop, which was the problem I originally posted!
Can't change to any other wallpaper.

Also, at startup, there are still 1,2 or 3 instances of Windows Installer trying to install something and the message "This MSI must be launched through Set up".

Could you please help me to try and sort out these problems?

Many thanks…
Tracy x

Give me a little time to research that Tracy and I'll get back with you. Sorry, but I didn't realize that issue hadn't been resolved.

Sorry Skywalker45. Apart from these couple of irritating little things, everything is running great! Have also taken your advice and now have updated version of Java and have un-wordwrapped Notepad… why didn't you say something sooner, It must have been driving you nuts! Thankyou for giving up your precious time to help me out. Tracy x

Hi Tracy! I didn't forget about your ongoing problem. I would like you to download another program that will show me what files have been created during the past few weeks. Please follow the instructions below:

• Download this file - combofix.exe
• Double click combofix.exe & follow the prompts.
• When finished, it will produce a log for you. Post that log in your next reply. If the log does not open automatically it can be found in C:\combofix.txt
  
  Note: Do not mouseclick combofix's window while it's running. That may cause it to stall

Let's also try this:

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd

[external image: Posted Image]

Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

IMPORTANT: Do NOT run any other options until you are asked to do so!

Hi Skywalker45… and thank you for remembering me and my problems! Please find below, the Combofix and Smitfraud logs, as requested. User - 06-11-01 21:52:34.10 Service Pack 2 ComboFix 06.10.19 - Running from: "C:\Documents and Settings\User\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Documents and Settings\User\Application Data\Install.dat ((((((((((((((((((((((((((((((( Files Created from 2006-10-01 to 2006-11-01 )))))))))))))))))))))))))))))))))) 2006-11-01 07:03 127,208 –a—— C:\WINDOWS\system32\mucltui.dll 2006-10-24 07:49 6,864 –a—— C:\WINDOWS\system32\vsrvcuser.sys 2006-10-22 21:59 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-10-19 19:34 578,252 –a—— C:\WINDOWS\Registry0.reg 2006-10-19 19:34 31,370,842 –a—— C:\WINDOWS\Registry3.reg 2006-10-19 19:34 138 –a—— C:\WINDOWS\Registry1.reg 2006-10-18 17:30 991,232 –a—— C:\WINDOWS\system32\VchReg.dll 2006-10-18 17:30 50,904 –a—— C:\WINDOWS\system32\CloseAll.exe 2006-10-18 17:30 229,376 –a—— C:\WINDOWS\system32\CheckDll.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-01 21:01 ——– d——– C:\Program Files\SpywareDetector 2006-11-01 18:59 ——– d——– C:\Program Files\Norton Internet Security 2006-11-01 18:54 ——– d-a—— C:\Program Files\Common Files 2006-10-31 21:12 ——– d——– C:\Program Files\Internet Explorer 2006-10-31 21:11 ——– d——– C:\Program Files\Windows Media Player 2006-10-31 21:07 ——– d——– C:\Program Files\Outlook Express 2006-10-31 21:07 ——– d——– C:\Program Files\Common Files\System 2006-10-31 20:30 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-10-31 19:23 ——– d——– C:\Program Files\Java 2006-10-31 19:21 ——– d——– C:\Program Files\Common Files\Java 2006-10-31 19:03 ——– d——– C:\Program Files\Java Web Start 2006-10-30 16:48 5632 –ahs—- C:\Program Files\Thumbs.db 2006-10-29 22:13 ——– d——– C:\Program Files\Hijackthis 2006-10-26 18:39 ——– d——– C:\Program Files\Registry Cleaner 2006-10-26 18:39 ——– d——– C:\Program Files\QuickTime 2006-10-26 18:38 ——– d——– C:\Program Files\MSN Messenger 2006-10-26 18:38 ——– d——– C:\Program Files\Microsoft Works 2006-10-26 18:36 ——– d——– C:\Program Files\Messenger 2006-10-22 21:59 ——– d——– C:\Program Files\Grisoft 2006-10-20 21:27 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-10-20 21:27 ——– d——– C:\Program Files\Hewlett-Packard 2006-10-08 20:02 174608 –a—— C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT 2006-10-06 20:28 ——– d——– C:\Program Files\Symantec Technical Support 2006-10-04 07:11 ——– d——– C:\Program Files\Symantec 2006-09-15 21:52 91904 –a—— C:\WINDOWS\system32\S32EVNT1.DLL 2006-09-15 21:52 124016 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2006-09-13 05:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll 2006-08-25 15:45 617472 –a—— C:\WINDOWS\system32\comctl32.dll 2006-08-21 12:21 16896 –a—— C:\WINDOWS\system32\fltlib.dll 2006-08-21 09:14 23040 –a—— C:\WINDOWS\system32\fltmc.exe 2006-08-16 11:58 100352 –a—— C:\WINDOWS\system32\6to4svc.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "IncrediMail"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe /c" "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "WorksFUD"="C:\\Program Files\\Microsoft Works\\wkfud.exe" "Microsoft Works Portfolio"="C:\\Program Files\\Microsoft Works\\WksSb.exe /AllUsers" "Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe" "MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft Money\\System\\Activation.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" "SiSPower"="Rundll32.exe SiSPower.dll,ModeAgent" "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="\"C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe\" /tray" "SystemTraySD"="C:\\Program Files\\SpywareDetector\\SDSystemTray.exe" "SDAutoLiveupdate"="C:\\Program Files\\SpywareDetector\\LiveUpdateSD.exe -AUTO" "RCSystemTray"="C:\\Program Files\\Registry Cleaner\\RCSystemTray.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] @="" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="" "SubscribedURL"="" "FriendlyName"="Security" "Flags"=dword:00006002 "Position"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,00,04,00,00,e3,02,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,32,00,00,00,32,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,00,00,00,00,01,00,00,00,00,04,00,00,e3,02,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,00,03,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - User.job Completion time: 06-11-01 21:53:59.56 C:\ComboFix.txt … 06-11-01 21:53 and… SmitFraudFix v2.117 Scan done at 22:02:58.79, 01/11/2006 Run from C:\Documents and Settings\User\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\User »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\User\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\User\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="" "SubscribedURL"="" "FriendlyName"="Security" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Hope these are useful! Best regards, Tracy x

Hi Tracy. I need to ask some questions but first I would like you to copy and paste the text below into Notepad:

@echo off
regedit /e c:\reglook.txt HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
notepad c:\reglook.txt

Save the file and when you do make sure the field that says save as files of type is set to All Files. Save it to your desktop with the name peek.bat

Don't do anything with the file yet.

Now in your first post you said:

Ok… Current situation is that I have a grey desktop which refuses to allow me to do anything to change it.
Had a lovely red background yesterday with a flashing spyware (our something) warning in the centre of it (that was scary), but seem to have managed to get rid of that.

Can you tell me exactly what you did to get rid of the red background with the spyware warning? Did you use a special program?

Now that I've asked those questions please double click on the peek.bat file we made earlier. It will open a log in Notepad. Please post that log here, along with the answers to my questions in your next reply.

Hi Skywalker 45

Can you tell me exactly what you did to get rid of the red background with the spyware warning? Did you use a special program?

I think I ran Live update on Norton, scanned and deleted / fixed what I could. I downloaded Spyware Detector & Registry Cleaner around the same time, but cannot remember whether I had the problem first so did the downloads, or did the downloads because of the other problems I was having for two weeks beforehand! If I had them at the time, I would have run them both and deleted all that I could.
I'm sorry to be so non-specific but it feels like a lifetime ago now and, to be honest, it's all a bit of a blurr!

Here is the log you requested. Hope that is more useful…

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000

With grateful thanks…
Tracy x

Hi Tracy. At this point I feel it would be wise for you to visit this site:

http://www.worldstart.com/tips/tips.php/1797

and follow the instructions there to try to restore your ability to change your wallpaper. If you still cannot do it then post back here and let me know. I'm trying to come up with a solution for you.

You're welcome Tracy and remember to follow all my previous suggestions for staying clean.