Desktop Display Properties Prob Hijack This Notepad Attached - Page 2

Question

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

dcinthemix 0 Newbie Poster · Answer 1 · 2008-03-21T22:42:25+00:00

dcinthemix 0 Newbie Poster

16 Years Ago

Any news on the new hijackthis report at all?

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 2 · 2008-03-24T14:06:50+00:00

Nothing showing up in that log at all. Download the latest version of Smitfraudfix and run it please. Try option #2 to get your desktop back.
I think there may be some corrupt files on the pc that are preventing the running of FF.

dcinthemix 0 Newbie Poster · Answer 3 · 2008-03-24T17:04:35+00:00

Downloaded Smitfraudfix again, heres the report

SmitFraudFix v2.307

Scan done at 12:02:32,68, 24/03/2008
Run from C:\Documents and Settings\dez\My Documents\Spy Virus Apps\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\vsnp2std.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\dez

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\dez\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\dez\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Atheros AR5005G Wireless Network Adapter
DNS Server Search Order: 80.58.61.250
DNS Server Search Order: 80.58.61.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{16E8AB5E-C32E-4316-AFC8-A8873F1B33E1}: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{16E8AB5E-C32E-4316-AFC8-A8873F1B33E1}: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{16E8AB5E-C32E-4316-AFC8-A8873F1B33E1}: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=80.58.61.250 80.58.61.254

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2008-03-24T18:12:03+00:00

crunchie 990 Most Valuable Poster

16 Years Ago

So, how is the desktop?

dcinthemix 0 Newbie Poster · Answer 5 · 2008-03-24T22:07:18+00:00

It has cleared the desktop but this time the options for browse, tile/center etc remain unavailable, heres the safe mode report

SmitFraudFix v2.307

Scan done at 16:52:36,39, 24/03/2008
Run from C:\Documents and Settings\dez\My Documents\Spy Virus Apps\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{16E8AB5E-C32E-4316-AFC8-A8873F1B33E1}: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{16E8AB5E-C32E-4316-AFC8-A8873F1B33E1}: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{16E8AB5E-C32E-4316-AFC8-A8873F1B33E1}: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=80.58.61.250 80.58.61.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=80.58.61.250 80.58.61.254

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 6 · 2008-03-25T16:38:40+00:00

If you have your XP installation CD, do the following;

Go to Start | Run and type in sfc /scannow and hit the Ok button. Insert your CD if/when requested.

Let me know how you go.

dcinthemix 0 Newbie Poster · Answer 7 · 2008-03-26T21:27:21+00:00

i dont have it unfortunately, can i do this without it?

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 8 · 2008-03-27T02:05:55+00:00

You may get away without it, but if the dllcache folder contents (or some of them) are corrupted, you will need the CD.

localhardrive 0 Newbie Poster · Answer 9 · 2008-03-27T23:17:21+00:00

I have been working on the same problem, about not being able to change the wallpaper after cleaning up spyware. I have deleted keys from the registry, and ran alot of freeware programs as suggested by others, and finally found one that did the trick. Go here and read this
http://www.windowsbbs.com/showthread.php?t=50039
Download and run this
http://www.thespykiller.co.uk/downloads/cleandesktop.exe
This is the only thing that worked for me.
Quick and perfect fix. Thanks to all.