Unknown problem with screen background

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by bergtho, May 26, 2008.

  1. bergtho

    bergtho Private E-2

    Originally had the red screen background with identity warning. Started out on my own with SpyBot S&D, Trendmicro online, didn't make much progress, found this site, went through the steps, now have white background. Any ideas?
     

    Attached Files:

  2. bergtho

    bergtho Private E-2

    Have been working on all day, am glad to have found a good resource.
    Wife said she clicked on something for free video and didn't think the PC was running rignt. She was correct, started with almost no access. Seems much improved notw.
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Yes this is the most frequent cause of SmitFraud (aka Zlob) and Vundo infections like this.

    Why are you running this PC without protection software?????


    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MT...ml?jumpid=in_r329_3d/hnd/rx3100|pdp|viewpoint
    O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
    O24 - Desktop Component 0: Privacy Protection - (no file)

    After clicking Fix, exit HJT.

    Now Let's Fix The Locked Desktop
    • Right click on your Desktop and select Properties.
    • Then click the Desktop tab
    • then click the Customize Desktop button.
    • Now in the next window that comes up click the Web tab.
      • Make sure at the bottom that Lock desktop items is unchecked.
    • Then in the Web pages: box delete all items but My Current Home Page and make sure it is unchecked too.
    • Then click OK.
    • Click Apply. And click OK.

    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.



    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  4. bergtho

    bergtho Private E-2

    chaslang,

    Performed listed steps. Desktop fix worked. Registry change successfully merged. Things are looking better now, and working better too. You are a wizard.

    I was running with zonealarm (free version) and Search&Destroy (also free). Doesn't seem like such a good deal now. I'm going to a full protection suite.

    Thank you for your help and let me know if you see any other changes/scans/removals that I need to make.

    Thank you,
    GBergthold
     

    Attached Files:

  5. bergtho

    bergtho Private E-2

    PC is working much better overall. There are a few things left hanging around on her account. I fixed the default IE page. The VIRUS ALERT text still shows in the time field in the taskbar and status bar of Explorer. The Start button only lists "Turn off" as an option, doesn't show "Log off". The Start menu is missing "Control Panel, Connect To, Help, Search, and Run. Maybe there is a windows command to add these back?

    I do now have a full antivirus, antispyware, and firewall program installed, up to date, and active.
     
  6. bergtho

    bergtho Private E-2

    I've spent a LOT of time on this, found some fixes in other places as well, and hope someone else can benefit from this information.

    Fix for the time in the system tray showing with the text: VIRUS ALERT!
    Open the Control Panel
    Select: Date, Time, Language, and Regional Options
    Select: Change the format of numbers, dates, and times
    On the Regional Options tab select the Customize button
    Select the Time tab
    Remove the text "VIRUS ALERT!" from any boxes where this displays. The military time (24 hour) format can be changed back to 12 hour time format by replacing HH (caps) in the time format box with hh (lower case)

    Other missing Start menu options can be found in Taskbar and Start Menu Properties, Customize, Advanced, Start Menu Items. Click the items that you need shown on the Start menu and they will show up correctly.

    I think the only thing I'm still fighting is the missing C: D: drives when I run Explorer.
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Neither of those were providing antivirus protection and Spybot would only give antispyware protection if you used its Teatimer function.

    Security Suites are not recommended as they are all resource hogs.

    Your clock was in 24 hr mode due to ComboFix not running 100% properly and thus it did not finishing putting you back into normal 12 hr mode.

    Not sure what you mean. This is the first you are mentioning this.

    Your logs are clean but I suggest that you delete the below empty folder:

    C:\WINDOWS\system32\818646


    If you are not having any other malware problems, it is time to do our final steps:
    1. You can uninstall SUPERAntiSpyware now.
    2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\cf" /u
        • Notes: The space between the cf" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\cf folder from combofix.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    7. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    8. Go to add/remove programs and uninstall HijackThis.
    9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    10. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    11. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds