desktop spyware

My dad downloaded some game and installed it. Now I'm stuck with spyware, adware and viruses. I ran ad aware and removed everything it found, I ran spybot and removed all it found and did the same with norton antivirus. I think I got them all, but my desktop is still screwed up, there is a flashing banner telling me to download some spyware program, with an all red background. I can't rightclick on the desktop and I can't highlight any icons. How do I get rid of this? I tried going through control panel and display, I make changes but it doesn't change the desktop picture.

 

See the below thread then attach a current HJT log.
http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis

 

see attachments

 

ran all the software 3 more times and now the add is gone but now i'm getting a white flashing screen and the desktop is not working right

 

Please download Spy Sweeper

• Click the link above to download the program.
• Install it. Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Options on the left side.
• Click the Sweep Options tab.
• Under What to Sweep please put a check next to the following:
  
  • Sweep Memory
  • Sweep Registry
  • Sweep Cookies
  • Sweep All User Accounts
  • Enable Direct Disk Sweeping
  • Sweep Contents of Compressed Files
  • Sweep for Rootkits
  • Please UNCHECK Do not Sweep System Restore Folder.
• Click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into notepad and save it as spysweeper.txt and attach it to your next post along with a fresh HJT log.

 

spy sweeper software is stops when it reaches a certain file, scan isn't complete, it's a idle, doing nothing. Ran it 3 times stops on the same file each time.

 

Can you get the filename and location?

 

so i deleted the file it seem to stall on, ran it again then stalled on a different file. I noticed the when sweeping i get a message in the progress window

Drives: C:
Also sweeping: Memory, Cookies, Registry
Adware found: azsearch toolbar
Adware found: flashtrack
Trojan Horse found: trojan-downloader-pacisoft
System Monitor found: potentially rootkit-masked files

It always gets this far, after this message it stops.

 

Reboot into Safe Mode and try a full sweep again.

 

see attachments

 

Download this trial version of Ewido Security Suite

• First, please download and run CCleaner to clean temp files, cookies, etc; to make the log shorter.
  
• Install ewido security suite
  
• When installing the program, under "Additonal Options" uncheck..
  
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should now be an icon on your desktop, double-click it.
• You will need to update ewido to the latest definition files:
  
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")

If you are having problems with the updater, you can use this link to manually update ewido. Ewido Manual Updates

• Once the updates are installed, exit Ewido.
• Now print the below instructions or save them locally because I want you to have all browsers closed and also have no connection to the internet (unplug your cable) while doing the below:
• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine
• While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report[/size][/color]
• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.
• Reboot into normal mode and reconnect to the internet.

Once your machine reboots please attach the report from Ewido along with a fresh HJT log from normal mode.

 

see attachments

 

Now, please download Blacklight to its own folder...

F-Secure Blacklight

After download is complete, double click to run the program. Click "Accept" to procede. Then click SCAN to begin scanning your system.

Once the scan is complete it will attempt to clean the found infections. There should be a log in the folder that you ran the program from, attach this log to your next post along with a fresh HJT log.

 

ran backlight found nothing.

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

Ewido

Spy Sweeper

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.

Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

smsystem.exe

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tv.yahoo.com/grid/?.crumb=OmmnmvShw.b&title=&subtit=&desc=&contrib=&searc h=&starthour=&startdate=&range=&src=&setlineupcookie=true&.intl=us&zip=16057&.do ne=&lineup=us_PA37786
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavili on&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O4 - HKLM\..\Run: [smsystem] C:\WINDOWS\system32\smsystem.exe
O4 - HKCU\..\Run: [smsystem] C:\WINDOWS\system32\smsystem.exe

O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c =Q105&bd=pavilion&pf=laptop

O15 - Trusted Zone: http://www.610wip.com
O15 - Trusted Zone: http://forums.menshealth.com
O15 - Trusted Zone: *.radiomat.com
O15 - Trusted Zone: http://tuner1.dc1.sonixtream.com
O15 - Trusted Zone: http://www.streamaudio.com

O16 - DPF: {26098EA2-C95D-48EA-89B4-63C5A63BD42F} - http://www.pacimedia.com/install/pcs_0002.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOWS\system32\smsystem.exe

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

see attachments

 

I think we got all the spyware adware and viruses out, but my desktop is still messed up.

 

Your HJT log is clean! For the desktop fix, see step #8 in the thread below...

SpySheriff (aka SpywareNo) Removal

 

Followed step #8 and 9 and still have no desktop.

 

Can you elaborate on your problem? What can you and can't you do?

 

sorry, i followed the instructions, step #8-9. You said following these instructions my desktop would be fixed, but its still the same. White screen, flashes to an offwhite color when i cover an icon. I can't highlight anything on the desktop, and when i try to change the wallpaper it doesn't do anything.

 

Ahh!

Right click on your Desktop and select Properties. Then click the Desktop tab and then the Customize Desktop button. Now in the next window that comes up click the Web tab. Make sure at the bottom that Lock desktop items is unchecked. Then in the Web pages: box delete all items but My Current Home Page and make sure it is unchecked too. Then click OK. Apply. OK.

 

Ok its back, thank you so much for your help.

 

Your Welcome!

You should see this article on How to Protect yourself from malware!

Surf Safely!