trojan hijacking desktop wallpaper

HijackThis is far from the first step. You could have a Smitfraud or SpyAxe related problem but I cannot tell based on your message. You did not say anything about what was in the wallpaper it put on your PC. So you can either run this:

Smitfraud, SpySheriff, SpyAxe & PSGuard Removal

for those problems (if you can tell). Or you need to work thru the below.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Please follow the steps below:

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

.

 

Okay! One of your problems is a form of About:Blank hijacker.

Download this file: SpSeHjfix109

Unzip it to your desktop or to a folder.

Boot into Safe Mode

Start SpSeHjfix, click on " Desinfecton starten" (the other button means close) then it will reboot and finish the cleaning.

Run SpSeHjfix one more time.

Reboot in Normal mode.

Run HijackThis again and post a new log. Also post the log from SpSeHjfix, the log should be on your desktop or the same folder as SpSeHjfix.

 

I going to post some additional steps which will include some items that the previous steps may have already fixed or changed. But you need to do the below steps ASAP.
If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {08542E91-DD18-4177-AE55-29845E7C1541} - C:\WINDOWS\system32\jlpd.dll
O4 - HKLM\..\Run: [WinHound] C:\Program Files\WinHound\WinHound.exe
O4 - HKLM\..\RunServices: [windesktop] C:\WINDOWS\system32\windesktop.exe
O9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - http://www.dellnet.com (file missing) (HKCU)
O18 - Filter: text/html - {E042853F-7434-4EB8-AF03-1FCD3A7345E1} - C:\WINDOWS\system32\jlpd.dll
O18 - Filter: text/plain - {E042853F-7434-4EB8-AF03-1FCD3A7345E1} - C:\WINDOWS\system32\jlpd.dll
O21 - SSODL: Internet Explorer - {F28A40D7-AD0E-034A-C651-5F0ED76232E6} - C:\WINDOWS\system32\Hhlogo32.dll (file missing)

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete (if found):
C:\Documents and Settings\Administrator\Local Settings\Temp\se.dll
C:\WINDOWS\system32\jlpd.dll
C:\WINDOWS\system32\Hhlogo32.dll
C:\WINDOWS\system32\windesktop.exe
C:\Program Files\WinHound <--- the whole folder

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

The message from MS Antispyware is to be expected as I was having you reset your web settings which will change all pages to defaults. You have to allow them or MS AS could reset them back to the bad stuff.

Right now your log is clean! Try another reboot and let me know where things are afterwards. Make sure you run Ccleaner on the old user accounts to cleanup the TIF (also you could delete the user accounts if not needed).

 

There is nothing unusal in your process list. Everything was probably there before except maybe the below two which you may have installed during the READ & RUN ME:
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

The are part of MS Antispyware. Did you have it running before you came here? It does require some of your CPU horsepower but that is necessary for your security. You do not even have a firewall which you will also have to install .

Post a new HJT log right now and let's see if anything else appeared.

Also do the below:

Fixing Locked Desktop
Also you should right click on your Desktop and select Properties. Then click the Desktop tab and then the Customize Desktop button. Now in the next window that comes up click the Web tab. Make sure at the bottom that Lock desktop items is unchecked. Then in the Web pages: box delete all items but My Current Home Page and make sure it is unchecked too. Then click OK. Apply. OK.

 

Okay! So MS AS is the only new item that is running on your PC. Thus there are only two additional processes in your list from whatever you had previously.

Let's try a couple things

1) Locate and delete: c:\windows\warn.html
If you cannot delete it in normal boot mode, try deleting if after booting in safe mode.

2) Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixadt.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixadt.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Reboot your system and check to see how things are working.

 

What firewall are your referring too?

In the READ ME, the only items you need to install were:

Ad-Aware SE
CCleaner
Microsoft® Windows AntiSpyware
Microsoft Windows Malicious Software Removal Tool
SpyBot - Search & Destroy

The only one using any real resource all the time is MS Antispyware. The others do not use anything unless running a scan. You should keep them all. Spybot's SDhelper I requested that you use in the READ ME, use very little system resource but it does not look like you installed Spybot or you did not enable this feature.

 

Also were you able to find and delete: c:\windows\warn.html

 

Yes I know I said that! But I wanted to know which firewall (the name) you installed.

I'm happy to hear things are working well!