Black background on desktop


I am not real computer savvy and I have a problem that I hope someone can help me with. I have a virus of some sort that keeps changing my desktop background to black. I have an anti-virus through Qwest, my internet provider.
A squared free finds the virus, but after I delete it, it comes right back. I tried some other remedies that are posted in this site but nothing works, perhaps I am doing it wrong. Another post shows someone with the same problem i am having and the suggested solution worked for them, but not for me. I moved the system restore slider to zero and unhooked from the internet and ran another scan. The scanner found the virus again and I deleted it again. It came back without my even having to hook up to the internet.

Can someone help? Please give instructions as if teaching a new computer user. Thank you in advance!

Greetings and welcome to the forums (:WAV),

Please follow this guide, it should be able to take care of the malware, if not, please post a Hijackthis log and we’ll help you further,



Thank you for your response. I am assuming that downloading these things and running them should do the trick? I will let you know what happens… What is a hijack log? (told you I am not the sharpest crayon in the box!!) I sure am grateful for folks like you who are willing to use their “smarts” to help the more “challenged” like myself!

“HijackThis” is a program that analyzes and gives info about you system. It puts this info into a log. You can post a log for “smart” people to review. (Well, I’m not totally sure because I’ve never used HijackThis ;D)

(See #8 of Xan’s guide:

Keep us tuned :slight_smile:


OK I have downloaded all of the programs you showed me. The only one that “captured” the virus is “SUPERantispyware”. Like I said it captures it but and shows that it is deleted but the black background comes back after about a hour and it shows I am re-infected. This is even with the computer disconnected from the internet. I guess I will now try that “Hijackthis” program you are talking about. Not sure what to do from there.

The virus shows up as a Trojan. Thanks!

How do I do the “Hijack This?” do I look for it under google?

OK, I downloaded “Hijack This” and ran a scan. What do I do with the results? Thanks!

post/attach the result here. (you might wanna change the .log extension to .txt )
so other ppl can examine it for you :slight_smile:

Click here to download HJTsetup.exe and download the installer.
[]Save HJTsetup.exe to your desktop.
]Double click on the HJTsetup.exe icon on your desktop.
[]By default it will install to C:\Program Files\Hijack This.
]Click on the Do a system scan and save a log file button. It will scan and and then the log will open in notepad.
[]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

OK, Here it is - thank you for your help!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:54:41 PM, on 1/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =*
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =*
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =*
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Qwest
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Popup-Blocker Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\x1IEBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM..\Run: [Adobe Photo Downloader] “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe”
O4 - HKLM..\Run: [SunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe”
O4 - HKLM..\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”
O4 - HKLM..\Run: [QuickCare2.2] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QuickCare2.2
O4 - HKLM..\Run: [OneCareUI] “C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe”
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - OneDrive
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Inbox Search - tbr:iemenu
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Qwest Live - {7097618A-74FB-4BF1-B675-78418FB81FF5} - (file missing) (HKCU)
O15 - Trusted Zone:
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -,0,0,101/
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -,0,0,26/
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SupportSoft Listener Service (sprtlisten) - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe
O24 - Desktop Component 0: (no name) -
O24 - Desktop Component 1: (no name) -
O24 - Desktop Component 2: (no name) -

End of file - 8836 bytes

It looks like the last three items are the source of the problem, funweb products? These free downloads can cause trouble.

Do you have anything called funutilities in your add or remove programs list? If so you could try uninstalling.

I do not have any other solution, so unless anyone else here does I suggest you post on a HijackThis help forum.

Send me a pm if you want help with doing this.

Hi, what security software you are running at the moment. I will suggest three things.

1- Install ThreatFire. Run a scan with SuperAntipsyeware and clean the infection. Now just watch for the malware to change ur desktop again n see if ThreatFire pop ups.

2- Install a HIPS like CFP or Online Armor free( simpler to use- so I highly recommend if you are new to HIPS) and repeat same procedure.

3- Run some rootkit scanners, threatfire has one builtin rootkit scanner. Also try Prevx CSI and gmer.

Let us know how it goes.

Thank you for your reply… I will do the things you suggest and let you know what happens. I am about at my wits end with this for sure. Again, thank you very much!!

Ok, waiting for the reults.

Take care

Thanks for the suggestion, none of that stuff worked. It only slowed down my computer.

err,have you check these things mentioned by JamesFrance?

Have you tried to turn up the brightness on the screen?
Maby instead of black you will get a grey background.

I would feel alright with that if it was my computer.

Anyway If this happens recently, I bet noone would agree here but you could do a system restore.

Maby that will help.

Well, this is no fix for the virus, but it could solve the wallpaper problem.

Download and install Wallpaper Changer, as it automaticly changes the wallpaper at start-up you should always get your wally back :slight_smile:


Hmmmm… I think you need expert help at some malware removal forums.

If I am in your place, I will go for an easier route, that is, a reformat n fresh install of OS.