Hello,
I am not real computer savvy and I have a problem that I hope someone can help me with. I have a virus of some sort that keeps changing my desktop background to black. I have an anti-virus through Qwest, my internet provider.
Can someone help? Please give instructions as if teaching a new computer user. Thank you in advance!
Greetings and welcome to the forums (:WAV),
Please follow this guide, it should be able to take care of the malware, if not, please post a Hijackthis log and we’ll help you further,https://forums.comodo.com/virusmalware_removal_assistance/what_to_do_if_youre_infected_experience_rev2-t32467.0.html
Thanks,
Xan
Thank you for your response. I am assuming that downloading these things and running them should do the trick? I will let you know what happens… What is a hijack log? (told you I am not the sharpest crayon in the box!!) I sure am grateful for folks like you who are willing to use their “smarts” to help the more “challenged” like myself!
“HijackThis” is a program that analyzes and gives info about you system. It puts this info into a log. You can post a log for “smart” people to review. (Well, I’m not totally sure because I’ve never used HijackThis ;D)
(See #8 of Xan’s guide: https://forums.comodo.com/virusmalware_removal_assistance/what_to_do_if_youre_infected_experience_rev2-t32467.0.html )
OK I have downloaded all of the programs you showed me. The only one that “captured” the virus is “SUPERantispyware”. Like I said it captures it but and shows that it is deleted but the black background comes back after about a hour and it shows I am re-infected. This is even with the computer disconnected from the internet. I guess I will now try that “Hijackthis” program you are talking about. Not sure what to do from there.
The virus shows up as a Trojan. Thanks!
How do I do the “Hijack This?” do I look for it under google?
OK, I downloaded “Hijack This” and ran a scan. What do I do with the results? Thanks!
ganda
January 5, 2009, 6:05am
9
post/attach the result here. (you might wanna change the .log extension to .txt )
Click here HJTsetup.exe and download the installer.]Save HJTsetup.exe to your desktop. ]Double click on the HJTsetup.exe icon on your desktop.]By default it will install to C:\Program Files\Hijack This. ]Click on the Do a system scan and save a log file button. It will scan and and then the log will open in notepad.]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log. ]Come back here to this thread and Paste the log in your next reply.DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
OK, Here it is - thank you for your help!
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blankhttp://qwest.live.com http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com http://qwest.live.com Bing http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html Bing http://qwest.live.com http://home.peoplepc.com/search http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com OneDrive @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://qwest.live.com (file missing) (HKCU)http://www.Mybasicisp.net http://www.webkinz.com http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab http://www.funutilities.com/files/SSaver/01/01/PIC_010106_1781.jpg http://wm25.inbox.com/img/logo_inbox_wm.gif http://wm25.inbox.com/inln/857234/1260.0.0.0/a0000006.jpg
–
It looks like the last three items are the source of the problem, funweb products? These free downloads can cause trouble.
Do you have anything called funutilities in your add or remove programs list? If so you could try uninstalling.
I do not have any other solution, so unless anyone else here does I suggest you post on a HijackThis help forum.
Send me a pm if you want help with doing this.
aigle
January 7, 2009, 8:00pm
13
Hi, what security software you are running at the moment. I will suggest three things.
1- Install ThreatFire. Run a scan with SuperAntipsyeware and clean the infection. Now just watch for the malware to change ur desktop again n see if ThreatFire pop ups.
2- Install a HIPS like CFP or Online Armor free( simpler to use- so I highly recommend if you are new to HIPS) and repeat same procedure.
3- Run some rootkit scanners, threatfire has one builtin rootkit scanner. Also try Prevx CSI and gmer.
Let us know how it goes.
Thank you for your reply… I will do the things you suggest and let you know what happens. I am about at my wits end with this for sure. Again, thank you very much!!
aigle
January 9, 2009, 1:57pm
15
Ok, waiting for the reults.
Take care
Thanks for the suggestion, none of that stuff worked. It only slowed down my computer.
ganda
January 10, 2009, 5:26pm
17
err,have you check these things mentioned by JamesFrance?
It looks like the last three items are the source of the problem, funweb products? These free downloads can cause trouble.
Do you have anything called funutilities in your add or remove programs list? If so you could try uninstalling.
I do not have any other solution, so unless anyone else here does I suggest you post on a HijackThis help forum.
Send me a pm if you want help with doing this.
Have you tried to turn up the brightness on the screen?
I would feel alright with that if it was my computer.
Anyway If this happens recently, I bet noone would agree here but you could do a system restore.
Maby that will help.
Well, this is no fix for the virus, but it could solve the wallpaper problem.
Download and install Wallpaper Changer , as it automaticly changes the wallpaper at start-up you should always get your wally back
Xan
aigle
January 10, 2009, 10:35pm
20
Hmmmm… I think you need expert help at some malware removal forums.
If I am in your place, I will go for an easier route, that is, a reformat n fresh install of OS.
