Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Spy sheriff blues [RESOLVED]

Started by Losian , Jun 19 2005 08:59 AM

This topic is locked

#1
Losian

Posted 19 June 2005 - 08:59 AM

New Member

Member
8 posts

Well it hit me last night before I put my new anti software in :tazz:

So I have gone throught the form I did the clean up then did the ewido software and high jack and I was surprise on how much my software did not do crap. So went and got some good ones to fix that. But I can not get rid of the Spy Sheriff Please help!!!

Logfile of HijackThis v1.99.1
Scan saved at 7:43:35 AM, on 6/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\CA\eTrust\Antivirus\realmon.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\Program Files\Archive\archive.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\AdsGone\adsgone.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CA\eTrust\Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust\Antivirus\InoRT.exe
C:\Program Files\CA\eTrust\Antivirus\InoTask.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\HijackThis.exe

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 7:22:57 AM, 6/19/2005
+ Report-Checksum: 76E2A4D1

+ Date of database: 6/19/2005
+ Version of scan engine: v3.0

+ Duration: 651 min
+ Scanned Files: 186016
+ Speed: 4.76 Files/Second
+ Infected files: 154
+ Removed files: 154
+ Files put in quarantine: 154
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\
D:\

+ Scan result:
C:\WINDOWS\system32\lsp.dll -> Spyware.Sahat.f -> Cleaned with backup
C:\Documents and Settings\Scott\My Documents\3ds max 4.2 X-Force crack\3ds_max_v4.2_Authorization_Patch_Working.RB0/crack.exe -> TrojanDropper.Bridge -> Cleaned with backup
C:\Program Files\Parallel Tasking\ptask.exe -> TrojanDownloader.Small.adg -> Cleaned with backup
C:\Program Files\SearchRelevancy\SearchRelevancy1.dll -> Spyware.Relevance.b -> Cleaned with backup
C:\winstall.exe -> Not-A-Virus.Hoax.Renos.a -> Cleaned with backup
D:\Dvd2\other\mimic - for poser lipsync\mimic for poser.exe/Mimic for poser\BBsPatch.EXE -> Not-A-Virus.VirTool.OptixPatch.04 -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@geocities[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@cgi-bin[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@com[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@overture[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@zedo[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@tradedoubler[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@cms[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@realmedia[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@S130376[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@S113245[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@S130343[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@x10[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@media[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@S005-01-8-16-233860-97291[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@S005-01-4-27-243511-71630[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bcentral[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@ad[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bluestreak[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@geocities[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@40617151[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@geocities[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@S110606[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@cgi-bin[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@oxcash[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@geocities[5].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@us[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@mediaplex[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@atdmt[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bravenet[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@com[4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@xiti[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@doubleclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@com[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@real[4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@gator[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bcentral[4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@zedo[4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][5].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bluestreak[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@6425137[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@targetnet[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bcentral[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bfast[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@hitbox[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@overture[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@geocities[4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@myway[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bravenet[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@list[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@tribalfusion[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@real[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@S144969[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@link[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bluestreak[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@xxxcounter[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@oxcash[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@inet-traffic[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@6425137[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@real[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@tmpad[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@com[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@tribalfusion[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@54564136[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bravenet[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@tryaolfree[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@overture[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@zedo[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@adserv[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@advertising[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][5].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@bcentral[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@valueclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][4].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@realmedia[3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][3].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@fastclick[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott jackson@commission-junction[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\Documents and Settings\Scott Jackson\Cookies\scott [email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
D:\My Downloads\file9.zip/crack.exe -> TrojanDropper.Bridge -> Cleaned with backup
D:\d drive\iMesh\Client\casino.exe -> Dialer.Generic -> Cleaned with backup
D:\d drive\iMesh\Client\TTIL_imesh.exe -> Spyware.EZula.d -> Cleaned with backup
D:\d drive\iMesh\Client\fsg.exe -> Spyware.Web3000 -> Cleaned with backup
D:\d drive\iMesh\Client\imesh_336.exe -> Spyware.NewDotNet -> Cleaned with backup

::Report End
I rebooted but still can not change my background!!
Thank you for your time in advance.

#2
Trevuren

Posted 19 June 2005 - 09:22 AM

Old Dog

Retired Staff
18,699 posts

Hi Losian, welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

Please repost your HijackThis log inasmuch as the whole bottom half is missing.

Regards,

Trevuren

#3
Losian

Posted 19 June 2005 - 09:27 AM

New Member

Topic Starter
Member
8 posts

Doh, Sorry about that here you go with a new one. Thanks for your help!!!!

Logfile of HijackThis v1.99.1
Scan saved at 8:27:07 AM, on 6/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\CA\eTrust\Antivirus\realmon.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\Program Files\Archive\archive.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\AdsGone\adsgone.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CA\eTrust\Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust\Antivirus\InoRT.exe
C:\Program Files\CA\eTrust\Antivirus\InoTask.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\devldr32.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r2.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r2.attbi.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrust\Antivirus\realmon.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Archive] C:\Program Files\Archive\archive.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: AdsGone 2004.lnk = C:\Program Files\AdsGone\adsgone.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AdsGone - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\AdsGone\adsgone (file missing)
O9 - Extra 'Tools' menuitem: &AdsGone Settings - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\AdsGone\adsgone (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ConferenceRoom Java Client - http://chat.vanpraag...000/java/cr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Digimation Protection Server (DigiPSrv) - Unknown owner - D:\3dsmax4\Digipsrv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\Antivirus\InoTask.exe
O23 - Service: ISEXEng - Unknown owner - C:\WINDOWS\system32\angelex.exe (file missing)
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

#4
Trevuren

Posted 19 June 2005 - 09:52 AM

Old Dog

Retired Staff
18,699 posts

Hi Losian,

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Now let's do some work on your log:

First we need to make all files and folders VISIBLE:

Go to start>control panel>folder options>view (tab)
*choose to "show hidden files and folders,"
*uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
*Close the window with ok
*All hidden files will now be visible

Close all browser windows and RUN HijackThis.
. Click the SCAN button to produce a log.

Place a check mark beside each one of the following items:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Archive] C:\Program Files\Archive\archive.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O23 - Service: ISEXEng - Unknown owner - C:\WINDOWS\system32\angelex.exe (file missing)

Now with all the items selected, delete them by clicking the FIX checked button. Close the HijackThis window and Reboot Your System in Safe Mode

How to use the F8 method to Start Your Computer in Safe Mode

*Restart the computer.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.

Using Windows Explorer, locate the following files/folders, and DELETE them (if they are present):

FILES

C:\winstall.exe
C:\WINDOWS\system32\angelex.exe

FOLDERS (with all their content)

C:\Program Files\Archive

Exit Explorer, and REBOOT BACK INTO NORMAL MODE

Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everytjhing looks now.

Regards,

Trevuren

#5
Losian

Posted 19 June 2005 - 10:28 AM

New Member

Topic Starter
Member
8 posts

Okey follow instructions to the T. Hide protected files where both uncheck already. could not find the file angelex in safemode so I will assume it was deleted. I am still stuck in classic mode and can not change background but spy sheriff has not come up again. so far thank you so much for your help!!!!!!!!!

Logfile of HijackThis v1.99.1
Scan saved at 9:22:51 AM, on 6/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\CA\eTrust\Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust\Antivirus\InoRT.exe
C:\Program Files\CA\eTrust\Antivirus\InoTask.exe
C:\Program Files\CA\eTrust\Antivirus\realmon.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\AdsGone\adsgone.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\devldr32.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r2.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r2.attbi.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrust\Antivirus\realmon.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2H1.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: AdsGone 2004.lnk = C:\Program Files\AdsGone\adsgone.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AdsGone - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\AdsGone\adsgone (file missing)
O9 - Extra 'Tools' menuitem: &AdsGone Settings - {ECC5777A-6E88-BFCE-13CE-81F134789E7B} - C:\Program Files\AdsGone\adsgone (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ConferenceRoom Java Client - http://chat.vanpraag...000/java/cr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Digimation Protection Server (DigiPSrv) - Unknown owner - D:\3dsmax4\Digipsrv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust\Antivirus\InoTask.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

#6
Trevuren

Posted 19 June 2005 - 10:36 AM

Old Dog

Retired Staff
18,699 posts

Try the following, if it doesn't work I have another possibility.

1. Download theme from HERE.

2. Move to C:\Windows\Resources\Themes\Luna

3. Reboot your system

4. Please advise on XP Theme and "spy sherriff"

Regards,

Trevuren

#7
Losian

Posted 19 June 2005 - 10:51 AM

New Member

Topic Starter
Member
8 posts

Okey well I am out of the classic look and now back to xp look which is a lot better. I still can not change background. I can change the color but it will not let me change the picture for the background.

Again thank you so much for your help!!!!!!!!!!!!!!!! :tazz:

#8
Trevuren

Posted 19 June 2005 - 11:09 AM

Old Dog

Retired Staff
18,699 posts

Are you missing any buttond in your display window?

Trevuren

#9
Losian

Posted 19 June 2005 - 11:20 AM

New Member

Topic Starter
Member
8 posts

When you go into Themes the sample is blank(white), it does have the little box the says active window and inside that it has Window Text(in black lettering). Then when you go to the Desktop the only button I can click on is Customize Desktop. Browse and position are greyed out. Even background is grey out where I can not click on anything. Any other buttons are there and are working from switch back and forth on my other computers just to make sure.

#10
Trevuren

Posted 19 June 2005 - 11:26 AM

Old Dog

Retired Staff
18,699 posts

Try this,

1. Copy the content of the following quote box to NOTEPAD ans save it as Tab.reg (Name) and "All Files" for type of files.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktopChanges"=hex:00,00,00,00
"NoActiveDesktop"=dword:00000000
"NoSaveSettings"=dword:00000000
"ClassicShell"=dword:00000000
"NoThemesTab"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoDispSettingsPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"SetVisualStyle"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallPaper"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager]
"ThemeActive"="1"
"DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,72,00,65,00,73,00,6f,00,75,00,72,00,63,00,65,00,73,00,5c,\
00,54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,6c,00,75,00,6e,00,61,00,5c,00,\
6c,00,75,00,6e,00,61,00,2e,00,6d,00,73,00,73,00,74,00,79,00,6c,00,65,00,73,\
00,00,00

2. If you did it correctly, you should now have a little blue cube on your desktop. Doubleclick it and when asked if you want to merge answer "YES"

3. REBOOT your system

4. How is it now?

Trevuren

#11
Losian

Posted 19 June 2005 - 12:05 PM

New Member

Topic Starter
Member
8 posts

I did as you ask, got the reg box merged it and reboot and nothing. still every thing is the same as the above post. Any other tricks you got will try them. Thanks again for your help!!!!!!!!!!1 :tazz:

#12
Trevuren

Posted 19 June 2005 - 12:21 PM

Old Dog

Retired Staff
18,699 posts

Maybe this:

Go to the Control Panel and double-click on Display.
If not already selected, go to the Desktop tab.
Click Customize Desktop... and then go to Web tab.
Click on the Security or similar entry and click Delete to remove the entry.

Trevuren

#13
Losian

Posted 19 June 2005 - 12:25 PM

New Member

Topic Starter
Member
8 posts

Only thing there was view my current home page. I even tried loading a new theme and that did not work either. Hope that might help.

#14
Trevuren

Posted 19 June 2005 - 12:29 PM

Old Dog

Retired Staff
18,699 posts

Right click on http://www.greyknigh...pairDesktop.reg and download that file. Double click on it and click on Yes when it asks you if you want to merge it into the registry. Once that's done, restart your computer.

Login as usual and now right click on your Desktop and go to Properties. Next go to Desktop tab->Customize Desktop button->Web tab. Uncheck everything listed there. Then delete all the entries listed except for 'My Current Home Page'. Click OK and OK.

Trevuren