[dave_minall]

i have a little red circle with a white cross in it, that keeps popping up little messages like "desctop authorised" and stuff. i also have no control over my wallpaper, the tabs in the display properties have dissapeared!
my homepage has also changed to hot offers or something and keeps popping up stuff about poker.

here is my hijack this log.

Logfile of HijackThis v1.99.1
Scan saved at 20:14:27, on 22/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\keyboard.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\SCardClnt.exe
D:\WINDOWS\System32\wumgrd32.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Media Access\MediaAccK.exe
D:\temp\salm.exe
D:\WINDOWS\vsnqrkx.exe
D:\Program Files\Internet Optimizer\optimize.exe
D:\Program Files\Media Access\MediaAccess.exe
D:\WINDOWS\System32\wuauclt.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\David\My Documents\My downloads\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/ad0179/
R3 - URLSearchHook: (no name) - _{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [System] wumgrd32.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Media Access] D:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [salm] d:\temp\salm.exe
O4 - HKLM\..\Run: [vsnqrkx] D:\WINDOWS\vsnqrkx.exe
O4 - HKLM\..\Run: [Internet Optimizer] "D:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\RunServices: [System] wumgrd32.exe
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...Bridge-c139.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1114079163106
O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/d...onale_ver10.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF3A49C0-BDE1-4A9D-821E-1D1B76AE49DE}: NameServer = 194.72.9.38 194.74.65.69
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - D:\WINDOWS\System32\hwclock.exe
O23 - Service: Keyboard Service System Files (Keyboard Service) - Unknown owner - D:\WINDOWS\System32\keyboard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Smart Card Client (SCardClnt) - Unknown owner - D:\WINDOWS\System32\SCardClnt.exe

thanks all

[Advertisements]

Before we help clean up your computer- it wont do any good unless you update your computer to atleast SP1 or your computer will just get re-infected...go online to windows update and install SP1 and then repost with a new log

[Hemal]

Before we help clean up your computer- it wont do any good unless you update your computer to atleast SP1 or your computer will just get re-infected...go online to windows update and install SP1 and then repost with a new log

[dave_minall]

does SP1 make a lot of difference then?