[iisupreme11]

all shortcuts are displayed on the PC as html pages e.g a shortcut to MS Word is linked to a web page and will not open the application. likewise any executable created as a shortcut appears the same way. Will I need to inreinstall the Op. system please help.

[Advertisements]

Every single shortcut? This is probably a virus.

Do me a favor to better help you tho, right click and press properties and make sure all the destionations are correct.

Hopefully I can help further

[Mycah]

Every single shortcut? This is probably a virus.

Do me a favor to better help you tho, right click and press properties and make sure all the destionations are correct.

Hopefully I can help further

[iisupreme11]

I checked the properties and the destinations are correct, when I click on the shortcut to open it nothing happens

[Resident_Blonde]

iisupreme11 Hi hun, and welcome to GTG!

PLEASE.... Do not follow peoples help that is outside of GTG Staff if it could be a virus/Malware...


Thank You


A Registered Staff member will help you out as soon as possible...

[Metallica]

Can you rightclick one of those shortcuts and look under properties and post what is listed under "Target"

Regards,

[iisupreme11]

Thanks

I am away from the PC in question, but I will check the shortcuts and post the details later.

[iisupreme11]

The PC was just turned on and the following error was received on the desktop

Spyware remover TIvirus

00010e36 error caused by TrojanSpy htmlsmithfraud.com
System cannot function in a normal mode
Please check your security settings
TIvirus spyremover Texplorer is a problem

What should I do next.

[Metallica]

Then please follow the instructions here:
http://www.geekstogo..._Log-t2852.html

Post the resulting log in the malware section of the board.

Regards,

[iisupreme11]

I have downloaded some of the programs suggested from the url posted, the only one i have been able to install is ad-aware. When I click on the .exe the following error appears

Internet Explorer script error: An error has occurred in the script on this page
Line: 260
Char: 4
Error: Object doesn't support this property or method
Code: 0
URL: file://C\windows\web\folder.htt

do you want to continue running scripts on this page Yes/No

If i click yes or no and attempt to run the .exe again nothing happens.

Will i need to copy these programs to CD

[Metallica]

Try as much as you can and post a HijackThis log.

One thing that might clear things up a bit is if you download and doubleclick this file:
http://metallica.gee...m/smitfraud.reg

Confirm you want to merge it with the registry and reboot.

Regards,

[iisupreme11]

Thanks

I have managed to install the programs using the run command from the start menu. So far I have run Cleanup (which is quite an amazing tool that should be standard on all PC's), ad-aware, cwshredder, spy-bot and housecall (which found the two trojans Trojan Agent J and Trojan Hijack B). I am currently downloading the AVG anti virus software and will apply the registry merge you supplied.

If the shortcut issue still remains after a re-boot I will post the results of the Hijack this scan.

Thanks again this has been a great learning curve.

[iisupreme11]

Hi

I installed AVG and ran a scan which picked up 3 additional trojans, but AVG stopped my mouse from working, therefore I had to uninstall it.

Also when I try to select the properties to change the desktop appearance the open with box appears.

I will download HijackThis and post a log

[iisupreme11]

Hi

Here is the HijackThis.Log extract

Logfile of HijackThis v1.99.1
Scan saved at 12:35:00 AM, on 6/25/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\CMMON32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\DOWNLOADS\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R3 - Default URLSearchHook is missing
O1 - Hosts: 1159680172 auto.search.msn.com
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - super-spider.com - (no file)
O9 - Extra button: (no name) - couldnotfind.com - (no file)
O9 - Extra button: (no name) - webanalsex.com - (no file)
O9 - Extra button: (no name) - spyorgy.net - (no file)
O9 - Extra button: (no name) - thestas.com - (no file)
O9 - Extra button: (no name) - allcrazyporn.com - (no file)
O9 - Extra button: (no name) - greg-tut.com - (no file)
O9 - Extra button: (no name) - mig29here.com - (no file)
O9 - Extra button: (no name) - t34rulit.com - (no file)
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw10fd.law10....ex/HMAtchmt.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O19 - User stylesheet: (file missing)

[Metallica]

Do you have a Ignorelist for HijackThis?

I really need to se the full picture.

Download: DelDomains.inf
Should the link above display the text instead of downloading the file, then copy & paste the text into notepad and save the file as DellDomains.inf
To use: right-click and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.

Download the Hoster from HERE Press "Restore Original Hosts" and press "OK". Exit Program.

Check the following items in HijackThis.
Close all windows except HijackThis and click Fix checked:

O9 - Extra button: (no name) - super-spider.com - (no file)
O9 - Extra button: (no name) - couldnotfind.com - (no file)
O9 - Extra button: (no name) - webanalsex.com - (no file)
O9 - Extra button: (no name) - spyorgy.net - (no file)
O9 - Extra button: (no name) - thestas.com - (no file)
O9 - Extra button: (no name) - allcrazyporn.com - (no file)
O9 - Extra button: (no name) - greg-tut.com - (no file)
O9 - Extra button: (no name) - mig29here.com - (no file)
O9 - Extra button: (no name) - t34rulit.com - (no file)

O19 - User stylesheet: (file missing)

Then reboot and try to download and install SP1 for IE.

Regards,

[iisupreme11]

Hi

I have applied the files and SP1 for IE as suggested.

Now when I click on the shortcuts on the desktop the file download dialogue box appears.

Also I checked the HijackThis config details and there is nothing in the ignorelist.

In addition as mentioned before when I try to launch the desktop properties the open with dialogue box appears asking which program to use to open the file rundll32.exe and why would AVG make my mouse stop working.

Thanks for your help