[Excal]

Can't explain how that happened. I have deleted that file a number of times without anything happening at all to anyones computer.

righ click on the desktop and go to properties. go to settings and adjust the settings to the way your want them.

As far as the screen goes, it sounds like you need to adjust your monitor to make the screen in the center.

hope that helps.


Thanks,



Excal

[Advertisements]

Went to control panel/display. Just to check since I am not sure what to change. Color is now set for 8bit. Monitor says secondary...things are not right!!!

[lannie]

Went to control panel/display. Just to check since I am not sure what to change. Color is now set for 8bit. Monitor says secondary...things are not right!!!

[lannie]

The display settings is showing two options: Default monitor on Radeon 9200-secondary or Multiple monitors on Radeon 9200. I have one do I select first choice? Should I check the box that says extend my windows desktop to monitor? Or use device as primary monitor???

[Excal]

Your going to have to do a little trial and error to see what best fits your computer.
Sounds like the first choice for each.




Excal

[lannie]

Have been able to get it somewhat better, but the view is stretched horizontally on the screen. None of the settings fix the horizontal distortion. Have tried everything I can thing of...am still checking.

[Excal]

On the monitor itself there should be setting to adjust it.


Excal

[lannie]

Got it! I looked up my former settings...and reset everything the way it used to be. It was still a mess on the screen. Stretched with big black border. I left the settings and rebooted. Everything was the way it should be after the reboot. yeah! Now I will complete the other scan. Will let you know when it is done. Sorry for the mess with the display.
Lannie

[Excal]

No Problem at all, I am glad they are back to normal


Excal

[lannie]

You said you only wanted current virus/spyware info...not things in quaratine. What about errors??!!! It already shows 4 viruses in file system and 57 errors. The scan has only been running for 7 minutes! Keep me posted. Thanks for all the help. I am surprised everything is such a mess. I have a good firewall/anti-virus program/and scan constantly for spyware. Don't understand what happened!

[Excal]

Yes please post those.


Thanks,


Excal

[lannie]

Here is the MWAV section that you need. Not sure what to do about the errors, since it found 4,852! I am starting with the infection section and then will ask more advice...

Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "Unknown Toolbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "WeatherBug Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\cpbrkpie.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ActiveData.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\asinst.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\CONFLICT.1\asinst.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ppctl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\GrooveAX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ieatgpc.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\IEAWSDC.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MSNChat45.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\msvcr71.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\navapi.vxd". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\navapi32.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\OTXMedia.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\popcaploader.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ppctl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\PPSDKActiveXScanner.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\Preloader.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\spweng.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\SpyWareKillerBKGD.jpg". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\swksig.dat". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\SymAData.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\tgctlcm.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\WebAAS.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\WONWebLauncherControl.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\WSDownloader.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\xscan53.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\xscan60.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\RMAgentOutput.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\RMAgentOutput.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\xscan60.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\CONFLICT.1\asinst.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Hewlett-Packard\Digital Imaging\{7C8BB31C-E09E-4c7d-BBF1-45E33B467FE1}\Drivers\Scanner\hpqgends.tmp". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2BC66F51-93A8-11D3-BEB6-00105AA9B6AE}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{95EA6620-7E55-4D56-83CF-AB0BACF59C52}" refers to invalid object "C:\WINDOWS\DOWNLO~1\xscan60.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}" refers to invalid object "c:\program files\google\googletoolbar1.dll__BHODemonDisabled". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C2FCEF4E-ACE9-11D3-BEBD-00105AA9B6AE}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{2BC66F43-93A8-11D3-BEB6-00105AA9B6AE}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{4387D200-E98E-4194-9684-44783E8EB4EE}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\CONFLICT.1\asinst.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{56815A80-D921-454E-9484-5B7961DA9040}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\xscan60.ocx". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{C2FCEF41-ACE9-11D3-BEBD-00105AA9B6AE}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{FCE18140-B12B-11D0-B06A-00AA0060271A}" refers to invalid object "E:\msppt8vr.olb". Action Taken: No Action Taken.
Entry "HKCR\ActiveScan_Installer" refers to invalid object "{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}". Action Taken: No Action Taken.
Entry "HKCR\ActiveScan_Installer.1" refers to invalid object "{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}". Action Taken: No Action Taken.
Entry "HKCR\RuFSI.SymUtility" refers to invalid object "{644E432F-49D3-41a1-8DD5-E099162EEEC5}". Action Taken: No Action Taken.
Entry "HKCR\RuFSI.SymUtility.1" refers to invalid object "{644E432F-49D3-41a1-8DD5-E099162EEEC5}". Action Taken: No Action Taken.
Entry "HKCR\Symantec.NavSniff" refers to invalid object "{2BC66F54-93A8-11D3-BEB6-00105AA9B6AE}". Action Taken: No Action Taken.
Entry "HKCR\Symantec.NavSniff.1" refers to invalid object "{2BC66F54-93A8-11D3-BEB6-00105AA9B6AE}". Action Taken: No Action Taken.
Entry "HKCR\XSCAN.XscanCtrl.1" refers to invalid object "{04E214E5-63AF-4236-83C6-A7ADCBF9BD02}". Action Taken: No Action Taken.
File C:\Program Files\Support.com\backup\B4\B44AC5F3d01\859817_5a9917a61_ infected by "Backdoor.Win32.IRC.Zapchast" Virus! Action Taken: No Action Taken.

[Excal]

All those are empty reg entries.

This will clean those up:

• Please dowload: RegSeeker.
• Click on "Clean The Registry" in the left panel.
• Check all boxes (make sure the backup box in the lower left corner is selected!).
• After it runs, click "Select All" on the bottom, then right-click on any selected item in the window and select "Delete Selected Items".
• Click "Quit RegSeeker".

Now, open any of your installed programs, and make sure that everything opens ok. If so, reboot, then go back and run the RegSeeker again, do the same thing again if anything is found. When RegSeeker finds nothing else, then it's clean!


Are all those errors the same? Let me see a few of them if they are not.

Thanks,



Excal

[lannie]

Remember I downloaded and ran RegSeeker per your suggestion the other day. I ran it until clean, but I will run again. How come there is so much new stuff?!

Thanks, Lannie

[Excal]

interesting, Did MWav delete some files before it got to that part?


Can i see the errors please

Excal

[lannie]

Since there are so many I will just give you a random assortment. Not sure if I am doing this right...will just cut and paste sections. When I started going thru the log I found that it was lots and lots of Spybot Search&Destroy (errors) -- how come Log is over 600 pages. Will keep looking as send anything else that seems different. Ran Regseeker several times. It keeps finding stuff. 39 files, than 15, than 20, on and on. Will keep working on that.

Mon Aug 22 16:09:35 2005 => {AA58ED58-01DD-4d91-8333-CF10577473F7} = c:\program files\google\googletoolbar1.dll__BHODemonDisabled
Mon Aug 22 16:09:35 2005 => ERROR!!! Invalid Entry = c:\program files\google\googletoolbar1.dll__BHODemonDisabled (in key Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}). No Action Tak

Mon Aug 22 16:30:52 2005 => C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MSOfficeExcel57.zip not Scanned. Possibly password protected...
Mon Aug 22 16:30:52 2005 => Scanning File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MSOfficeExcel58.zip
Mon Aug 22 16:30:52 2005 => Result: ERROR!!! File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MSOfficeExcel58.zip is Not Scanned
Mon Aug 22 16:30:52 2005 => C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MSOfficeExcel58.zip not Scanned. Possibly password protected...
Mon Aug 22 16:30:52 2005 => Scanning File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MSOfficeExcel59.zip
Mon Aug 22 16:30:52 2005 => Result: ERROR!!! File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MSOfficeExcel59.zip is Not Scanned
Mon Aug 22 19:22:21 2005 => Total Objects Scanned: 130259
Mon Aug 22 19:22:21 2005 => Total Virus(es) Found: 5
Mon Aug 22 19:22:21 2005 => Total Disinfected Files: 0
Mon Aug 22 19:22:21 2005 => Total Files Renamed: 0
Mon Aug 22 19:22:21 2005 => Total Deleted Objects: 0
Mon Aug 22 19:22:21 2005 => Total Errors: 4852
Mon Aug 22 19:22:21 2005 => Time Elapsed: 02:32:11
Mon Aug 22 19:22:21 2005 => Virus Database Date: 2005/08/22
Mon Aug 22 19:22:21 2005 => Virus Database Count: 144970