[MichelleB99]

Ok, this is really weird, but I just came down to the computer and the entire screen was covered with all of my icons. I would say I had between 20-30 icons, and now I have 140+. They are all the same ones, and the duplicates have a number next to them indicating the order of repetition. The highest numbr I have seen in () is 21...

In the upper left hand corner where my Recycle Bin is, it looks like a tornado is going on there...I think that's what's duplicating the icons, because it keeps flashing and I can see several layers of icons blinking on top of each other.

My son was playing a computer game earlier and other than that, we haven't had any strange activity. I ran Clean Up, for lack of not doing anything.

What on earth is going on, and can it be easily fixed?

Thanks!

[Advertisements]

Hello, MichelleB99.

What is the icon of, if I may ask? Have you tried rebooting, if so, has it stopped multiplying so you can select all of them and delete them? Rebooting should stop whatever program is doing it, unless it's a joke program or malware related.

[OwNt]

Hello, MichelleB99.

What is the icon of, if I may ask? Have you tried rebooting, if so, has it stopped multiplying so you can select all of them and delete them? Rebooting should stop whatever program is doing it, unless it's a joke program or malware related.

[MichelleB99]

Sure, no problem...my icons are:
Ad-Aware, Adobe Reader, AIM, AVG Free, Record This, Calander Creator, Camedia (digital camera), Clean Up, Deduction Pro, Elmo's Preschool, AOL, H&R Block, Hijack This, I SPY Preschool game, Internet Explorer, Outlook Express, Printmaster, Quicktime, Real Arcade, misc Shortcuts, Spybot, Turbo Tax and Broderbund.


Yes, I've tried logging off and rebooting, with no luck. I sure hope it's not mal-related...it took me forever to clean up my computer from a nasty infection earlier...UGH!

Also, here is my Hijack This log:

Logfile of HijackThis v1.99.1
Scan saved at 4:39:45 PM, on 9/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\ScanSoft\Pagis\Monitor.exe
C:\Program Files\ScanSoft\Pagis\Ereg\REMIND32.EXE
C:\Documents and Settings\Michelle Bain\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/flash/index.cfm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program Files\ScanSoft\Pagis\Ereg\REMIND32.EXE
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: Pagis Schedule Monitor.lnk = C:\Program Files\ScanSoft\Pagis\Monitor.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.clarkcolo...larkActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1119994519875
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://echat.us.del...t/TLIEFlash.CAB
O16 - DPF: {F461205D-ABDC-42FE-B2E2-AFD4600B905E} (MASHControl Class) - http://www.amiuptoda...,0,0,7/mash.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

Thanks!

[OwNt]

Hello, MichelleB99.

Your Hijackthis log is clean, no information there =/

It sounds from what your describing that someone the icons got copied and accidentally pasted multiple times somehow. Are the icons still copying themselves, or have they stopped? Have you tried selecting all the copies and deleting them yet?

[Johanna]

Do a System Restore to before the problem ASAP. Post back if problem reoccurs.

Johanna

[MichelleB99]

Hi OwNt and Johanna,

Yes, I tried deleting all of them last night and it appeared to be working, but after I was all done, they all came back.

I was completely clueless until I took Johanna's advice and went into system restore, and at the point where you select a restore point, it had yesterday's date and time of 4:14pm and listed "Software Distribution Service 2.0", and that's approximately the time that my system went all buggy, as I made my first post at 4:29pm (and had tried on my own for a bit to troubleshoot).

What exactly is this service, and do I have to worry about it again? Just weird coincidence?

Thanks to you both for your time. Have a great day and weekend!
Michelle

[gerryf]

wait up a second....is this a work computer on a domain?

Software Distribution Service is a MS deployment service used to send out updates, patches, software. If something went wrong, you really need to let your IT department know about this, not just because it is messing up your machine, but it could be indicative of another problem.

[MichelleB99]

Nope, I'm at home. This is the only computer we have, and it's not linked into a network or other domain.

Should I not be receiving/accessing Software Distribution Service otherwise? Should I be concerned that its on my system?

Here's about where my computer literacy ends!

Thanks for your help!
Michelle