Spyware warning background problem, HJT log attached

[Shadowrunner]

to get rid of spy sheriff, get MS anti-spyware and trend micro, run a fukll scan about five times, this WILL NOT fix the background though..

 

[Derm]

background spy warning

Microsoft came out with an alert last week concerning this. Apparently they think this is a huge issue. See www.eweek.com/print_article2/0;1217,a=168152,00.asp. This has a link to the microsft web site. They traced it to Russia and made a link to Vladimir Putin. You can't make this stuff up.

Microsoft is trying to come up with something to remedy the problem. Perhaps we could email them the solution above?

 

[spike2020]

help

hi
Ive got a red desktop background with a black box in the centre - spyware warning software costs $49.99

I CAN change the desktop picture for all of a second by going through control panel icon display etc

but it wont go away
i still have my hopepage as wanadoo (meaning to change that)

My greatest worry is the security of passwords etc for things like online money transfers (Paypal) or ebay

I ran spybot and cleared off some nasties and am currently doing a full AVG

Spike

 

[Tedster]

this is the spysherriff virus or a variant. read the sticky.

 

[spike2020]

I read and have printed the info on this.. i dont have thos programs in my processes though.
the closest i have is ''winlogon.exe''

Thanks
Spike

 

[JackTech]

Solved

I was right.
Today I updated the Ad-Aware SE ad/spyware killer at my brother-in-laws PC.
This program recognized the virus/adware and destroyed it.
I was very hapy I(!) could help him this time.

 

[Derm]

Jacktech,

Did it also fix or re-enable your display properties?

 

[JackTech]

Don't know Derm. Suppose.
I don't see that PC on a daily basis. Next time I pay a visit to my B-I-L
I will check that.
Have you tried Ad-Aware SE?

JackTech

 

[shaetroy]

Help!

I have downloaded the Ad-ware SE program and I have still not been able to get rid of the "Spyware Warning" on my desktop background. Where did you get your versions from?

 

[Derm]

JackTech,

Thanks for responding.

I have tried Spybot, ewido, ADAware SE and Microsofts's downloads and I upgraded my Norton Suite. I have not had a block of time to try what MTnBIker suggested a couple of weeks ago. When this him me it caused two major problems: 1. The hijack of my web page and 2. the spyware ad background that wouldn't go away.

With a computer consutltant and the running of these programs, I got rid of the hijack of my default web page that directed me ironically to anti virus software.

Because of what my consultant did the screen warning which also had a link to anti virus software, is gone but the way he described it, it is really only covered up and running in background but has also locked up my display properties so I cannot use them to set the background, screensaver etc.

This makes me very nervous. ALso, what I have read about microsoft's patch that came out and the patch by a guy named Guilfanov, (1/12/06 CNET news) they protect going forward once downloaded but do nothing to get rid of it if you already had it.

I'm continuing to work on it and I appreciate your assistance. It sounds like Shaetroy and others are in the same boat with me.

Good Luck All

 

[JackTech]

Shaetroy, do you have the latest definitions (11.01.2006)?

Derm, have not yet been there, but as I remember I deleted the file(s) shdocha.exe manually a month ago and i removed all registry values of shdocha manually. I also changed the openingpage of I.E. in the registry to about:blank. That worked but the black screen came back.
Changing the screenmode to (or from i don't know anymore) active desktop solved it for a short time, but when starting explorer or IE the black screen came back. Ad-Aware was not aware then.
Last week the version of Ad-Aware detected a couple of registry entries en recognized them as malware. I let him remove this garbage. The black screen was gone and did not return when explorer or IE was started. I concluded that the problem was solved since we had no problems anymore...
B.t.w. that PC was (and is) running Windows ME. Maybe there is a difference with this virus in XP? I will not try that on my (virusfree) XP-PC as you might understand.

Good luck all

 

[Derm]

jacktech,

just to update you. I updated my Adaware and ran it but it did not clean up this last aspect with the display properties. I'll keep working on it.

I appreciate the help and suggestions of the BOard.

 

[bbentz]

Hello all,
I ran across a computer that had a desktop with a black background and warning you are infected with spyware or a virus message. I did some digging and found there was a html file called secure or security and it was the background. I deleted it but I was unable to change the desktop. I went into DISPLAY PROPERTIES > DESKTOP tab > CUSTOMIZE DESKTOP button > WEB tab - there's a checkbox to LOCK THE DESKTOP ITEMS plus above this checkbox it where you can add a webpage as your desktop. Make sure to uncheck the checkbox and remove any webpages that are listed in there besides MY CURRENT HOME PAGE which is there by default. This should allow you to change your desktop. The client did not want me to do a virus or spyware removal so I do not know what was the cause of the infection.

Bill

 

[Derm]

bbentz,

Thanks for your suggestion. I did that but, alas, I am still stuck with a stuck "display properties."

I seem not to have a large block of time to try some of the other fixes suggested.

Oh well
Derm