Help from spyware infection

147ak477

after infection
always have pop ups
desktop background cannot be changed


i tried
yahoo taskbar
microsoft antispyware
norton
use them scan and remove

but still have prob

also computer is really slow....
please hlpe me

147ak477

i downloaded hijackthis
scanned.... but dunno how to find which one is problematic and clear

147ak477

attached
pls rename it to  .log instead of .rar to view

thanks

147ak477

thanks but i have some problem

導出後再DEL，睇下有問題，若有，再導入返
how to do this?
i scanned, and cliked those item and click fix checked, it said i will permanantly remove those item..so i clicked no....



—— 入註冊表，start——run,type regedit
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop" ,  --- i can find this, value is 0
"NoActiveDesktopChanges" ---- cannot find this


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000           - cannot find
"NoDispBackgroundPage"=dword:00000000    -cannot find




[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL", "Search Page"
-- it seems the link are from micorsoft since they start with www.microsoft.com
but i didn't set them

147ak477

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

the other 2 items inside
"force active desktop on"  have  0X0000001 (1)
"no driver typpe autorun" have  0x000091 (145)

does that have probelm?

147ak477

for the desktop problem
i can open the propoerties, but it doesen't me to select other background from the list
i can click change colour but even i click apply , don't have effect
but change screensavers etc is ok

when i just got infected. the desktop change to blue with a large textbox saying  SPYWARE INFECTION. and cannot change background

after i used some other software , microsoft anti-spyware , norton etc to scan and remove the infected files , the desktop become white in background but still cannot change

[ Last edited by 147ak477 on 2006-1-15 at 11:59 AM ]

147ak477

for the filter-031, those files doesn't seem familiar to me
i open registry and can see the functions to import and export

does that mean i should export one set of thoses filter-031 files to one location as backup?
then delete the orignal ones ?

also if change registy do i need to restart to take effect?

147ak477

do not have “No Save Setting” in that folder ...


the names in #12 doesn't look familiar to me

[ Last edited by 147ak477 on 2006-1-15 at 12:16 PM ]

147ak477

Originally posted by gergermen at 2006-1-15 12:31 PM:
REG:system.ini: Shell=explorer. exe...

deleted all of them lu
see if it works

147ak477

still have popo-ups