Re: Getting rid of malware screen theme

From: pcbutts1 (pcbutts1_at_seedsv.com)
Date: 07/31/05 

Date: Sun, 31 Jul 2005 02:23:04 GMT

Download, install, update and run all of the following.

Ad-Aware
http://www.pcbutts1.com/downloads/aawsepersonal.exe

Spybot search and destroy
http://www.pcbutts1.com/downloads/spybotsd14.exe

Microsoft Windows AntiSpyware (Beta1)
http://www.microsoft.com/downloads/details.aspx?FamilyId=321CD7A2-6A57-4C57-A8BD-DBF62EDA9671&displaylang=en

If none of the above fixes the issue then download Hijack this, run it, save
a copy of the log file and cut and paste it back here to the group so that I
can analyze it.

HijackThis
http://www.pcbutts1.com/downloads/HijackThis.zip 

-- 
The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system  W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com
"Martin" <nagasml@netscape.net> wrote in message 
news:1122771295.954822.260890@z14g2000cwz.googlegroups.com...
> Just as I was ending an internet session, I found that the opening
> "wallpaper image" - or maybe 'theme' is the proper word? - had been
> hijacked by an unwanted ad for a spy removal ware called PSguard. So
> far the functions are not affected, but it's very irritating - the
> screen jet black against an intrusive message - and a quick check on
> the web confirmed it's a recent malware.
> However it seems, of course, to have blocked the function for changing
> screen wallpaper, so I can't shuck it out that way. How do I get around
> this?
>
> The PC runs on Win XP with Norton firewall and Antivirus, it's not part
> of a LAN, and otherwise it's free of manifest virus problems.
>
> note: I just checked the activities manager and there are two processes
> which could be suspect: NPROTECT.EXE and NPFMNTOR.EXE (both using
> several megs of memory right now) Those two normally belong with
> Norton, but a spyware or adware could pose under these names, couldn't
> it? They can't be closed down, however.
>
> any tips appreciated
>
> Martin, Sweden
>