Jump to content


Photo

No clue what if this is a trojan or virus but it's


  • Please log in to reply
15 replies to this topic

#1 OptimusDigger

OptimusDigger

    Member

  • Full Member
  • Pip
  • 35 posts

Posted 28 June 2004 - 01:03 AM

I accidently came across a broken link and now this stupid 'warning you're in danger' and goes on about files that can 'break you' etc etc. Basically One of those 'secure your tracks and erase your tracks' things has set itself over my desktop and I can't remove it!

Any ideas?

#2 OptimusDigger

OptimusDigger

    Member

  • Full Member
  • Pip
  • 35 posts

Posted 28 June 2004 - 01:41 AM

Here;s the link the damn thing on my desktop leads you to.

http://www.smart-sec...fo/?affid=DNN-1

#3 thethe3k

thethe3k

    Member

  • New Member
  • Pip
  • 1 posts

Posted 28 June 2004 - 12:44 PM

i had that too, some how they changed your desktop to a web page, a friend got rid of that, but im not sure how. ll ask

#4 OptimusDigger

OptimusDigger

    Member

  • Full Member
  • Pip
  • 35 posts

Posted 28 June 2004 - 05:42 PM

I'd be most grateful if you can get back to me on how I can be rid of it. ^^

#5 OptimusDigger

OptimusDigger

    Member

  • Full Member
  • Pip
  • 35 posts

Posted 02 July 2004 - 08:12 PM

...Does anybody else know how I can get this damn thing off my desktop?

#6 dave38

dave38

    Devout Murphyite!

  • Emeritus
  • PipPipPipPipPip
  • 8,508 posts

Posted 03 July 2004 - 06:55 AM

We need a closer look at what's happening.
Please download Hijack this
Copy it into its own folder, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, do Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.
Be wary of strong drink. It may make you shoot at tax collectors, and miss!
Please support SWI forum

#7 OptimusDigger

OptimusDigger

    Member

  • Full Member
  • Pip
  • 35 posts

Posted 05 July 2004 - 01:52 PM

Logfile of HijackThis v1.97.7
Scan saved at 2:51:24 PM, on 7/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\George Jr\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup


Here's my latest Hijack-This log

#8 dave38

dave38

    Devout Murphyite!

  • Emeritus
  • PipPipPipPipPip
  • 8,508 posts

Posted 05 July 2004 - 03:47 PM

Is that the COMPLETE log?? There should be several more entries in the second part.
Be wary of strong drink. It may make you shoot at tax collectors, and miss!
Please support SWI forum

#9 OptimusDigger

OptimusDigger

    Member

  • Full Member
  • Pip
  • 35 posts

Posted 05 July 2004 - 06:31 PM

Here's another log.

thethe3k said what's up with my compuer is a website of some sort I came via a broken link has placed itself over my desktop background.

Logfile of HijackThis v1.97.7
Scan saved at 7:30:29 PM, on 7/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\George Jr\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.micr...922/wmv9VCM.CAB

#10 OptimusDigger

OptimusDigger

    Member

  • Full Member
  • Pip
  • 35 posts

Posted 16 July 2004 - 12:28 AM

I hate to be a nag, but does ANYONE know how to get rid of this thing? It's making it almost impossible for me to work at some of the message boards I work on save this and two others, plus alot of my desktop functions are shot because the damn thing has pasted itself over my desktop background.

#11 OptimusDigger

OptimusDigger

    Member

  • Full Member
  • Pip
  • 35 posts

Posted 18 July 2004 - 12:30 AM

Okay here's what is wrong with my computer.

My desktop background is covered by a black wegpage backdrop and in the middle is a message and a word-link for some anti-spyware software for sale.

This is what is displayed in the square in the middle of the pagem annd the removal insturctions words on the bottom lead to the link I pasted below.


ALL YOU DO WITH COMPUTER IS STORED FOREVER IN YOUR HARD DISK. WHEN YOU VISIT SITES, SEND EMAILS... ALL YOUR ACTIONS ARE LOGGED. AND IT IS IMPOSSIBLE TO REMOVE THEM WITH STANDARD TOOLS. YOUR DATA IS STILL AVAILABLE FOR FORENSICS. AND IN SOME CASES FOR YOUR BOSS, YOUR FRIENDS, YOUR WIFE, YOUR CHILDREN.

Every site you or somebody or even something, like spyware, opened in your browser, with all images, and all downloaded and maybe later removed movies or mp3 songs - ARE STILL THERE and could broke your life!


SECURE YOURSELF RIGHT NOW!

Removal instructions

http://www.smart-sec...fo/?affid=DNN-1

#12 LineOFire

LineOFire

    Malware Assassin

  • Retired Staff
  • PipPipPipPipPip
  • 1,267 posts

Posted 18 July 2004 - 12:41 AM

Yeah, I've seen people with this thing before. To get rid of that ad on your desktop do this:

Right-Click on Desktop, choose Properties, go to the Desktop tab, click Customize Desktop, go to the Web tab, and uncheck the webpage Security. Click OK and it should be done.

#13 Crazy007

Crazy007

    Member

  • New Member
  • Pip
  • 2 posts

Posted 18 July 2004 - 12:42 AM

I think I just had the same problem. Unfornunately, I had no clue, (and still have no clue), of what in the world I was doing, but I searched for files that were created today, deleted them, but now the desktop turned white. Another thing, when I turn the resolution of my moniter up, the 'white' is only in the top left and covers part of my desktop, instead of the whole thing.

#14 OptimusDigger

OptimusDigger

    Member

  • Full Member
  • Pip
  • 35 posts

Posted 18 July 2004 - 01:10 AM

THANK YOU LineofFire!!!

#15 Crazy007

Crazy007

    Member

  • New Member
  • Pip
  • 2 posts

Posted 18 July 2004 - 01:14 AM

Yeah, your solution worked :lol:

#16 LineOFire

LineOFire

    Malware Assassin

  • Retired Staff
  • PipPipPipPipPip
  • 1,267 posts

Posted 18 July 2004 - 01:55 AM

No problem. Glad I could help. :D




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button