Getting rid of malware screen theme

Getting rid of malware screen theme
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Getting rid of malware screen theme Martin 07-30-2005
Posted by Martin on July 30, 2005, 6:01 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Just as I was ending an internet session, I found that the opening
"wallpaper image" - or maybe 'theme' is the proper word? - had been
hijacked by an unwanted ad for a spy removal ware called PSguard. So
far the functions are not affected, but it's very irritating - the
screen jet black against an intrusive message - and a quick check on
the web confirmed it's a recent malware.
However it seems, of course, to have blocked the function for changing
screen wallpaper, so I can't shuck it out that way. How do I get around
this?

The PC runs on Win XP with Norton firewall and Antivirus, it's not part
of a LAN, and otherwise it's free of manifest virus problems.

note: I just checked the activities manager and there are two processes
which could be suspect: NPROTECT.EXE and NPFMNTOR.EXE (both using
several megs of memory right now) Those two normally belong with
Norton, but a spyware or adware could pose under these names, couldn't
it? They can't be closed down, however.

any tips appreciated

Martin, Sweden



Posted by pcbutts1 on July 31, 2005, 2:23 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Download, install, update and run all of the following.

Ad-Aware
http://www.pcbutts1.com/downloads/aawsepersonal.exe

Spybot search and destroy
http://www.pcbutts1.com/downloads/spybotsd14.exe

Microsoft Windows AntiSpyware (Beta1)
http://www.microsoft.com/downloads/details.aspx?FamilyId=321CD7A2-6A57-4C57-A8BD-DBF62EDA9671&displaylang=en

If none of the above fixes the issue then download Hijack this, run it, save
a copy of the log file and cut and paste it back here to the group so that I
can analyze it.

HijackThis
http://www.pcbutts1.com/downloads/HijackThis.zip

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com



> Just as I was ending an internet session, I found that the opening
> "wallpaper image" - or maybe 'theme' is the proper word? - had been
> hijacked by an unwanted ad for a spy removal ware called PSguard. So
> far the functions are not affected, but it's very irritating - the
> screen jet black against an intrusive message - and a quick check on
> the web confirmed it's a recent malware.
> However it seems, of course, to have blocked the function for changing
> screen wallpaper, so I can't shuck it out that way. How do I get around
> this?
>
> The PC runs on Win XP with Norton firewall and Antivirus, it's not part
> of a LAN, and otherwise it's free of manifest virus problems.
>
> note: I just checked the activities manager and there are two processes
> which could be suspect: NPROTECT.EXE and NPFMNTOR.EXE (both using
> several megs of memory right now) Those two normally belong with
> Norton, but a spyware or adware could pose under these names, couldn't
> it? They can't be closed down, however.
>
> any tips appreciated
>
> Martin, Sweden
>




Posted by relic on July 31, 2005, 2:57 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Martin wrote:
> Just as I was ending an internet session, I found that the opening
> "wallpaper image" - or maybe 'theme' is the proper word? - had been
> hijacked by an unwanted ad for a spy removal ware called PSguard. So
> far the functions are not affected, but it's very irritating - the
> screen jet black against an intrusive message - and a quick check on
> the web confirmed it's a recent malware.
> However it seems, of course, to have blocked the function for changing
> screen wallpaper, so I can't shuck it out that way. How do I get
> around this?
>
> The PC runs on Win XP with Norton firewall and Antivirus, it's not
> part of a LAN, and otherwise it's free of manifest virus problems.
>
> note: I just checked the activities manager and there are two
> processes which could be suspect: NPROTECT.EXE and NPFMNTOR.EXE (both
> using several megs of memory right now) Those two normally belong with
> Norton, but a spyware or adware could pose under these names, couldn't
> it? They can't be closed down, however.

*PSGuard Removal*
http://labs.paretologic.com/spyware.aspx?remove=PSGuard

--
If there is a Tourist Season, how come we can't shoot them?




Similar ThreadsPosted
screen saver privilege April 16, 2007, 11:15 pm
Small Screen Security site September 14, 2006, 6:16 am
Screen saver timeout changed to 180 minutes and doesn't activate March 28, 2005, 7:57 pm
Possible infection by malware? June 5, 2005, 5:41 pm
Unwanted Malware October 8, 2005, 5:27 pm
Weird Malware December 22, 2005, 2:34 pm
Malware\spyware Infestation April 28, 2005, 11:23 am
Malware Test Lab - BitDefender January 26, 2007, 12:30 pm
Bin Laden Capture Used as a Lure for Malware August 22, 2006, 9:01 am
Re: OT: Myth # 13: Macs Are Safe From Malware Attacks May 27, 2007, 6:51 pm

The site map in XML format XML site map

Contact Us | Privacy Policy