Please Help: trojan-spy.html.smitfraud.c [Archive]

View Full Version : Please Help: trojan-spy.html.smitfraud.c

Ruslan

30 Apr 2005, 5:36pm

Hi, my name is Ruslan, I use a software called Deep Freeze that can frozen your computer so when you restart the system, everything is back normal (as it was before you frozen it). So I just set it on "Thawed" and restarted my computer to install some Adobe software I Downloaded in my Local Disc G:.

And lots of spyware got in my computer, I used Spyware Doctor, Spybot S&D, Ad-Aware SE Personal & SpySubstract to clean my PC, so There is one or more i think, spyware that was not deleted or detected, a tool bar on top of my IE navigator, and then my desktop wallpaper changes to:

Security Warning: A fatal error has occured at ... Error was caused by: Trojan-spy.html.smitfraud.c

I read some threads and used "HijackThis"

Logfile of HijackThis v1.99.1
Scan saved at 11:21:53 AM, on 4/30/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Archivos de programa\HyperTechnologies\Deep Freeze\DfServEx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\HyperTechnologies\Deep Freeze\_$Df\FrzState.exe
C:\WINDOWS\LTSMMSG.exe
C:\Archivos de programa\QuickTime\qttask.exe
C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\Spyware Doctor\swdoctor.exe
C:\Archivos de programa\PhanTim3\PhanTim3.exe
C:\Archivos de programa\Sony Corporation\Image Transfer\SonyTray.exe
C:\Archivos de programa\Sony\VAIO Action Setup\VAServ.exe
C:\CFusionMX7\runtime\bin\jrunsvc.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
c:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\CFusionMX7\runtime\bin\jrun.exe
C:\WINDOWS\system32\sdkpq32.exe
c:\wp.exe
c:\archiv~1\intern~1\iexplore.exe
C:\WINDOWS\system32\ipdi32.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.urtpwatfdevzt.com/xGzjn_3gVJifnYYOKA7ZVGRFSNOaEp2qrf2zpESSK693mKNCLbw1h9ATqVQAaOaf.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = V�nculos
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {47B53421-0DCB-C3EA-A451-2E8EDBE2B5BD} - C:\WINDOWS\system32\apiko32.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: GetPostLog module - {C9B0D3DC-DC2B-4a17-8E34-02CD4C1E573F} - C:\WINDOWS\gpl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Archivos de programa\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O6 "USB001" /M "Stylus C62"
O4 - HKLM\..\Run: [build support link defy] C:\Documents and Settings\All Users\Datos de programa\trans wave build support\hide dumb.exe
O4 - HKLM\..\Run: [sdkpq32.exe] C:\WINDOWS\system32\sdkpq32.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Archivos de programa\Security iGuard\Security iGuard.exe
O4 - HKLM\..\RunOnce: [ipdi32.exe] C:\WINDOWS\system32\ipdi32.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Archivos de programa\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [ares] "C:\Archivos de programa\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [PhanTim30] "C:\Archivos de programa\PhanTim3\PhanTim3.exe" 0
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BendOkay] C:\DOCUME~1\Admin\DATOSD~1\GREATL~1\Binprogramlicense.exe
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\ARCHIV~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\MSMSGS.EXE
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\ARCHIV~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\ARCHIV~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {ACF9C2AD-3D22-4885-8D5C-2325BA6227DB} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {ACF9C2AD-3D22-4885-8D5C-2325BA6227DB} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Archivos de programa\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony-latin.com/registration/vaio
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.130/e9xr2.chm::/file.exe
O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
O23 - Service: Network Security Service ( 11F��#��`I) - Unknown owner - C:\WINDOWS\sysey.exe (file missing)
O23 - Service: ColdFusion MX 7 Application Server - Macromedia Inc. - C:\CFusionMX7\runtime\bin\jrunsvc.exe
O23 - Service: DFServEx - Hyper Technologies Inc. - C:\Archivos de programa\HyperTechnologies\Deep Freeze\DfServEx.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Archivos de programa\Archivos comunes\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Archivos de programa\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\ARCHIV~1\ARCHIV~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Archivos de programa\Trend Micro\PC-cillin 2002\Tmntsrv.exe

If anyone can help me, Please, I'd appresiate it.

Ruslan from mexico.

SpywareShooter

30 Apr 2005, 6:50pm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.urtpwatfdevzt.com/xGzjn_...ATqVQAaOaf.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = V�nculos
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {47B53421-0DCB-C3EA-A451-2E8EDBE2B5BD} - C:\WINDOWS\system32\apiko32.dll
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [build support link defy] C:\Documents and Settings\All Users\Datos de programa\trans wave build support\hide dumb.exe
O4 - HKLM\..\Run: [sdkpq32.exe] C:\WINDOWS\system32\sdkpq32.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Archivos de programa\Security iGuard\Security iGuard.exe
O4 - HKLM\..\RunOnce: [ipdi32.exe] C:\WINDOWS\system32\ipdi32.exe
O4 - HKCU\..\Run: [BendOkay] C:\DOCUME~1\Admin\DATOSD~1\GREATL~1\Binprogramlice nse.exe
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.130/e9xr2.chm::/file.exe
O23 - Service: Network Security Service ( 11F��#��`I) - Unknown owner - C:\WINDOWS\sysey.exe (file missing)

Fix those entries then find and delete the following files:
C:\WINDOWS\system32\csrao.dll
C:\WINDOWS\system32\apiko32.dll
C:\Archivos de programa\MessengerPlus! 3\
C:\Documents and Settings\All Users\Datos de programa\trans wave build support\hide dumb.exe
C:\WINDOWS\system32\sdkpq32.exe
C:\Archivos de programa\Security iGuard\
C:\WINDOWS\system32\ipdi32.exe
C:\DOCUME~1\Admin\DATOSD~1\GREATL~1\Binprogramlice nse.exe
c:\wp.exe

Then restart your computer and post a new log.

Ruslan

30 Apr 2005, 7:16pm

Thanks, it worked! BUT...

The desktop wallpaper i had does not appear, in stead, its all black, and
i can't change it...
Screenshot:

http://img.photobucket.com/albums/v369/skate_am/screen.jpg

-------- Log
Logfile of HijackThis v1.99.1
Scan saved at 1:12:03 PM, on 4/30/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Archivos de programa\HyperTechnologies\Deep Freeze\DfServEx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\LTSMMSG.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Archivos de programa\iTunes\iTunesHelper.exe
C:\Archivos de programa\QuickTime\qttask.exe
C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE
C:\Archivos de programa\Spyware Doctor\swdoctor.exe
C:\Archivos de programa\Ares Lite Edition\Ares.exe
C:\Archivos de programa\PhanTim3\PhanTim3.exe
C:\Archivos de programa\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Archivos de programa\Sony\VAIO Action Setup\VAServ.exe
C:\CFusionMX7\runtime\bin\jrunsvc.exe
C:\CFusionMX7\runtime\bin\jrun.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\HyperTechnologies\Deep Freeze\_$Df\FrzState.exe
C:\Archivos de programa\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\Archivos de programa\iPod\bin\iPodService.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\ARCHIV~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\ARCHIV~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: GetPostLog module - {C9B0D3DC-DC2B-4a17-8E34-02CD4C1E573F} - C:\WINDOWS\gpl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Archivos de programa\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O6 "USB001" /M "Stylus C62"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Archivos de programa\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [ares] "C:\Archivos de programa\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Archivos de programa\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [PhanTim30] "C:\Archivos de programa\PhanTim3\PhanTim3.exe" 0
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\ARCHIV~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\MSMSGS.EXE
O9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\ARCHIV~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\ARCHIV~1\ELTIMA~1\FLASHD~1\iebt.dll (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {ACF9C2AD-3D22-4885-8D5C-2325BA6227DB} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {ACF9C2AD-3D22-4885-8D5C-2325BA6227DB} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Archivos de programa\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony-latin.com/registration/vaio
O20 - Winlogon Notify: DfLogon - C:\WINDOWS\SYSTEM32\LogonDll.dll
O23 - Service: Network Security Service ( 11F��#��`I) - Unknown owner - C:\WINDOWS\sysey.exe (file missing)
O23 - Service: ColdFusion MX 7 Application Server - Macromedia Inc. - C:\CFusionMX7\runtime\bin\jrunsvc.exe
O23 - Service: DFServEx - Hyper Technologies Inc. - C:\Archivos de programa\HyperTechnologies\Deep Freeze\DfServEx.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Archivos de programa\Archivos comunes\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Archivos de programa\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\ARCHIV~1\ARCHIV~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Archivos de programa\Trend Micro\PC-cillin 2002\Tmntsrv.exe

PD: I did not delete nothing of Messenger Plus, i downloaded it, and i like it.

HeartSmasherElite

30 Apr 2005, 7:27pm

Are you the administrator
Disable Deepfreeze it is a horrible program that really makes me mad
It sometimes will lock you out of changing some of the desktop properties without your knowledge.

I tried it out I went to change my screen resoultion and nothing happened and the deepfreeze icon turned off and on everytime I tried to change the size.

I had to use system restore and reboot in safe mode just to remove the program. I hope you don't have to do this.

Just disable it if you don't need it on right know

HeartSmasherElite

30 Apr 2005, 7:36pm

If you can't change the background through properties use Windows Explorer or IE or Mozilla.

Right click the picture and click on Set As Background Picutre in IE Explore
or Set as Wallpaper in Mozilla

Let me know if it works and if it doesn't I 'll have to figure out how to do it from the registry for you.

Ruslan

30 Apr 2005, 7:44pm

It worked :D i did that with IE..., well now, about Deep Freeze.. it works well with me, and i like it... i'm sorry it didn't wok for you.. well maybe it was a problem with that copy you installed, so.. thanks a lot for the attention all of you, i appreciate it, and recomend you with my firneds beacuse you really help a lot! Thanx to you Spyware Shooter....

HeartSmasherElite

30 Apr 2005, 7:50pm

No actually it was at a school and I fixed it by removing it from the registry and startup so ...

Well so it couldn't start hahaha :thumbsup:

HeartSmasherElite

30 Apr 2005, 7:56pm

I think spyware shooter is a software developer maybe he can make a get around. So you
still have a bunch of selections alternatives instead of properties.

And if you still can't use make a folder somewhere on your computer with all the pictures you would like to use for your desktop background.

Can you change all of the other properties?

SpywareShooter

30 Apr 2005, 8:01pm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\csrao.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O23 - Service: Network Security Service ( 11F��#��`I) - Unknown owner - C:\WINDOWS\sysey.exe (file missing)

Fix those entries then find and delete csrao.dll, reboot and post a new log.

This trojan makes a few registry keys that will block you out of the Desktop Properties section. I will find a list of the keys and make a small file for you that will remove them.

HeartSmasherElite

30 Apr 2005, 8:03pm

Thanks spyware shooter that helped me too.
Had same problem at school for teachers computer.

SpywareShooter

30 Apr 2005, 8:09pm

Okay give this a try. I'm not sure if it'll work though.

First make a backup of your whole registry, just in case. To make a backup go to Start�Run and type Regedit. In the 'File' section click Export, and make sure the dot for "Export All" is checked. Save the file in a place where you wont forget its path (save it on your desktop or in My Documents or something). Download the attached file wallpaper.zip, and extract wallpaper.reg from it. Doubleclick Wallpaper.reg and say Yes to the prompt.

If it works please tell me so I can make it available to the public on spywareshooter.com