Options

What is 'Microsoft.Windows.ActiveDesktop'?

Unknown
edited July 2007 in Spyware & Virus Removal
This consistently shows up when I run SpyBot. I quarantine it and then it shows up again.

How so I really get rid of it?? It is 'bad' isn't it?!

Help!!!

PLEASE!!!

Comments

  • Rahina-RescueRahina-Rescue Finland
    edited May 2007
    Hello TeamFic, Welcome!

    Let us Take a look.

    Please download Deckard's System Scanner (DSS) and save it to your Desktop.
    • Close all other windows before proceeding.
    • Double-click on dss.exe and follow the prompts.
    • When it has finished, DSS will open two Notepads: main.txt and extra.txt
    • Use Save As to save both Notepad files to your Desktop and post them in your next reply.
  • TeamFic
    edited May 2007
    Thank you --

    I will attempt this tonight and will post the outcome!
  • Rahina-RescueRahina-Rescue Finland
    edited May 2007
    Ok, Good
  • TeamFic
    edited May 2007
    FINALLY!

    Here are the notebook files as requested.

    I truly appreciate your help and knowledge.
  • Rahina-RescueRahina-Rescue Finland
    edited May 2007
    You should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

    Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

    Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

    Scan with DrWeb-CureIt as follows:
    • Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
    • Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
    • Once the short scan has finished, Click Options > Change settings
    • Choose the "Scan tab" and UNcheck "Heuristic analysis"
    • Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
    • Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
    • When done, a message will be displayed at the bottom advising if any viruses were found.
    • Click "Yes to all" if it asks if you want to cure/move the file.
    • When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
      (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
    • Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
    • Save the DrWeb.csv report to your desktop.
    • Exit Dr.Web Cureit when done.
    • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
    • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
  • TeamFic
    edited June 2007
    Sorry about taking so long... I finally had the time to run DrWeb-CureIt.
    This is the report:

    Process.exe;C:\Documents and Settings\Owner\Desktop\smitRem;Tool.Prockill;
    Moved.;
    KillWind.exe;C:\hp\bin;Tool.ProcessKill;Moved.;
  • TeamFic
    edited July 2007
    Really need help!!! I just quarantined this with Spybot about 30 minutes ago... just ran it again and its back!!!!
  • Rahina-RescueRahina-Rescue Finland
    edited July 2007
    Hello

    Sorry for the delayed response.

    Could you please post a fresh Hijackthis logfile

    Thank you.
Sign In or Register to comment.