Windows desktop problem

vinylmusic

Using XP SP2
when I start my computer I get the usual illustration, a photo filling the page but when the icons come up the background goes completely white.
I right click the mouse where usually I have a choice to arrange icons but now I get nothing, no options at all
I dont know if it has any relavence but I get an error message saying cannot find C:/Windows/privacy_danger/index.htm
Can anyone help?
Thanks

superscaper

Looks like you're infected with some kind of malware. I'd suggest immediately going through the malware removal guide sticky. What kind of security do you presently have?

Browntoa

Privacy danger is Malware



Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.

When VundoFix re-opens,click the "Scan for Vundo" button.

Once it's done scanning,click the "Remove Vundo" button.
You will receive a prompt asking if you want to remove the files, click "YES".
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed,it will prompt that it will reboot your computer,click "OK".

Post the contents of C:\vundofix.txt into your next reply.

Note:
It is possible that VundoFix encountered a file it could not remove.
In this case,VundoFix will run on reboot,simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

***********************

Please download Combofix and save to your desktop:

http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe

Note:
It is important that it is saved directly to your desktop

Close any open browsers.

Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.

Post the entire contents of C:\ComboFix.txt into your next reply.

Note:
Do not mouseclick combofix's window while it's running.
That may cause the program to freeze/hang.

text copied as i'm lazy....from

http://www.bleepingcomputer.com/forums/topic97656.html

Browntoa

then follow superscrapers advice

superscaper

Browntoa wrote: »

then follow superscrapers advice

which reality is actually a link to your advice. How very cyclic.

Browntoa

worryingly they are now offline, either broke their PC or they are off in safe mode

vinylmusic

Browntoa wrote: »

Privacy danger is Malware

Post the entire contents of C:\ComboFix.txt into your next reply.

Note:
Do not mouseclick combofix's window while it's running.
That may cause the program to freeze/hang.

text copied as i'm lazy....from

http://www.bleepingcomputer.com/forums/topic97656.html

Thanks for helping.
The reading I got is as follows:
ComboFix 07-08-15.3 - "Nic" 2007-08-15 12:36:22.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.185 [GMT 1:00]
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\Nic\FAVORI~1.\Error Cleaner.url
C:\DOCUME~1\Nic\FAVORI~1.\Privacy Protector.url
C:\DOCUME~1\Nic\FAVORI~1.\Spyware&Malware Protection.url

((((((((((((((((((((((((( Files Created from 2007-07-15 to 2007-08-15 )))))))))))))))))))))))))))))))

2007-08-15 12:35 51,200 --a

---

C:\WINDOWS\nircmd.exe
2007-08-15 12:27 <DIR> d

---

C:\VundoFix Backups
2007-08-15 11:24 <DIR> d

---

C:\Program Files\Software Oasis Pop-Up Zapper Utility
2007-08-15 09:50 <DIR> d

---

C:\Program Files\CCleaner
2007-08-15 09:41 <DIR> d

---

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prism
2007-08-15 09:40 929,792 -ra

---

C:\WINDOWS\system32\PRISME5.dll
2007-08-15 09:40 372,825 --a

---

C:\WINDOWS\system32\PRISMAPI.dll
2007-08-15 09:40 290,905 --a

---

C:\WINDOWS\system32\PRISMSVR.exe
2007-08-15 09:40 15,781 -ra

---

C:\WINDOWS\system32\drivers\mdc8021x.sys
2007-08-15 09:40 <DIR> d

---

C:\Program Files\2Wire 802.11g Wireless
2007-08-15 09:38 <DIR> d

---

C:\TWWGUSB_TEMP

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-15 10:07

---

d

---

C:\DOCUME~1\Nic\APPLIC~1\SUPERAntiSpyware.com
2007-08-15 09:40

---

d--h

---

C:\Program Files\InstallShield Installation Information
2007-07-19 07:59 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-18 19:38

---

d

---

C:\Program Files\Common Files\Real
2007-07-18 19:37

---

d

---

C:\DOCUME~1\Nic\APPLIC~1\Real
2007-07-13 22:25

---

d

---

C:\Program Files\Sky
2007-07-13 22:25

---

d

---

C:\Program Files\KService
2007-07-13 00:31 765952 --a--c--- C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-11 00:00

---

d

---

C:\DOCUME~1\Nic\APPLIC~1\AdobeUM
2007-07-10 01:31

---

d

---

C:\Program Files\Common Files\Teleca Shared
2007-07-05 15:59

---

d

---

C:\Program Files\Common Files\Symantec Shared
2007-07-04 22:26

---

d

---

C:\Program Files\Windows Media Connect 2
2007-07-03 00:15 16474 --a

---

C:\smitfrau.reg
2007-06-27 15:34 823808 --a--c--- C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 15:34 671232 --a--c--- C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 15:34 6058496

---

c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 15:34 52224

---

c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 15:34 477696 --a--c--- C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 15:34 459264

---

c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 15:34 44544

---

c--- C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 15:34 384512

---

c--- C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 15:34 383488

---

c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 15:34 27648 --a--c--- C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 15:34 267776

---

c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 15:34 232960

---

c--- C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 15:34 230400

---

c--- C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 15:34 193024 --a--c--- C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 15:34 153088

---

c--- C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 15:34 132608 --a--c--- C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 15:34 124928

---

c--- C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 15:34 1152000 --a--c--- C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 15:34 105984

---

c--- C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 15:34 102400

---

c--- C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 09:27 63488

---

c--- C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 09:27 625152 --a--c--- C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 09:27 13824

---

c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 08:00 161792 --a--c--- C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 07:08 1104896 --a

---

C:\WINDOWS\system32\msxml3.dll
2007-06-26 07:08 1104896

---

c--- C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-25 19:08

---

d

---

C:\DOCUME~1\Nic\APPLIC~1\Leadertech
2007-06-19 14:31 282112 --a

---

C:\WINDOWS\system32\gdi32.dll
2007-06-19 14:31 282112

---

c--- C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 11:23 1033216 --a

---

C:\WINDOWS\explorer.exe
2007-06-13 11:23 1033216

---

c--- C:\WINDOWS\system32\dllcache\explorer.exe
2007-05-17 12:28 549376 --a

---

C:\WINDOWS\system32\oleaut32.dll
2007-05-17 12:28 549376

---

c--- C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-05-16 16:12 86528

---

c--- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 16:12 85504

---

c--- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 16:12 683520 --a

---

C:\WINDOWS\system32\inetcomm.dll
2007-05-16 16:12 683520

---

c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 16:12 510976

---

c--- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 16:12 1314816

---

c--- C:\WINDOWS\system32\dllcache\msoe.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\ATI-CPanel\atiptaxx.exe" [2004-08-12 21:10]
"SoundMan"="SOUNDMAN.EXE" [2004-04-28 17:19 C:\WINDOWS\SOUNDMAN.EXE]
"PinnacleDriverCheck"="C:\WINDOWS\System32\PSDrvCheck.exe" [2004-03-10 16:26]
"PE2CKFNT SE"="C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe" [1998-07-03 12:51]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-10-18 12:58]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-11-06 20:20]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2005-06-17 12:49]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-06-13 06:20]
"btbb_wcm_McciTrayApp"="C:\Program Files\btbb_wcm\McciTrayApp.exe" [2006-11-30 11:51]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 16:19]
"Motive SmartBridge"="C:\PROGRA~1\BTBROA~2\SMARTB~1\BTHelpNotifier.exe" [2006-05-24 13:20]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2006-08-31 16:01]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-07-05 16:52]
"PRISMSVR.EXE"="C:\WINDOWS\system32\PRISMSVR.exe" [2004-04-13 19:45]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:56]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"InstantTray"="C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe" [2004-05-06 15:14]
"IW_Drop_Icon"="C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" [2004-07-30 15:10]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 12:00]
"Jessops Insert Detect"="C:\Program Files\Jessops\Picture Suite\InsDetect.exe" [2003-02-17 11:45]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-03-01 18:11]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-11 00:07]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
C:\Documents and Settings\Nic\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-03-09 22:35:08]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
2Wire Wireless Client.lnk - C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.EXE [2007-08-15 09:40:53]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-06-18 10:12:40]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-07-22 16:50:16]
BT Broadband Desktop Help.lnk - C:\Program Files\BT Broadband Desktop Help\bin\matcli.exe [2007-04-05 22:45:25]
Kodak EasyShare software.lnk - C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2002-09-16 15:42:06]
KODAK Software Updater.lnk - C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-03-13 08:08:34]
Photo Express Calendar Checker SE.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe [2005-06-18 10:22:35]

Browntoa

does the same error message still come up on a reboot and are you still getting the problems ??

Browntoa

I'd still download and run

www.superantispyware.com

you want the free blue button, install, let it update and then do a FULL scan , at the end it may ask to reboot the pc ...

vinylmusic

Browntoa wrote: »

does the same error message still come up on a reboot and are you still getting the problems ??

Yes I ran both the programs you mentioned.
I also ran spybot which removed something that looked significant.
All looked ok and I thought the problem was solved
Then after a reboot it was back again:mad:

richyrichuk

use hijack this. that will take it down... i cba finding the file within ur log file. unless u r desperate.