Re: Trojan/Spyware Problem

[mto]

"Spaceboy" <mic@brea.net> wrote in message
newsgcehvkpebp56kmr8rckko38en6m074frh@4ax.com...
> I had what appears to be a trojan on my system. After launching IE,
> suddenly my wallpaper was changed along with my startup page, and
> various other things. After doing a full scan of my system, a couple
> of Trojans were found, along with some Spyware.
>
> The problem is though even after removing them, I can't change the
> Wallpaper on my Desktop because there is a tab missing on the Display
> Properties Window.
>
> Any idea how I can fix this?
>
> Also, the IE Titlebar text has been changed.
>
> Any help appreciated. Thanks.
>

What did you do the scan with?
How did you take the files out?
What were the specific trojans/spyware that was on your system?

[Dick Hazeleger]

mto wrote:

>
> "Spaceboy" <mic@brea.net> wrote in message
> newsgcehvkpebp56kmr8rckko38en6m074frh@4ax.com...
> > I had what appears to be a trojan on my system. After launching IE,
> > suddenly my wallpaper was changed along with my startup page, and
> > various other things. After doing a full scan of my system, a
> > couple of Trojans were found, along with some Spyware.
> >
> > The problem is though even after removing them, I can't change the
> > Wallpaper on my Desktop because there is a tab missing on the
> > Display Properties Window.
> >
> > Any idea how I can fix this?
> >
> > Also, the IE Titlebar text has been changed.
> >
> > Any help appreciated. Thanks.
> >
>
> What did you do the scan with?
> How did you take the files out?
> What were the specific trojans/spyware that was on your system?

And if I may add one question: What OS (Windows flavor) are you
running? (could be important.)

Dick

[Spaceboy]

On Fri, 18 Jul 2003 00:37:22 -0000, "Dick Hazeleger"
<Dick@post_it_in_the_newsgroup.com> wrote:

>mto wrote:
>
>>
>> "Spaceboy" <mic@brea.net> wrote in message
>> newsgcehvkpebp56kmr8rckko38en6m074frh@4ax.com...
>> > I had what appears to be a trojan on my system. After launching IE,
>> > suddenly my wallpaper was changed along with my startup page, and
>> > various other things. After doing a full scan of my system, a
>> > couple of Trojans were found, along with some Spyware.
>> >
>> > The problem is though even after removing them, I can't change the
>> > Wallpaper on my Desktop because there is a tab missing on the
>> > Display Properties Window.
>> >
>> > Any idea how I can fix this?
>> >
>> > Also, the IE Titlebar text has been changed.
>> >
>> > Any help appreciated. Thanks.
>> >
>>
>> What did you do the scan with?
>> How did you take the files out?
>> What were the specific trojans/spyware that was on your system?
>

Scanned with RAV antivirus, Trojan Remover, Spybot and Adaware. Found
two unknown trojans. Got the following message on running Trojan
Remover: The exefile\shell\open\command Registry Keys appears to have
been modified.

Spyware found included SearchExplorerBar, Vx2/Transponder keys,
Lop.com and ShopNav

>And if I may add one question: What OS (Windows flavor) are you
>running? (could be important.)
>
>Dick

Windows Server 2003

[mto]

"Spaceboy" <mic@brea.net> wrote in message
news:vlkehvk9nha3k0t2rka8bfhnshmu9cgv66@4ax.com...
> On Fri, 18 Jul 2003 00:37:22 -0000, "Dick Hazeleger"
> <Dick@post_it_in_the_newsgroup.com> wrote:
>
> >mto wrote:
> >
> >>
> >> "Spaceboy" <mic@brea.net> wrote in message
> >> newsgcehvkpebp56kmr8rckko38en6m074frh@4ax.com...
> >> > I had what appears to be a trojan on my system. After launching IE,
> >> > suddenly my wallpaper was changed along with my startup page, and
> >> > various other things. After doing a full scan of my system, a
> >> > couple of Trojans were found, along with some Spyware.
> >> >
> >> > The problem is though even after removing them, I can't change the
> >> > Wallpaper on my Desktop because there is a tab missing on the
> >> > Display Properties Window.
> >> >
> >> > Any idea how I can fix this?
> >> >
> >> > Also, the IE Titlebar text has been changed.
> >> >
> >> > Any help appreciated. Thanks.
> >> >
> >>
> >> What did you do the scan with?
> >> How did you take the files out?
> >> What were the specific trojans/spyware that was on your system?
> >
>
> Scanned with RAV antivirus, Trojan Remover, Spybot and Adaware. Found
> two unknown trojans. Got the following message on running Trojan
> Remover: The exefile\shell\open\command Registry Keys appears to have
> been modified.
>
> Spyware found included SearchExplorerBar, Vx2/Transponder keys,
> Lop.com and ShopNav
>
> >And if I may add one question: What OS (Windows flavor) are you
> >running? (could be important.)
> >
> >Dick
>
> Windows Server 2003

Is the machine operating as a server?

[siljaline]

On Fri, 18 Jul 2003 03:00:50 +0100, Spaceboy <mic@brea.net> wrote:

><snipped>

>Spyware found included SearchExplorerBar, Vx2/Transponder keys,
>Lop.com and ShopNav

Ad-aware or SpyBot should be able to kill all but Lop since variants are
proliferating all the time.
I suggest your run 'Hijack This' for the Lop parasite.

http://www.tomcoyote.org/hjt/
http://www.spywareinfo.com/~merijn/htlogtutorial.html

Post your results here or in the Spywareinfo Forum.
http://www.spywareinfo.com/forums/in...b3&act=SF&f=11

HTH



--
siljaline

"Arguing with anonymous strangers on the Internet is a sucker's game
because they almost always turn out to be -- or to be indistinguishable from
-- self-righteous sixteen-year-olds possessing infinite amounts of free time."
- Neil Stephenson, _Cryptonomicon_

[Spaceboy]

On Fri, 18 Jul 2003 03:14:15 -0400, siljaline <siljaline@invalid.com>
wrote:

>On Fri, 18 Jul 2003 03:00:50 +0100, Spaceboy <mic@brea.net> wrote:
>
>><snipped>
>
>>Spyware found included SearchExplorerBar, Vx2/Transponder keys,
>>Lop.com and ShopNav
>
>Ad-aware or SpyBot should be able to kill all but Lop since variants are
>proliferating all the time.
>I suggest your run 'Hijack This' for the Lop parasite.
>
>http://www.tomcoyote.org/hjt/
>http://www.spywareinfo.com/~merijn/htlogtutorial.html
>
>Post your results here or in the Spywareinfo Forum.
>http://www.spywareinfo.com/forums/in...b3&act=SF&f=11
>
>HTH

Ok, I've managed to fix the problem, after someone on the TweakXP
forum gave me a suggestion. Thanks anyway.