Coolfreak

I am sorry for the wait, our experts do work very hard though. As you probably saw, they have hundreds of threads a day, so it might take a day or two.

Hopefully one of them answers soon.

-Coolfreak

__________________
I subscribe to all threads I post in. But, if in case I don't or I forget, and I don't post back within 24 hours, please PM me. I will get back to your thread as quickly as possible.


Everest ~ DBAN ~ UBCD4WIN ~ SpeedFan

WaxhawRon

as they say in China--Mei Wenti. That means "no problem". If they are tied up and I have to wait in line a bit, that's the way it is.

WaxhawRon

Cool Freak: I've been playing around with the computer while waiting to hear from the malware pros. it seems that when I ran my AVG8.0 AntiVirus in safe mode, there were a few things found. AVG in safe mode runs a command line scanner, and at the end when it is done it just closes the DOS window. I wasn't watching as it did its thing last time (I just assumed that if it found something it would state what it found in some report at the end), but when I sat and watched AVG do its thing in safe mode--hey, it's a rainy Sunday--I saw the following tracking cookies listed. These only showed up in the AVG safe mode scan, not the Ad Aware or Trend Micro House Call scans in safe mode. They do not show up in the AVG scan in regular mode. How do I delete the following tracking cookies? Maybe one of them is keeping my desktop active so I can't use Iconoid to make the icon names transparent?

C:\Documents and Settings\Barbara\Cookies\barbara@m.webtrends[2].txt:\m.webtrends.com.b4ca7df0 Found tracking cookie.Webtrends

C:\Documents and Settings\Barbara\Cookies\barbara@m.webtrends[2].txt
Found tracking cookie.Webtrends

C:\Documents and Settings\Ron\Cookies\ron@adopt.euroclick[1].txt:adopt.euroclick.com.fb764ef7 Found tracking cookie.Euroclick

C:\Documents and Settings\Ron\Cookies\ron@adopt.euroclick[1].txt:adopt.euroclick.com.891542da Found tracking cookie.Euroclick

C:\Documents and Settings\Ron\Cookies\ron@adopt.euroclick[1].txt:adopt.euroclick.com.ffe11db7 Found tracking cookie.Euroclick

C:\Documents and Settings\Ron\Cookies\ron@adopt.euroclick[1].txt Found tracking cookie.Euroclick

C:\Documents and Settings\Ron\Cookies\ron@m.webtrends[1]txt:\m.webtrends.com.b4ca7df0 Found tracking cookie.Webtrends

C:\Documents and Settings\Ron\Cookies\ron@m.webtrends[1]txt Found tracking cookie.Webtrends

I did Start-Search for euroclick and for webtrends, but nothing came up in complete computer search including hidden files.

Have I found anything significant here? What do you think?

WaxhawRon

Hi again Cool freak, forgot to also tell you taht there are two temp files that I cannot delete. When I try to delete these two files, I get a message that "cannot delete...It is being used by another person or program. Close any programs that might be using the file and try again." But there are no programs running on either my identity or my wife's (Barbara).

The two files are:

ZLT055fb.TMP
TMP File
1 KB

ZLT055ff.TMP
TMP File
1 KB

Perhaps the program that is being used is what is keeping my desktop active?

Coolfreak

Well, first, lets get rid of those temp files. Unlocker is a free program that can 'unlock' those files, so you can delete them.

As for the tracking cookies, have you tried to run Ad Aware in normal mode? I'm surprised Ad Aware doesn't pick up those tracking cookies. Ad Aware is usually pretty good at those.

__________________
I subscribe to all threads I post in. But, if in case I don't or I forget, and I don't post back within 24 hours, please PM me. I will get back to your thread as quickly as possible.


Everest ~ DBAN ~ UBCD4WIN ~ SpeedFan

WaxhawRon

Downloaded Unlocker. Good idea! The two temp files are Zone labs files, I guess for my Zone Alarm firewall. So I did not unlock and get rid of them.

AdAware in normal mode has not picked up these tracking cookies. Surprised me also.

Weird.

WaxhawRon

Had a neighbor who is an IT pro at a big bank stop by this morning. He went into DOS and deleted the tracking cookies. I'm not sure what he did because I had to let my dog out and my neightbor did this very quickly. He did not know why AdAware or AVG or House Call while in normal mode did not pick these up, but said that working in safe mode does allow working with less interference and is often better for finding malware.

But he tried for about 20 mnutes to figure out why my desktop icons have the opaque backgrounds that we cannot change, and he had no ideas how to fix this. Not a problem at the bank where he works, I guess.

Coolfreak

If you know how to use DOS, navigating to the tracking cookies and deleting them isn't hard at all. Trying to explain how to do that over a forum, would be kinda of a tough task.

As for those opaque backgrounds, I am really stumped. There has to be something we are missing with this active desktop. I'm just not sure what it is yet.

Did you try to turn off the active desktop again after deleting the tracking cookies?

I'll do a little more research and see if I can find anything.

__________________
I subscribe to all threads I post in. But, if in case I don't or I forget, and I don't post back within 24 hours, please PM me. I will get back to your thread as quickly as possible.


Everest ~ DBAN ~ UBCD4WIN ~ SpeedFan

WaxhawRon

I agree with you about using DOS. Not only would it be difficult to navigate via a forum, it would be potentially dangerous. I had thought of this, but due to the danger never suggested it to you. One typo and who knows how I could have screwed up my computer! You were smart not to bring it up.

After my neighbor got rid of the tracking cookies and tried in vain to de-activate my desktop, I ran AVG, AdAware, and House Call again--both in normal and in safe modes, trying after each program ran to de-activate my desktop. But Iconoid always said that my desktop was still active. There has to be some sort of malware we are missing, and when the experts finally get down to my name on their waiting list we'll see if there is something that they can find.

I've run across all sorts of instances on the web of people searching for ways to make their desktop icon names on a tranparent background again, but nobody has a clue. The only clue was to a Microsoft web site that has been deactivated. Guess it didn't work, which is not a confidence builder.

WaxhawRon

Cool Freak, perhaps the most perplexing part of this problem is that there are two identities working on the computer--my wife and me. Her desktop display works fine while mine is screwed up. Two of the tracking cookies that my neighbor eliminated were hers. Zone Alarm runs to protect both identities. This just doesn't make a lot of sense unless there is some sort of malware that is specific to my identity that we have not found.

Coolfreak

Maybe Iconiod is seeing your wife's desktop as active. Try to disable her active desktop, then try Iconoid.

This is just a guess though.


-Coolfreak

__________________
I subscribe to all threads I post in. But, if in case I don't or I forget, and I don't post back within 24 hours, please PM me. I will get back to your thread as quickly as possible.


Everest ~ DBAN ~ UBCD4WIN ~ SpeedFan

WaxhawRon

It was worth a try, but it didn't work. First try was when her identity was not even logged on. Second try it was re-set to be inactive. Third try was back to it being active, which was her (and my) default setting.

Iconoid said all three had active desktops.

Like I said, it was worth a try. When all we know fails, it is by examining the unknown that we move forward.

Coolfreak

Alright, well, I decided to download Iconoid and see if it worked fine on my computer. It said I had an active desktop, so I went to the web tab under customize desktop, and unchecked all the boxes. I only had two boxes. I unchecked them, and then it worked fine.

So something is keeping your desktop active.

Let's try one more thing. Try running Panda'a online scan one more time. Make sure the autoclean box is checked.

See if that finds anything.

__________________
I subscribe to all threads I post in. But, if in case I don't or I forget, and I don't post back within 24 hours, please PM me. I will get back to your thread as quickly as possible.


Everest ~ DBAN ~ UBCD4WIN ~ SpeedFan

WaxhawRon

Never tried this scan before. Just downloaded it and started it scanning. Says it could take an hour or so, so we'll see what it comes up with. I'll keep you posted. Thank you.

WaxhawRon

The free scan showed some infected files and vulnerabilities, but the freeware doesn't disinfect them. There was no autoclean box. So I've signed up to purchase Panda and am waiting for them to get back with a confirmation so I can set up a name and password and then run the scan again and disinfect. I'll keep you posted. So far, It's taking a long time to hear back from them with my registration materials.

WaxhawRon

Cool Freak, is this Panda Security for real? It have never taken this long for me to hear back about registering downloaded software ever. Should I get on the phone with my credit card company and block the transaction? Please advise soonest!

Coolfreak

I never had anybody actually buy it. I'm not 100% sure if it is real. I would block the transaction.

Also, if you took the 'first steps' in removing malware and properly posting for help in the HJT forum, you would have ran this scan.

Please follow these directions exactly.

To get Expert Help with malware removal:

I recommend that you read this article… ( Simply, click on the links to be re-directed.)

"Having problems with spyware and pop-ups? First steps;
IMPORTANT - Read This Before Posting For Malware Removal Help

Please follow the instructions very carefully; then, post all the requested logs and information; as instructed, in the
HiJackThis Log Help Forum.
http://www.techsupportforum.com/secu...this-log-help/

Please ensure that you create a new thread in the HiJackThis Log Help Forum;
not back here in this one.

When carrying out The 5 Steps,
IMPORTANT - Read This Before Posting For Malware Removal Help

if you cannot complete any of them for whatever reason, just continue on with the next one until they are all completed.
However,it is extremely important to make mention of the fact that you could not complete any of the steps in your post to HiJackThis Log Help Forum.
http://www.techsupportforum.com/secu...this-log-help/

where an Analyst will assist you with other workarounds.

Once done, please be patient, as the Security Team Analysts are usually very busy; one of them will answer your request as soon as they can.

__________________
I subscribe to all threads I post in. But, if in case I don't or I forget, and I don't post back within 24 hours, please PM me. I will get back to your thread as quickly as possible.


Everest ~ DBAN ~ UBCD4WIN ~ SpeedFan