Download, install, update and run all of the following.

Ad-Aware
http://www.pcbutts1.com/downloads/aawsepersonal.exe

Spybot search and destroy
http://www.pcbutts1.com/downloads/spybotsd14.exe

Microsoft Windows AntiSpyware (Beta1)
http://www.microsoft.com/downloads/d...displaylang=en

If none of the above fixes the issue then download Hijack this, run it, save
a copy of the log file and cut and paste it back here to the group so that I
can analyze it.

HijackThis
http://www.pcbutts1.com/downloads/HijackThis.zip

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com



"Martin" <nagasml@netscape.net> wrote in message
news:1122771295.954822.260890@z14g2000cwz.googlegr oups.com...
> Just as I was ending an internet session, I found that the opening
> "wallpaper image" - or maybe 'theme' is the proper word? - had been
> hijacked by an unwanted ad for a spy removal ware called PSguard. So
> far the functions are not affected, but it's very irritating - the
> screen jet black against an intrusive message - and a quick check on
> the web confirmed it's a recent malware.
> However it seems, of course, to have blocked the function for changing
> screen wallpaper, so I can't shuck it out that way. How do I get around
> this?
>
> The PC runs on Win XP with Norton firewall and Antivirus, it's not part
> of a LAN, and otherwise it's free of manifest virus problems.
>
> note: I just checked the activities manager and there are two processes
> which could be suspect: NPROTECT.EXE and NPFMNTOR.EXE (both using
> several megs of memory right now) Those two normally belong with
> Norton, but a spyware or adware could pose under these names, couldn't
> it? They can't be closed down, however.
>
> any tips appreciated
>
> Martin, Sweden
>