Getting rid of malware screen theme

Just as I was ending an internet session, I found that the opening
"wallpaper image" - or maybe 'theme' is the proper word? - had been
hijacked by an unwanted ad for a spy removal ware called PSguard. So
far the functions are not affected, but it's very irritating - the
screen jet black against an intrusive message - and a quick check on
the web confirmed it's a recent malware.
However it seems, of course, to have blocked the function for changing
screen wallpaper, so I can't shuck it out that way. How do I get around
this?

The PC runs on Win XP with Norton firewall and Antivirus, it's not part
of a LAN, and otherwise it's free of manifest virus problems.

note: I just checked the activities manager and there are two processes
which could be suspect: NPROTECT.EXE and NPFMNTOR.EXE (both using
several megs of memory right now) Those two normally belong with
Norton, but a spyware or adware could pose under these names, couldn't
it? They can't be closed down, however.

any tips appreciated

Martin, Sweden

Download, install, update and run all of the following.

Ad-Aware
http://www.pcbutts1.com/downloads/aawsepersonal.exe

Spybot search and destroy
http://www.pcbutts1.com/downloads/spybotsd14.exe

Microsoft Windows AntiSpyware (Beta1)
http://www.microsoft.com/downloads/d...displaylang=en

If none of the above fixes the issue then download Hijack this, run it, save
a copy of the log file and cut and paste it back here to the group so that I
can analyze it.

HijackThis
http://www.pcbutts1.com/downloads/HijackThis.zip

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com



"Martin" <nagasml@netscape.net> wrote in message
news:1122771295.954822.260890@z14g2000cwz.googlegr oups.com...
> Just as I was ending an internet session, I found that the opening
> "wallpaper image" - or maybe 'theme' is the proper word? - had been
> hijacked by an unwanted ad for a spy removal ware called PSguard. So
> far the functions are not affected, but it's very irritating - the
> screen jet black against an intrusive message - and a quick check on
> the web confirmed it's a recent malware.
> However it seems, of course, to have blocked the function for changing
> screen wallpaper, so I can't shuck it out that way. How do I get around
> this?
>
> The PC runs on Win XP with Norton firewall and Antivirus, it's not part
> of a LAN, and otherwise it's free of manifest virus problems.
>
> note: I just checked the activities manager and there are two processes
> which could be suspect: NPROTECT.EXE and NPFMNTOR.EXE (both using
> several megs of memory right now) Those two normally belong with
> Norton, but a spyware or adware could pose under these names, couldn't
> it? They can't be closed down, however.
>
> any tips appreciated
>
> Martin, Sweden
>

Martin wrote:
> Just as I was ending an internet session, I found that the opening
> "wallpaper image" - or maybe 'theme' is the proper word? - had been
> hijacked by an unwanted ad for a spy removal ware called PSguard. So
> far the functions are not affected, but it's very irritating - the
> screen jet black against an intrusive message - and a quick check on
> the web confirmed it's a recent malware.
> However it seems, of course, to have blocked the function for changing
> screen wallpaper, so I can't shuck it out that way. How do I get
> around this?
>
> The PC runs on Win XP with Norton firewall and Antivirus, it's not
> part of a LAN, and otherwise it's free of manifest virus problems.
>
> note: I just checked the activities manager and there are two
> processes which could be suspect: NPROTECT.EXE and NPFMNTOR.EXE (both
> using several megs of memory right now) Those two normally belong with
> Norton, but a spyware or adware could pose under these names, couldn't
> it? They can't be closed down, however.

*PSGuard Removal*
http://labs.paretologic.com/spyware.aspx?remove=PSGuard

--
If there is a Tourist Season, how come we can't shoot them?

pcbutts1 <pcbutts1@seedsv.com> wrote:
> Download, install, update and run all of the following.
> Ad-Aware
> http://www.pcbutts1.com/downloads/aawsepersonal.exe
> Spybot search and destroy
> http://www.pcbutts1.com/downloads/spybotsd14.exe
> Microsoft Windows AntiSpyware (Beta1)
> http://www.microsoft.com/downloads/d...displaylang=en
> If none of the above fixes the issue then download Hijack this, run it, save
> a copy of the log file and cut and paste it back here to the group so that I
> can analyze it.

And don't forget to read this:

http://www.microsoft.com/technet/com...mt/sm0504.mspx

F'up here, because it's security related.

Yours,
VB.
--
Irony has to be marked as clear as possible. Please use asterisks
AND underlines AND <irony>-tags to make that clear - and don't forget,
that closing </irony>-tags are needed to compensate any sarcasm.