[NeonFx]

Cool. I think I can see what's causing the problems. I'll wait for the RootRepeal results.

[nichos]

here is #2

[NeonFx]

Good. Please do the following now:

STEP 1

Run OTS

• Under the Paste Fix Here box on the right, paste in the contents of following code box

[Unregister Dlls]
[Win32 Services - Safe List]
YN -> (Seekeen Service) Seekeen Service [On_Demand | Stopped] -> 
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E} [HKLM] -> C:\Program Files\Smart-Shopper\Bin\2.5.1\Smrt-Shpr.dll [Smart-Shopper]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-823518204-261478967-725345543-1004\] > -> HKEY_USERS\S-1-5-21-823518204-261478967-725345543-1004\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
YN -> {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF}:{6FAC4823-815E-4361-836E-46D65ED2550B} [HKLM] -> C:\Program Files\Smart-Shopper\Bin\2.5.1\Smrt-Shpr.dll [Button: ]
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
YN -> {4871A87A-BFDD-4106-8153-FFDE2BAC2967} [HKLM] -> http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.8.cab [DLM Control]
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
YN -> "C:\Documents and Settings\y\Local Settings\Temporary Internet Files\Content.IE5\CMGGKQGK\hfs[1].exe" -> C:\Documents and Settings\y\Local Settings\Temporary Internet Files\Content.IE5\CMGGKQGK\hfs[1].exe [C:\Documents and Settings\y\Local Settings\Temporary Internet Files\Content.IE5\CMGGKQGK\hfs[1].exe:*:Enabled:hfs[1]]
[Registry - Additional Scans - Safe List]
< Desktop Components > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\
YN -> 0 -> [Key]
YN -> 0 -> FriendlyName =
YN -> 0 -> Source = file:///C:/DOCUME~1/y/LOCALS~1/Temp/msoclip1/01/clip_image002.jpg
YN -> 0 -> SubscribedURL = file:///C:/DOCUME~1/y/LOCALS~1/Temp/msoclip1/01/clip_image002.jpg
[Custom Items]
:files
C:\Program Files\Smart-Shopper
:end
[Empty Temp Folders]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• This will create a log in C:\_OTS\MovedFiles\<date>_<time>.txt where date and time are those of when the fix was run. Open it from there if it does not appear automatically on reboot. Please copy and paste or attach the contents of that file here.

Note: You may receive some errors while running the fix. Just press Ok and the fix should continue normally.
If it seems to get stuck, give it some time. It's probably still working.


STEP 2

Run OTS again. Under Additional Scans check "Reg - Desktop Components" and click on the Run Scan button at the top. Attach the results of this scan in your next reply.

[nichos]

All Processes Killed
[Win32 Services - Safe List]
Service Seekeen Service stopped successfully!
[Registry - Safe List]
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-823518204-261478967-725345543-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF}:{6FAC4823-815E-4361-836E-46D65ED2550B}\ not found.
Starting removal of ActiveX control {4871A87A-BFDD-4106-8153-FFDE2BAC2967}
C:\WINDOWS\Downloaded Program Files\DownloadManagerV2.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4871A87A-BFDD-4106-8153-FFDE2BAC2967}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Documents and Settings\y\Local Settings\Temporary Internet Files\Content.IE5\CMGGKQGK\hf not found.
[Registry - Additional Scans - Safe List]
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0\ not found.
[Custom Items]
========== FILES ==========
File/Folder C:\Program Files\Smart-Shopper not found.
[Empty Temp Folders]


User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 4649116 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: y
->Temp folder emptied: 230476602 bytes
->Temporary Internet Files folder emptied: 37768733 bytes
->FireFox cache emptied: 77064190 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2162283 bytes
%systemroot%\System32 .tmp files removed: 2932753 bytes
Windows Temp folder emptied: 8597 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 29524547 bytes

Total Files Cleaned = 366.87 mb

< End of fix log >
OTS by OldTimer - Version 3.1.6.0 fix logfile created on 11182009_185219
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...

[nichos]

here is the last one

NB on last reboot it hung & had to restart it nyself.

[NeonFx]

Cool. I'll review the results more carefully later.

For now, are the symptoms gone?

[nichos]

YESssssssss forgot to tell you after last reboot "Desktop Properties" did not appear & I can now bring them up at will.

BLESS you boffin, how on earth can you do it.

Any way did I have nasty virouses or badies in my HD?

What caused it.

Resently a lot of things changed all of a sudden, my network settings changed unable to connect etc etc small things.

I keep blaming the wife that she dusted the box. ...... hanx....nick

PS do you mean to say you are sitting in California & chating like this to me outside London UK ????? ...amazing

[nichos]

NEON,

calamity, I had to restart again just now & the thing came back. What's going on????

[NeonFx]

I have no idea where that's loading from. We'll figure it out though.

You didn't have any serious infections, just traces of old Adware. That's software that can be used to deliver advertisements to your computer.

Since this is a Virtual Machine on Virtual Box, have you considered backing up your data and reinstalling Windows? I ask this because you said you are noticing a number of problems. We could spend a lot of time trying to figure out the causes while a reinstall of Windows would only take a couple hours.

Let's do the following to scan for things I might have missed or can't see:

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan. Scan all of your harddrives.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.



======================

After restarting your machine please do the following:

Run OTS again. Under Additional Scans check "Reg - Desktop Components" and click on the Run Scan button at the top. Attach the results of this scan in your next reply.

[nichos]

Malwarebytes' Anti-Malware 1.41
Database version: 3194
Windows 5.1.2600 Service Pack 3
18/11/2009 22:19:32
mbam-log-2009-11-18 (22-19-32).txt
Scan type: Full Scan (C:\|D:\|E:\|G:\|P:\|)
Objects scanned: 267183
Time elapsed: 40 minute(s), 36 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 30
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 6
Files Infected: 10
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\smart-shopper.hbax (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.hbax.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.hbinfoband (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.hbinfoband.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebutton (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebutton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebuttona (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebuttona.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebuttonb (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebuttonb.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{90f62ef7-58d1-4e8e-bb3e-cfb10ba9e47b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b2b92bc9-e149-4ee8-a93e-0b8cfb329808} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79b1445-dfea-4bef-a786-e0c0f33c863b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4cf088bd-be95-40a5-be9b-677f8683edea} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6fac4823-815e-4361-836e-46d65ed2550b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{911f251e-34fd-465e-b6ce-df00ff49a6be} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fe4f1649-8909-49c0-87ba-24d65120db46} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{022c671f-6cba-4a03-a8f9-3b3a361b235a} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{305c6cb1-9d31-4489-881d-5a8e2dc3fe14} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{8ad815fc-607b-419f-8b70-d345a507a54e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4a7c 84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8bcb 5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3 d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3 d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Documents and Settings\y\Application Data\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\db (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\dwld (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\report (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\res1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
Files Infected:
E:\ZipFS9 Utils\InstallCreator.exe (Adware.EShoper) -> Quarantined and deleted successfully.
E:\zMultiPlay\AvcTuner\AVCTuner_1_2_1_2.exe (Adware.EShoper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\Config.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\db\Aliases.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\db\Sites.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\dwld\Phishinglist.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\dwld\WhiteList.xip (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\report\aggr_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\report\send_storage.xml (Adware.SmartShopper) -> Quarantined and deleted successfully.
C:\Documents and Settings\y\Application Data\Smart-Shopper\cs\res1\WhiteList.dbs (Adware.SmartShopper) -> Quarantined and deleted successfully.

[nichos]

and the last one

[nichos]

off to bed now, will check again tomorroe. Still did it on last reboot

many thanks, .......nick

[NeonFx]

Do me a favor to allay a suspicion of mine.

Go to Start > Control Panel > Add/Remove programs and Uninstall the following program:

Sun xVM VirtualBox Guest Additions 2.0.4

Then restart the computer. Let me know if that solved the problem.

If that was the source of the problems then it should also solve the other issues you were having with networking and such.

[nichos]

Sorry for delayed answer but I wrote this twice & both when about to send a popup asked to install MS framework..... & on OK my text was wiped out. This one is on notepad copy/paste.
I noted your earlier remark "...this is a Virtual Machine on Virtual Box.....", Imostly use XP for Simming & dualboot with Upuntu 8.10, & in XP is the VB for trying an old linux, win7 etc.
I'd hate to wipe them as was an epic effort for me & could not repeat it. They were there for ages, long before what you try to help on, which I'd rather have instead.
To deviate a bit, between all that going on, I was trying to copy the XP IE bookmarks, via my network, to the old winME Dell laptop when whatever stupid thing I did 20-30 shortcuts & files on my deskotp were wiped out without any trace of them anywhere, PC or Dell whilst 14 others remained .
Probably this is out of your scope, but could you have a clever idea on how to retrace them?
thanx .....nick

[NeonFx]

Just to clarify, is the computer we are trying to fix a Virtual machine or not?

You see, I noticed you had Sun Virtual Box installed on this machine and had the virtual machine guest additions installed as well. You don't normally see that because the first is to host virtual machines while the second should only be installed on the virtual machines themselves not the host.

In short, did uninstalling the Sun VirtualBox Guest Additions solve our main problem (Display Properties on reboot)? I want to uninstall those because they should only be installed on Virtual Machines, not the host machine itself.

When you uninstall these (Guest Additions) you are not uninstalling Virtual Box.