Nilage-GS, Bravesentry-B

[Jaylee]

this virus lock my desktop to show my wallpaper
Nilage-GS
Bravesentry-B

I delete it with avast but still my wallpaper is not appear
why?

[mauserme]

What files were deleted?  Is it possoble the wallpaper was infected?

[Jaylee]

C:\WINDOWS\wstrrs.exe
C:\WINDOWS\wms3.exe
C:\WINDOWS\wgs3.exe
C:\WINDOWS\system32\wsttrs.dll
C:\WINDOWS\system32\SVCHOST.EXE
C:\WINDOWS\system32\mppdys.dll
C:\WINDOWS\mppdys.exe
C:\Documents and Settings\Jaylee\Local Settings\Temp\mhso1.dll
C:\Documents and Settings\Jaylee\Local Settings\Temp\mhso0.dll
C:\Documents and Settings\Jaylee\Local Settings\Temp\mhso.exe

[mauserme]

Nothing there that looks like a wallpaper file.

Can you go into your display properties and set the wallpaper again?

[Jaylee]

Cannot click anything in display properties

[mauserme]

Well, there are some registry keys you could check

http://support.microsoft.com/kb/921049

I suggest you back up your registry first, before making any changes

http://www.snapfiles.com/get/erunt.html

[Jaylee]

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

 + Created at:   11:18:11 PM 7/29/2007

 + Scan result:   



C:\System Volume Information\_restore{D98C5124-D88C-4021-8A47-1E98FEC031E9}\RP152\A0030079.EXE -> Backdoor.Agent.air : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D98C5124-D88C-4021-8A47-1E98FEC031E9}\RP152\A0030077.exe -> Trojan.OnLineGames.es : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D98C5124-D88C-4021-8A47-1E98FEC031E9}\RP152\A0030078.dll -> Trojan.OnLineGames.es : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D98C5124-D88C-4021-8A47-1E98FEC031E9}\RP152\A0030080.dll -> Trojan.OnLineGames.es : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D98C5124-D88C-4021-8A47-1E98FEC031E9}\RP152\A0030083.exe -> Trojan.OnLineGames.es : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D98C5124-D88C-4021-8A47-1E98FEC031E9}\RP152\A0030081.exe -> Trojan.OnLineGames.lg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{D98C5124-D88C-4021-8A47-1E98FEC031E9}\RP152\A0030082.exe -> Trojan.Pakes : Cleaned with backup (quarantined).

More scan

[mauserme]

Why don't you post ComboFix and HijackThis logs and we'll make sure your clean.


Download ComboFix from Here or Here to your Desktop.

Double click combofix.exe and follow the prompts.
 
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
 
Note: Do not mouseclick combofix's window while its running. That may cause it to stall.



Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
  
• Put a check by Create a desktop icon then click Next again.
  
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
  
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
  

[Jaylee]

Solve the problem after edit my registry, tx a lot

[mauserme]

No problem 

Looks like you've had a thing or two going on there.  If you want to post the logs I'll be happy to look at them.  Otherwise, no worries ...