HJT LOG: Desktop icons changed, text italicised in Security Cleanup

HJT LOG: Desktop icons changed, text italicised in Security Cleanup http://www.dslreports.com/forum/r22461909 en Thu, 03 Dec 2009 08:33:21 EDT Thu, 03 Dec 2009 08:33:21 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22488357 Koil :

said by TheJoker

:

One think I would change in the Avira settings is to set heuristics as low, rather than medium. It will result in fewer false positive detections.

quote:
Thank you again for all of your time and help, it is definitely appreciated.

I'm glad to have been able to help. :)

Already did that, as thats what got me in trouble w/ Comodo ;)
--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09]]> http://www.dslreports.com/forum/remark,22488357 Wed, 03 Jun 2009 10:41:30 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22488351 TheJoker : One think I would change in the Avira settings is to set heuristics as low, rather than medium. It will result in fewer false positive detections.

quote:
Thank you again for all of your time and help, it is definitely appreciated.

I'm glad to have been able to help. :)
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22488351 Wed, 03 Jun 2009 10:40:27 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22488167 Koil : Well, its done. Freshly installed and running Avira and Online Armor. I've also went ahead and started using DriveImage XML for creating actual image backups, and I've already made one of the clean install, so any issues like this again....bam...back to the beginning. ;)

Thank you for all your help and time. I know it was a royal PITA...its appreciated.

As far as CCleaner, I have used it for years and never had an issue with its registry cleaning. There is a first time for everything, for sure, but I think I would lean towards the Comodo issue being the problem, more than CCleaner, but who knows.

I was using Comodo as it was recommended by someone on here and I'd been using AVG forever and thought I would give it a shot...live and learn there. Hopefuly Avira won't yield a similar experience.

Thank you again for all of your time and help, it is definitely appreciated.

Have a great day!
--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09]]> http://www.dslreports.com/forum/remark,22488167 Wed, 03 Jun 2009 10:09:21 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22486624 TheJoker : Since even a Windows Repair install didn't fix the problem, it's probably time to consider backing up your data to an external source such as CD or DVD and reinstalling Windows.

It was pointed out that on your desktop image that you have an icon for CCleaner. Did you ever use the registry cleaner capability in CCleaner? If you did, that could have been part of the actual original problem. Registry cleaners are extremely powerful applications and their potential for harming your OS far outweighs any small potential for improving your computer's performance.

There's also this topic which shows mentions detection of detection by Comodo Internet Security of the same file, bass.dll, along with a scan of the file at VirusTotal:
»www.virustotal.com/analisis/0b61···95418a1c

There wasn't a single positive detection there, only three suspicious entries. Has CIS removed other files or registry entries lately? If so, I would view them as potentially suspicious after seeing the results of scanning bass.dll. It's always possible that you never had an infection.

I would recommend a windows reinstall after backup up your data files. After reinstalling Windows, You need a better antivirus and firewall than CIS. I would recommend Avira AntiVir PersonalEdition Classic
as one of the best free (or paid) antivirus programs available. Two excellent free firewalls are Outpost Firewall Free (I used to use the Pro version and it's an excellent firewall) or Online Armor Free. Either one would be a good choice.
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22486624 Tue, 02 Jun 2009 23:20:23 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22480905 Koil : .

Listing of all the fonts in the /windows/font dir
IE not seeing any of the fonts..not sure if relevant

]]> http://www.dslreports.com/forum/remark,22480905 Mon, 01 Jun 2009 23:46:59 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22480821 Koil : I can't run FF, I can go to their home page in IE

If I try to look at the fonts for IE, there is nothing listed.

Also, when I check the C:\windows\font directory...there aren't many fonts in there.]]> http://www.dslreports.com/forum/remark,22480821 Mon, 01 Jun 2009 23:31:44 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22480601 TheJoker : In Firefox, go to Tools > Options, and check what the default font is. Mine is set to the default of Times New Roman 16. Is that what yours is set at, or is it different?
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22480601 Mon, 01 Jun 2009 22:45:07 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22475974 Koil : Yeah, its filebased and I learned how it handles the situation I was wondering about as I wasn't sure how it would restore the OS directory while the OS was in use...easy answer: it doesn't.

It doesn't backup the Windows directory at all...I thought it might copy it to a tmp directory with some sort of script to move it to the correct place on reboot or something, but no such luck...so still have the issue.

The Windows repair using the CD should have fixed the font issue, right? Or at least, thats the best shot we have at fixing it? I honestly think that the font thing is the only remaining remnant. Maybe I will just suck it up until I feel like reformatting again. Is there any other way of going about restoring the fonts to their default config...like a hard, heavy handed way?

The issue is that now the desktop icons text is correct, but the Start button text isn't correct, and the default system font looks like Windows 3.1....and in in IE8, if you go to the FF homepage (for example) the header text of the page looks like...like an 8 bit font or something..and its just the header text..the rest of the text is fine, so its stylized that way, but that's what it is. (see pic)

Have we come to the end of our rope?

--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09

]]> http://www.dslreports.com/forum/remark,22475974 Mon, 01 Jun 2009 08:41:19 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22475249 Koil : Its not an image, 99.99% sure its file based, as it works something akin to Windows Explorer. You have the drive tree on the left where you can select which directories you want to backup, etc.

I backed the entire C drive up, so I should have that, and I think maybe the backup was done before this thing showed up.]]> http://www.dslreports.com/forum/remark,22475249 Mon, 01 Jun 2009 00:33:50 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22475000 TheJoker : What you quoted from the page is all I see on it anywhere. While it mentions backup and restoration of data, I don't see any mention of a capability for catastrophic restore, where you would be restoring an entire drive, such as with Norton Ghost or Acronis True Image Home, or a file based backup and restore program like Backup My PC or NovaBACKUP.
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22475000 Sun, 31 May 2009 23:12:15 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22474954 Koil : »www2.ashampoo.com/webcache/html/···_USD.htm

I can't remember if its 8 or 9, but that's the page.

From the page:

Back up your data to single or multiple discs
Back up your valuable data to one or more CD, DVD or Blu-ray discs. Single backups can span multiple discs. Restore your backups in a single easy operation.
--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09]]> http://www.dslreports.com/forum/remark,22474954 Sun, 31 May 2009 23:00:27 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22474922 TheJoker :

quote:
I guess I am not sure if I had a virus or just some annoying Trojan thing or what. Do you think putting the data I have now back on the restored system is risky?

You mention removing some malware in your first reply. If you were able to detect and remove it then, you should still be able to if you restored the system.

What Ashampoo program are you referring to? I checked their homepage, and didn't see a backup program.
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22474922 Sun, 31 May 2009 22:55:17 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22473195 Koil : A) I did not delete the profile folders. I'll give it a shot and see if it makes a difference. At work now, so will be after 10pm EDT.

B) I guess I am not sure if I had a virus or just some annoying Trojan thing or what. Do you think putting the data I have now back on the restored system is risky? I just don't want to re-introduce the problem, though I don't see any indicators of weird services running or anything...but then again, what the hell happened to my desktop..lol

C) Ashampoo
--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09]]> http://www.dslreports.com/forum/remark,22473195 Sun, 31 May 2009 15:57:36 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22473167 TheJoker : After you uninstalled Firefox, did you delete assoicated folders before reinstalling:
C:\Documents and Settings\[profile]\Application Data\Mozilla
C:\Program Files\Mozilla Firefox

quote:
I have a backup from about a few weeks ago...I will lose a few things

I would save any data files that have been saved since the date of your backup to an external source, for instance, a CD or USB drive.

quote:
I've never actually had to restore from backup...will it overwrite the registry and it will be exactly as I backed it up at that time?

It should be, what is the backup program?
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22473167 Sun, 31 May 2009 15:50:32 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22472558 Koil : I did everything, but I think I am hosed, man...The desktop fonts are indeed back to normal, but the fonts in IE are showing up weird, FF will not start at all, just crashes over and over. I un / re-installed, tried loading it in safe mode, nada.

I have a backup from about a few weeks ago...I will lose a few things, but I guess its better than having a compromised install. I've never actually had to restore from backup...will it overwrite the registry and it will be exactly as I backed it up at that time? Or will certain lingering effects in the registry, etc., still be apparent?
--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09]]> http://www.dslreports.com/forum/remark,22472558 Sun, 31 May 2009 12:32:42 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22470562 TheJoker : Boot the computer using the XP CD. You may need to change the boot order in the system BIOS so the CD boots before the hard drive. Check your system documentation for steps to access the BIOS and change the boot order. When you see the "Welcome To Setup" screen, you will see the options below. This portion of the Setup program prepares Microsoft.

Windows XP to run on your computer:

To setup Windows XP now, press ENTER.

To repair a Windows XP installation using Recovery Console, press R.

To quit Setup without installing Windows XP, press F3.

Press Enter to start the Windows Setup. do not choose "To repair a Windows XP installation using the Recovery Console, press R", (you Do Not want to load Recovery Console). I repeat, do not choose "To repair a Windows XP installation using the Recovery Console, press R".

Accept the License Agreement and Windows will search for existing Windows installations. Select the XP installation you want to repair from the list and press R to start the repair. If Repair is not one of the options, END setup. After the reboot read Warning#2!

Setup will copy the necessary files to the hard drive and reboot. Do not press any key to boot from CD when the message appears. Setup will continue as if it were doing a clean install, but your applications and settings will remain intact.

After this, you will need to go to Windows Update and install all Critical Updates.
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22470562 Sat, 30 May 2009 20:54:53 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22470261 Koil : Ok, so this is not so good.

Windows will not boot now, it says the following file is missing.

vgaoem.fon

It says the windows CD can be use to repair......
--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09]]> http://www.dslreports.com/forum/remark,22470261 Sat, 30 May 2009 19:41:14 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22469326 TheJoker : Assuming D is your CD drive:

You don't type D:\i386\TAHOMA.TT_ C:\TAHOMA.TTF

It's: expand D:\i386\TAHOMA.TT_ C:\TAHOMA.TTF
(copy won't work, as the file that's copied is not expanded)

quote:
component mscomctl.ocx or one of it's dependencies not correctly registered: a file is missing or invalid

Download the following file to your Desktop.
Double-click and run missingfilesetup.exe.
Then reboot your system

Now that you have expended the file, and corrected the Killbox error, Try this again:

Now please double-click Killbox.exe to run it.
Select "Replace on Reboot", and click the "All Files" button.

Copy the file path below to the clipboard by highlighting the line and pressing CTRL + C

quote:
C:\TAHOMA.TTF

Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
To the right of the the second entry line in the main Killbox window (the line that appeared when you selected "Replace on Reboot"), click the folder window and browse to and select C:\Windows\Fonts

Click the red-and-white "Delete File" button. Click "Yes" at the prompt asking if you want to reboot now.
If your computer does not restart automatically, please restart it manually.

Does that fix the problem?

--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22469326 Sat, 30 May 2009 15:17:14 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22469192 Koil : Searched C:, "MSCOMCTL.OCX" isn't on the drive. I found an article that says how to resolve the issue...I am going to wait until I hear from you to do that, as I don't know what your plan is.

Let me know, and thank you so much for the help.]]> http://www.dslreports.com/forum/remark,22469192 Sat, 30 May 2009 14:36:47 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22469171 Koil : I downloaded KillBox.exe (I couldn't extract it) and when I double click on it, I get the error in the pic. Is this normal.

I downloaded it from this link:

»killbox.net/

]]> http://www.dslreports.com/forum/remark,22469171 Sat, 30 May 2009 14:28:29 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22469145 Koil : .........]]> http://www.dslreports.com/forum/remark,22469145 Sat, 30 May 2009 14:23:03 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22469138 Koil : :BIG FRIGGIN EDIT!!!!:

BAH...pls disregard. I missed the "expand" command...reading too fast.

The file is now on C: the way you asked.

Still have the .OCX issue w/ Killbox....waiting to hear from you there.]]> http://www.dslreports.com/forum/remark,22469138 Sat, 30 May 2009 14:19:48 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22469098 TheJoker : You could try to replace the Tahoma font file with a new copy.

Insert the Windows Installation CD in your CD drive.
Go to Start > Run
Type CMD. Click OK.
In the Command Prompt window that opens:
Type expand cd_drive_letter:\i386\TAHOMA.TT_ C:\TAHOMA.TTF and press ENTER

(change cd_drive_letter to your CD drive)
Type exit.

For example:
Type expand D:\i386\TAHOMA.TT_ C:\TAHOMA.TTF and press ENTER

Please download the Killbox by Option^Explicit and save it to your Desktop.

Extract Killbox.exe to the Desktop.
Now please double-click Killbox.exe to run it.
Select "Replace on Reboot", and click the "All Files" button.

Copy the file path below to the clipboard by highlighting the line and pressing CTRL + C[/b]

quote:
C:\TAHOMA.TTF

Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
To the right of the the second entry line in the main Killbox window (the line that appeared when you selected "Replace on Reboot"), click the folder window and browse to and select C:\Windows\Fonts

Click the red-and-white "Delete File" button. Click "Yes" at the prompt asking if you want to reboot now.
If your computer does not restart automatically, please restart it manually.

Does that fix the problem?

--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22469098 Sat, 30 May 2009 14:09:26 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22466233 Koil : No...didn't fix it. I don't get it...the them was back to modified again, too.

Although, I can change the font and it will go to what I change it to....It just that tahoma doesn't look right. It looks bolded, even though it isn't.

This pic is what a standard XP desktop should be.

you can see, comparing that to the pic from earlier, mine looks different...did it maybe replace a font file? (Standard prolly isn't the right word to use, as it isn't...lol...but the font is the same. If you look at the start button, that is what my desktop font is, which I think is just Tahoma Bold.)

--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09

]]> http://www.dslreports.com/forum/remark,22466233 Fri, 29 May 2009 19:48:54 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22465972 TheJoker : Right-click on the Desktop and select Properties > Appearance > Advanced, and in the new window that opens (Advanced Appearance), from the drop down meny for "Item" select Icon. Sor the size to the right of Icon, check to see that it is set at 32. For the Font, select Tahoma if it isn't selected, make sure the size is set at 8, and that Bold and Italic are not depressed, and select OK to close the Advanced Appearance window..
In the windows that's left open, if you don't want shadows, click the Effects button, unselect "Show shadows under menus", click OK to close the Effects window, and then OK to close Display Properties.

Here are some other settings in that section:
Active Title bar : size:25 (font tahoma, 10)
Active Window Border: size:1
Caption Buttons: size:25
Icon: size:32 (font tahoma, 8)
Icon Spacing(horizontal/vertical): size:43
Inactive Title Bar: size:25 (font tahoma, 10)
Inactive window border: size:1
Menu: size:19 (font tahoma, 8)
Message Box: (font tahoma, 8)
Palette Title: size:19 (font tahoma, 9)
Scrollbar: size:19
Selected Items: size:19 (font tahoma, 8)
ToolTip: (font tahoma, 8)

Restart your system. Did that fix the Desktop icon font problem?

If not, go to »www.kellys-korner-xp.com/xp_tweaks.htm, and right-click on item 249, select Save Link As, and save it as defaultfont.reg, which should be the default. Go to where you saved the file defaultfont.reg, double-click on it, and select Yes to merge it with the registry.

Did that help?
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22465972 Fri, 29 May 2009 18:37:48 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22465171 Koil : I messed a bit with the theme settings of the desktop and set it to WIndows XP and it would immediately pop back to custom theme. Once when I did it, and blank box appeared on the task bar, no clue what it did, but when I right clicked on it and clicked close (only option) it went away and allowed theme to stay at Win XP.

Since then, the fonts are still wonked up, but that fixed the mouse issue..lol...weird stuff.
--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09]]> http://www.dslreports.com/forum/remark,22465171 Fri, 29 May 2009 15:57:07 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22464721 Koil : I tried resetting FF completely by removing my profiles folders.....brand new profile still has the same font issues...gotta be something OS wise, I think]]> http://www.dslreports.com/forum/remark,22464721 Fri, 29 May 2009 14:42:33 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22463881 Koil : Well, Kaspersky didn't find anything either....

Here's the HJT but I think its the same:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:28:35 PM, on 5/29/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\COMODO Internet Security\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
D:\Utils\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = »go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = »go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = »go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = »go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [COMODO Internet Security] "D:\COMODO Internet Security\Comodo\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - »www.nvidia.com/content/DriverDow···lab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - »www.nvidia.com/content/DriverDow···Scan.cab
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - D:\COMODO Internet Security\Comodo\COMODO Internet Security\cmdagent.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 3861 bytes

Any ideas on why the text in wordpad, FF, icons on the desktop all show up as either bold or italicized?

I checked the font settings in FF and they're set to use whatever the page sets, but it isn't working that way.

Everything should be at its default settings, but I will upload screenshots so you can see what I mean. (I added the black squares over icons for privacy reasons). Zoom keep clicking the screenshots until they're full size to see exactly what I am talking about.

The icons on the desktop aren't the default windows font, and have shadows beneath. Notepad defaults to an italics font, FF shows all text as bold....and the mouse doesn't scroll correctly...its only scrolls 2 lines maybe on a full rotation...and if I click on the slider bar tab to drag it down, it goes 2 lines, then the mouse goes to "click and drag" mode, and starts to try and drag the window on the desktop.
--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09

]]> http://www.dslreports.com/forum/remark,22463881 Fri, 29 May 2009 12:39:56 EDT Re: HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22462265 TheJoker : Hi Koil

I don't see anything wrong in your HijackThis log. :)

quote:
the only thing I think I see odd is the xpnetdiag stuff looks a little weird....not sure what that is.

It's legitimate:
»www.systemlookup.com/O9/35.html

Please do a scan with Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.
- The program will install and then begin downloading the latest definition files.
- After the files have been downloaded on the left side of the page in the Scan section select My Computer.
- This will start the program and scan your system.
- The scan will take a while, so be patient and let it run.
- Once the scan is complete, click on View scan report
- Now, click on the Save Report as button.
- In the drop down box labeled Files of type change the type to Text file.
- Save the file to your desktop.
- Copy and paste that information in your next post.

Please post a new HijackThis log, the log from Kaspersky's online scan, and note any errors encountered.
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,22462265 Fri, 29 May 2009 05:35:16 EDT HJT LOG: Desktop icons changed, text italicised http://www.dslreports.com/forum/remark,22461909 Koil : I got something...not sure what. My desktop fonts are wonky, notepad shows everything in italics, as well as webpages coming up in italics. My mouse wheel doesn't work very well.....very annoying. Not sure if its been cleaned out and I just need to reset everything manually, but I can't seem to get that to happen w/ the desktop, or browser italics issue.

Ad Aware, S&D, Panda Online scan, Trend Micro all came back clean.

Malwatre Bytes came back w/ this:
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

My Comodo (free ver) found 2 files...windows/system32/bass.dll and "uninst.exe" in my PS3 Media Server directory, but were removed and the condition persists.

HJT log below...the only thing I think I see odd is the xpnetdiag stuff looks a little weird....not sure what that is.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:07:54 AM, on 5/29/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\COMODO Internet Security\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
D:\COMODO Internet Security\Comodo\COMODO Internet Security\cfp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Utils\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = »go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = »go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = »go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [COMODO Internet Security] "D:\COMODO Internet Security\Comodo\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - »www.nvidia.com/content/DriverDow···lab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - »www.nvidia.com/content/DriverDow···Scan.cab
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - D:\COMODO Internet Security\Comodo\COMODO Internet Security\cmdagent.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 3810 bytes
--
Let us so live that when we come to die, even the undertaker will be sorry. -Mark Twain

My Blog - Raising Connor - »raisingconnor.blogspot.com/ - updated 3/11/09]]> http://www.dslreports.com/forum/remark,22461909 Fri, 29 May 2009 01:17:23 EDT