Desktop.Active Desktop

[hdbg62]

Just joined this forum a few minutes ago. Checked this site as usual when Spybot does not remove a found problem but this time was not able to locate an answer. So here it goes. For several weeks now I've been running Spybot and the same problem is found each time: Desktop.Active Desktop - 7 entries.
I'm running an older IBM clone with Windows 98SE, using AOL and everything seems to be normal if not operating just a bit slower while browsing. Anybody experiencing same problem or an answer for this? Thanks!
**********************************************************

Desktop.ActiveDesktop: User settings (Registry change, nothing done)
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoMovingBands!=0

Desktop.ActiveDesktop: User settings (Registry change, nothing done)
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoCloseDragDropBands!=0

Desktop.ActiveDesktop: User settings (Registry change, nothing done)
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper!=0

Desktop.ActiveDesktop: User settings (Registry change, nothing done)
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoHTMLWallPaper!=1

Desktop.ActiveDesktop: User settings (Registry change, nothing done)
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoClosingComponents!=0

Desktop.ActiveDesktop: User settings (Registry change, nothing done)
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoEditingComponents!=0

Desktop.ActiveDesktop: User settings (Registry change, nothing done)
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoDeletingComponents!=0


--- Spybot - Search && Destroy version: 1.3 ---
2005-11-18 Includes\Cookies.sbi
2005-11-18 Includes\Dialer.sbi
2005-11-18 Includes\Hijackers.sbi
2005-11-18 Includes\Keyloggers.sbi
2005-11-18 Includes\Malware.sbi
2005-11-18 Includes\Revision.sbi
2005-11-18 Includes\Security.sbi
2005-11-18 Includes\Spybots.sbi
2005-11-18 Includes\Trojans.sbi
2005-02-17 Includes\Tracks.uti
2004-11-29 Includes\LSP.sbi
2005-11-18 Includes\PUPS.sbi

[LonnyRJones]

Hi hdbg62, Welcome

--- Spybot - Search && Destroy version: 1.3 ---

In windows addremove programs uninstall SpyBot then Restart the PC, and delete SpyBots folder in program files,
usualy > C:\Program Files\Spybot - Search & Destroy
Then download and install 1.4 once thats done, check for updates, then check for problems, fix everything found, always reboot if SpyBots needs to, to finish the cleanup.
http://www.safer-networking.org/index.php?page=tutorial
Download found here
http://www.safer-networking.org/en/download/index.html

[hdbg62]

Thanks for quick reply; I'll give it a shot and will get back. One question though, should Spybot Update not have informed me of a newer version available?

[hdbg62]

Thanks Lonny, it worked just fine! Still, I am curious, what was it? I run NAV, Spyware Blaster and of course use Spybot.

[LonnyRJones]

Hi

Im not sure, could you post a SpyBot report after fixing so we can double check

Open SpyBot 1.4, check for and get any updates available, close all browsers, check for problems and fix everything found. Then on the toolbar menu select mode and switch to advanced mode, on the left lower down select tools,and view report, ensure all the options are select near the bottom except
Uncheck[ ] do not report disabled or known legitimate Items,
uncheck[ ] Include a list of services in report.
Uncheck[ ] Include uninstall list in report.
Now select (near the top) view report, Press export, in the save in box choose a place such as your my documents folder, then in your next post near the bottom select the "browse" button , navigate to and attach or post that report please.

[hdbg62]

Hi Lonny,

Hope I did this right; would this be my third report? Ran one after install and update which solved the problem, then another just to make sure and now in doing what you asked. Or does it all stay in there?


Jerry

[LonnyRJones]

Hi, Thanks

In SpyBots tools > system start
hilight this item and delete

HK_LM:Run, webHancer Agent (DISABLED)
"C:\Program Files\webHancer\Programs\whAgent.exe"

Why do you have more than one antivirus program and why on earth are they disabled ?
MCAFEE and norton

I suggest these be re-enabled
HK_LM:Run, ScanRegistry (DISABLED)
command: C:\WINDOWS\scanregw.exe /autorun

HK_LM:Run, SystemTray (DISABLED)
SysTray.Exe
file: C:\WINDOWS\SYSTEM\SysTray.Exe

HK_LM:RunServices, KB891711 (DISABLED)
command: C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE

HK_LM:RunServices, LoadPowerProfile (DISABLED)
Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

[hdbg62]

Thanks for quick reply; lets see:

1. Don't have anything named webhancer, no file and nothing in StartUP

2. I don't have and never had MCafee, can't even find a file named the same!
Perhaps something got imported by AOL?

3. I got Norton Anti Virus uninstalled through ad/remove and am using their
online anti virus check program; I have an older sustem, 128 MEG Ram
and a Spectra (400KAMD) Proc.; NAV just slowed my system down
qutie a bit.

4. ScanReg, Systray and KB891711 were disabled in Sys Config Utility and I
will enable. Exactly what is KB891711? I know it was an update but what
does it do?

5. Load Power Profile is enabled in Sys Config Utility but I don't have any
scheme loaded in Power Profiles; have been putting my PC on Standby
through Shutdown command.

Spybot System Startup is attached ;your comments are appreciated, thank you!

Jerry

[hdbg62]

Hi Lonny,

Guess my eyes are going bad, just found webhancer in Startup and deleted.


Jerry

[LonnyRJones]

Hi

You can delete nortons to, for now please re-anable aols mcafee
i had forgot they were including it.

You could download another less resouce intensive program then disconnect uninstall mscaffee and install the new program
I suggest AVGfree
AVG Anti-Virus-Free: http://www.grisoft.com/us/us_dwnl_free.php

post another startup listr when that finished please

[hdbg62]

Ok; I do not have Norton NAV nor McAfee installed but I am running Norton Utilities; deleted webhancer and activated systray, scanreg, KB891711 in Startup; attached is my Startup list from Spybot as it stands now; will download your recommended antivirus program.


Jerry

[hdbg62]

ok, attached is Spybot Startup; installed AVG, updated and ran virus check; no virus, system has slowed down some; in Startup what is HK_LMRunOnce?
it is not listed or checked in my System Config Utility Startup.

[LonnyRJones]

Hi

I dont see a runonce in there. its common to see one from time to time
can we see a uninstall list from hijackthis ?
in hijackthis click config > mise tools > open uninstall manager > save list<

[hdbg62]

Hi,

Copied just the enabled items from Spybot Startup, it's the last item on the bottom in red; as I said it's enabled in Spybot but doesn't even show up in SysConfig Utility Startup; what's hijackthis?



Located: HK_LM:Run, AVG7_AMSVR
command: C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
file: C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
size: 336896
MD5: 71599f550d4d892671dba3f05efafb71

Located: HK_LM:Run, AVG7_CC
command: C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
file: C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE
size: 356352
MD5: 6492815fc67068a11420740637946b0e

Located: HK_LM:Run, AVG7_EMC
command: C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
file: C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
size: 279040
MD5: ffeffa201b60d9095c2ca826af9f167b

Located: HK_LM:Run, internat.exe
command: internat.exe
file: C:\WINDOWS\SYSTEM\internat.exe
size: 28672
MD5: 598546c897cf0e351a9af69c3a446be4

Located: HK_LM:Run, LoadPowerProfile
command: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
file: C:\WINDOWS\Rundll32.exe
size: 24576
MD5: 3857d93aa630abbd63467db4aeffce2c

Located: HK_LM:Run, ScanRegistry
command: C:\WINDOWS\scanregw.exe /autorun
file: C:\WINDOWS\scanregw.exe
size: 86016
MD5: f123231689e2ab2fa5c636b99314501f

Located: HK_LM:Run, StillImageMonitor
command: C:\WINDOWS\SYSTEM\STIMON.EXE
file: C:\WINDOWS\SYSTEM\STIMON.EXE
size: 114688
MD5: 3a395315c2d9e63c0ce4704afa404ffa

Located: HK_LM:Run, SystemTray
command: SysTray.Exe
file: C:\WINDOWS\SYSTEM\SysTray.Exe
size: 27648
MD5: c7e1448ef194081ca615b2601e9751fd

Located: HK_LM:RunServices, AOL TopSpeedMonitor
command: C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
file: C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
size: 100016
MD5: 7fb54900aa9792ab6307c699ec1859d4

Located: HK_LM:RunServices, KB891711
command: C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
file: C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
size: 9088
MD5: cbd841775a04e82b2828fc301aafee70

Located: HK_LM:RunOnce, 7837dfa0-128c-11da-b336-8c335f8e893f
command:
file:

[LonnyRJones]

Hi
Windows should delete it the next time tou restart the pc

[hdbg62]

Hi,

Yep, it's gone! Thank you for all your time and help!

[LonnyRJones]

Hi
uninstall list ?
I still suggest uninstalling Norton(anything) since your concerned with resources, even if some of it is disable part's of it still consume resources.

You asked about KB891711.EXE
http://support.microsoft.com/default.aspx?scid=kb;en-us;891711

[hdbg62]

Hi,

When you talk about "uninstall list", are you still talking about "hijackthis"?
As I said, I don't know what that is; also I have NAV uninstalled but I still use
Norton Utilities such as Windoctor, Diskdoctor, Speed Disc and Optimization
Wizard.

[LonnyRJones]

Yes hijackthis can make a list, mentioned here >
http://forums.spybot.info/showpost.php?p=2319&postcount=13

[hdbg62]

Yes, I know you mentioned it in this previous post but as I said, what is
"hijackthis"?

[LonnyRJones]

Opps sorry, we can get an uninstall list/report with SSD also
tools > uninstall Info > export

[hdbg62]

Here's Uninstall from Spybot.

[LonnyRJones]

Hi hdbg62
In the future Never sacifice your antivirus program becouse of limited resources
Remind us of the current problems please.

[hdbg62]

Hi,

I'll keep that in mind; thanks for the help!