Hugh, thanks very much. I tried it and it worked - that overlay is GONE! Most appreciated. Thomas, I'll of course try other spyware/malware programs. From a past exchange of suggestions on a similar problem I recall that some problems such as an embedded redirection can't, though, be fixed by software and may require a manual clean-up of the registry. I am sure that i have such a problem - some links which used to work now either don't work or I get a warning from Spyware Doctor that I'm being re-directed to a "potentially harmful site" and would I like to block it.... Any suggestions on manually cleansing one's registry and what I should look for ? Best - = Cheeta / [log in to unmask] At 11:20 AM 7/7/2006 -0400, Hugh Vandervoort wrote: >I believe your overlay" is an active desktop web page. >Right-click the desktop, select Properties/Desktop/Customize Desktop/Web. >If there is a web page listed, uncheck it. That should solve the problem. >For the other problems, I'd get Ad Aware and Spybot. > > >-----Original Message----- >From: PCSOFT - Personal Computer software discussion list >[mailto:[log in to unmask]] On Behalf Of C Gauba >Sent: Thursday, July 06, 2006 5:35 PM >To: [log in to unmask] >Subject: [PCSOFT] Trojan attack > > >Hello all - need help. > >My PC has been attacked by a Trojan (or rather by more than one). Despite >having AVG antivirus etc it seems I wandered onto a dangerous site and >downloaded malware. Here's what I saw: > >1. My desktop had something called "Search & Kill" which claimed to be a >spyware detector and started scanning my system, reporting spyware, and >"recommending" it be purchased to remove the problems > >2. My desktop turned bright red (from its usual pictorial wallpaper), with >a big bold spyware warning and a recommending to immediately get "Razz" (at >a price, of course). Icons etc displayed and worked normally for the most >part, but this in-your-face warning continued and my desktop wallpaper >couldn't be displayed > >3. My browser (IE) had been hijacked, with various links no longer working >or going to clearly inappropriate sites. > >I obtained and installed SPYWARE DOCTOR from PC Tool and ran a full scan >(it took ages, and involved stopping and re-scanning in 'safe' mode; but it >was finally completed). The situation now is: > >1. "Search & Kill" seems to have gone, totally >2. The bright red screen and demand to buy "Razz" has gone. However, the >wallpaper which appears normally during power-on is overlaid as soon as the >icons appear, although the screen is now not red but a neutral grey/white >screen, i.e. just like the red "Razz" screen without the colour, warning, >and "buy me" text box >3. My browser may still have re-directional problems, though I'm not too >sure - some clicks just don't seem to work any more (redirection being >blocked by my software?) > > From past correspondence on this forum I know that to recover from browser >direction I may need to manually edit the Registry and look for obscure >buried DNS re-direction. Question: how do I do this ?? > >My other question would be how to get my normal display back. Spyware >Doctor seems to have removed most of Razz but not vthe damage it caused. >Somehow Razz has patched something which loads this screen (window?), which >now overlays the wallpaper (but not the icons) - how do I get rid of it ? >By the way; it is active not passive as it appears to 'blink' from white to >gray and back. > >I am running Windows XP Home edition (version 5.1 with SP 2) on an IBM >Thinkpad R32 notebook. This has a Pentium 4 1.7 Ghz and 640 Mb of RAM. I >use AVG antivirus and now Spyware Doctor as well. I also have Registry >Mechanic (which reports no problems) and I used Registry Cleaner to find >"Security Agent Manager" which I removed. > > >Hope someone can help! > >Regards - = Cheeta Gauba / [log in to unmask] The NOSPIN Group Promotions is now offering our special coffee cups and mouse pads with the PCSOFT logo... at a great price!!! http://freepctech.com/goodies/promotions.shtml