weird graphical changes

[George Hester]

Hijack this can get rid of the reg entries not the files. Deleting the
files is one thing but you could have a trojan bringing them back in. I
still say the issue is Norton. I do not think those Imaging programs are
the result. I have Adobe 7.0 in here and do not have this issue. It may be
that Norton recognized what it thought was an attempt to change system files
by Office disabled the attempt and now you have what you have. An uninstall
will not fix that. Addins - did you look there in the Office applications
not just COM? Look at Excel. First do you get the corrupted Splash? If so
look at the startup folder in C:\Programs\Office\... xlstart.. Make sure
there is no personal.xls there. Then go into the Documents and Settings
folder under your profile and then Application Data. Then under Microsoft |
Excel you should see a Start Up. Look in there. If it is not empty move
the stuff out do not delete. Remove the xlb also under Excel. Make sure
Norton stuff is gone under Application Data as well. Now there is a way of
opening an Office Application in safe mode depending on the version you are
using. Hold the CTRL key down when double-clicking or selecting the startup
program Excel say.

 

[Guest]

I know this isn't the main issue here but, the registry keys for shicoxp,
caxchg, registry cleaner, tkbell (real player thing), and steam (hl2 demo)
keep recreating themselves right after Hijackthis deletes them. Even if I go
in and manually delete those registry values in safe mode, when i restart
back in normal windows mode they are recreated. I know this is true because
I have Ad-Watch and it tells me when new data is created in the registry,
among other things. How can I get rid of them permanently? Or do I not need
to?

If you think what is happening is what you said ("It may be that Norton
recognized what it thought was an attempt to change system files by Office
disabled the attempt and now you have what you have.") then why wasn't the
splashscreen normal when I uninstalled Norton and repaired Office? And why
was the splashscreen normal before any of this started when Office and Norton
were still integrated? Do you think one of the Norton definitions file
updates had something to do with it? Ok, I looked in Word, Excel, and PPT at
add-ins and don't see any. What is "COM"? Yes, still getting corrupted
splashscreens on all Office apps. There was a folder called XLSTART in app
data/microsoft/excel, nothing in it. Nothing in STARTUP folder in Word. No
startup folder of any sort in PPT. What do you want me to do about the
Symantec (norton) folder? I emptied it out, still no change. Do I need to
get rid of app data from "guest" or anything else? I tried starting word and
excel in safe mode, nothing different happens other then it telling me it's
going to start in safe mode. Sorry if I'm not that computer smart. Thanks
again for your help so far.

Greg

 

[George Hester]

The spyware you have must be gotten out and for me to explain how to
permenently keep it out is not that easy. Your best bet is to try to ask
someone that knows where to look. But in truth this may not be sufficient.
There are things called Root Kits that the only fix is a complete resinstall
and then to watch what you do on the Net. Sorry. But my opinion is to
reinstall and then do NOT put Norton on your machine. In fact you want to
make sure that any AV software you put on your machine is not allowed to
integrate with Office. They never work right I do not care who makes it.
And I don't care what anyone says to the contrary. My suggestion is to
reinstall the op sys and like I said keep Norton out.

As for the malware you have on the machine that is a result of visiting
sites that put that stuff on your machine. You should always surf with ALL
Security set to disable everything except two things; file downloads and
Submit unencrypted data. The first so that you can d/l files and the second
so that you can fill out forms. EVERYTHING else disable when you are going
to sites you are unfamiliar with. Also NEVER suirf with an account in
Windows XP that is part of any group that has a high level of permissions.
Sign in wih the guest account or one with similar lack of permissions and
surf from that profile.

Anything else we investigate will take too long I don't have the stamina for
it sorry. You might get more help at Tom Coyote's forums but I think you
will end up doing what I tell you anyway. Good luck Greg.

 

[Guest]

Ok, I will post this issue on Tom Coyote's forums and see what they have to
say. If I do end up formatting my hard drive/reinstalling XP is there
somewhere I can find step by step instructions on how to do that so that I
make sure I do it right and don't screw something up?