Help! Desktop replaced with a webpage advert!

Yesterday i was browsing the web when i had a popup window that downloaded some spyware to mm machine.

My desktoo then turned into a web page saying "You have been compomised by blaa blaa, click here to download some sort of secuirty sweet to remove it".

Right clicked on the webpage and found it was sitting in c:\windows\web\
so i deleted all the files in tehre and now windows loads a blank white webpage over my desktop that i cant close or remove.

I also got infected by 106 items of spyware which through use of Adware, Spybot s&d, CWShredder and spyware docter i removed.

Heres my Hijackthis log:


Logfile of HijackThis v1.97.7
Scan saved at 10:35:38, on 20/06/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\LckFldService.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Spyware Doctor\spydoctor.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\OPScan.exe
D:\My Downloads\Misc\Tools\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}

Please help, I want my desktopback

 

Can no one help? ive looked at my registary but its all double duch to me, ive used Mscofig but i dont see anything that needs disabling there. Ive run all my scanners and unitlies 3 times and i look clean. I really dont know what to do

 

Hi there Mord, i'm not one of the HJT experts, but it appears to me your HJT log is very short! Did you really check all the options to be shown in the log?
And rightclick on the desktop doesn't enable to get back to no wallpaper?
System restore , if the experts have no better option? But wait till they tell you so,

 

Hi Mord,

The first place I'd check is:
Open the Control Panel.
Open Display Properties.
Click the Desktop tab.
Click the Web tab in the Desktop Items window.

Regards,

Pieter

 

thanks, I dont belive i dindt check the web tab *slaps forehead*, well its fixed now thats what matters.

Oh as for my HJthis log, i went a bit podantic and removed everything i dindt need.

 

Glad Pieter's advice is right again, as always.
In the parts you removed could have been / could be indications of your downloads etc. But i'm no expert in that part.