Can't change Desktop background due to virus/malware
RobW
I have just removed quite a lot of spyware/malware from a PC running
XP Pro Sp2.
One of the nasties was Trojan-Spy.HTML.Smitfraud.c. (wp.exe)
After removing all the malware the main profile still had the smitfaud
desktop background and the "desktop" tab was missing from the display
properties dialog box.
I restored this with a reg fix from Kelly's korner, however even with
the "desktop" tab there it still won't let me change desktop
backgrounds.
It won't change even when I right click a .bmp and choose Set as
Desktop Background.
Any suggestions would be much appreciated.
Best regards,
Rob
WTC
news:ebed711bq4v6v3b7v...@4ax.com...
Make a Registry Edit
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
or
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
In the right-hand pane, delete "NoChangingWallPaper" or change the value
to 0.
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
In the right-hand pane, delete "Wallpaper" and "WallpaperStyle".
--
William
Rock
Also try in Display Properties, Desktop, Customize Desktop, Web tab -
uncheck all items in the Web Pages box and delete everything except My
Computer Home Page.
--
Rock
MS MVP Windows - Shell/User
RobW
Hi WTC,
Thanks for the suggestion, however the 1st reg key
"NoChangingWallPaper" was already set to 0.
The 2nd "Wallpaper" and "WallpaperStyle" did not exist.
Hi Rock,
I did what you suggested,
FYI,
the background can be modified fine in the other user accounts. It's
only on this 1 profile that it won't change.
Thanks,
Rob
WTC
Did you try to edit this key while logged on the user cannot change the
background.
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
In the right-hand pane, delete "NoChangingWallPaper" or change the value
to 0.
--
William
RobW
Hi William,
It was already set to 0.
I just went back in and deleted it "NoChangingWallPaper" to make sure
and this has made no difference.
Regards,
Rob
RobW
<bcrawfordjr(remove)@yahoo.com> wrote:
Sorry,
In answer to your Q.
Yes, I was logged in as the user that can't change to wallpaper.
Rob
WTC
Kelly has a Reg fix that may fix your problem under Wallpaper -
Desktop - Disable Changing
http://www.kellys-korner-xp.com/xp_w.htm
--
William
RobW
<bcrawfordjr(remove)@yahoo.com> wrote:
>http://www.kellys-korner-xp.com/xp_w.htm
Hi William,
Appreciate your help, but still no joy.
Ran wallpaperenable.reg and rebooted (just in case).
Still can't change wallpaper.
Regards,
Rob
Kelly
Are you running any third party desktop enhancers? Which types of
backgrounds are you trying to change to? Where are they located and where
did they come from? What are the extensions, how does your desktop HKEY
desktop hives read, etc?
--
All the Best,
Kelly (MS-MVP)
Troubleshooting Windows XP
http://www.kellys-korner-xp.com
"RobW" <no...@none.com> wrote in message
news:ebed711bq4v6v3b7v...@4ax.com...
RobW
>Hi Rob,
>
>Are you running any third party desktop enhancers?
No
>Which types of backgrounds are you trying to change to?
Standard MS backgrounds
>Where are they located and where did they come from?
C:\Windows , just stock standard XP backgrounds.
>What are the extensions, how does your desktop HKEY desktop hives read, etc?
.bmap and I am not sure which registry hives you would like to know
about
Thanks Kelly.
Rob
WTC
Rob,
Could you look at see if these four items are located in the Registry,
they refresh current policies and make current policies revert back to
the correct values when the policies have been changed without using the
Group Policy Editor.
HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy
Object\{21A7BE9D-5027-49C1-B6F7-757B707E1C94}User\Software\Policies\Microsoft\Windows\System
If "GroupPolicyRefreshTime" and/or "GroupPolicyRefreshTimeOffset" are
there then delete them
HKCU\Software\Policies\Microsoft\Windows\System
If "GroupPolicyRefreshTime" and/or "GroupPolicyRefreshTimeOffset" are
there then delete them and then run the reg fix from Kelly's Page that
you downloaded earlier.
But I have a feeling they will probably not be present.
--
William
RobW
There was a default wallpaper called wp.bmp set in
HKCU\Software\Policies\Microsoft\Windows\System created by the
smitfraud.c virus.
I removed that and now I can choose different wallpapers.
Thank-you very much for your time and expertise.
Best regards,
Rob
RobW
Thank-you for taking the time to look at this.
There was a default wallpaper called wp.bmp set in
HKCU\Software\Policies\Microsoft\Windows\System created by the
smitfraud.c virus.
I removed that and now I can choose different wallpapers.
Thank-you very much.
Best regards,
Rob
On Mon, 2 May 2005 22:39:57 -0500, "Kelly" <ke...@mvps.org> wrote:
WTC
> WELL DONE William!!!!!!
> There was a default wallpaper called wp.bmp set in
> HKCU\Software\Policies\Microsoft\Windows\System created by the
> smitfraud.c virus.
> I removed that and now I can choose different wallpapers.
> Thank-you very much for your time and expertise.
>
You're welcome.
--
William
Kelly
Was there anything else listed under .....\System?
--
All the Best,
Kelly (MS-MVP)
Troubleshooting Windows XP
http://www.kellys-korner-xp.com
"RobW" <no...@none.com> wrote in message
news:hm1e71hua1uhdhrb1...@4ax.com...
RobW
However they looked normal as far as I could tell. (not that I would
really know, lol)
The machine is back at my friends place now so I can't refer to it
right now.
Thanks again.
Rob :-)
Kelly
--
All the Best,
Kelly (MS-MVP)
Troubleshooting Windows XP
http://www.kellys-korner-xp.com
"RobW" <no...@none.com> wrote in message
news:5tph71932jdqobmar...@4ax.com...