Can't change Desktop background due to virus/malware

R

RobW

Hello all,

I have just removed quite a lot of spyware/malware from a PC running
XP Pro Sp2.
One of the nasties was Trojan-Spy.HTML.Smitfraud.c. (wp.exe)
After removing all the malware the main profile still had the smitfaud
desktop background and the "desktop" tab was missing from the display
properties dialog box.
I restored this with a reg fix from Kelly's korner, however even with
the "desktop" tab there it still won't let me change desktop
backgrounds.
It won't change even when I right click a .bmp and choose Set as
Desktop Background.

Any suggestions would be much appreciated.

Best regards,
Rob
 
W

WTC

RobW said:
Hello all,

I have just removed quite a lot of spyware/malware from a PC running
XP Pro Sp2.
One of the nasties was Trojan-Spy.HTML.Smitfraud.c. (wp.exe)
After removing all the malware the main profile still had the smitfaud
desktop background and the "desktop" tab was missing from the display
properties dialog box.
I restored this with a reg fix from Kelly's korner, however even with
the "desktop" tab there it still won't let me change desktop
backgrounds.
It won't change even when I right click a .bmp and choose Set as
Desktop Background.

Any suggestions would be much appreciated.
Click to expand...

Make a Registry Edit

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
or
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
In the right-hand pane, delete "NoChangingWallPaper" or change the value
to 0.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
In the right-hand pane, delete "Wallpaper" and "WallpaperStyle".
 
R

Rock

RobW said:
Hello all,

I have just removed quite a lot of spyware/malware from a PC running
XP Pro Sp2.
One of the nasties was Trojan-Spy.HTML.Smitfraud.c. (wp.exe)
After removing all the malware the main profile still had the smitfaud
desktop background and the "desktop" tab was missing from the display
properties dialog box.
I restored this with a reg fix from Kelly's korner, however even with
the "desktop" tab there it still won't let me change desktop
backgrounds.
It won't change even when I right click a .bmp and choose Set as
Desktop Background.

Any suggestions would be much appreciated.

Best regards,
Rob
Click to expand...

Also try in Display Properties, Desktop, Customize Desktop, Web tab -
uncheck all items in the Web Pages box and delete everything except My
Computer Home Page.
 
R

RobW

Hello all,

I have just removed quite a lot of spyware/malware from a PC running
XP Pro Sp2.
One of the nasties was Trojan-Spy.HTML.Smitfraud.c. (wp.exe)
After removing all the malware the main profile still had the smitfaud
desktop background and the "desktop" tab was missing from the display
properties dialog box.
I restored this with a reg fix from Kelly's korner, however even with
the "desktop" tab there it still won't let me change desktop
backgrounds.
It won't change even when I right click a .bmp and choose Set as
Desktop Background.

Any suggestions would be much appreciated.

Best regards,
Rob
Click to expand...



Hi WTC,
Thanks for the suggestion, however the 1st reg key
"NoChangingWallPaper" was already set to 0.
The 2nd "Wallpaper" and "WallpaperStyle" did not exist.


Hi Rock,
I did what you suggested,

FYI,
the background can be modified fine in the other user accounts. It's
only on this 1 profile that it won't change.

Thanks,
Rob
 
W

WTC

RobW said:
Hi WTC,
Thanks for the suggestion, however the 1st reg key
"NoChangingWallPaper" was already set to 0.
The 2nd "Wallpaper" and "WallpaperStyle" did not exist.


Hi Rock,
I did what you suggested,

FYI,
the background can be modified fine in the other user accounts. It's
only on this 1 profile that it won't change.
Click to expand...

Did you try to edit this key while logged on the user cannot change the
background.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
In the right-hand pane, delete "NoChangingWallPaper" or change the value
to 0.
 
R

RobW

Did you try to edit this key while logged on the user cannot change the
background.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
In the right-hand pane, delete "NoChangingWallPaper" or change the value
to 0.
Click to expand...

Hi William,

It was already set to 0.
I just went back in and deleted it "NoChangingWallPaper" to make sure
and this has made no difference.

Regards,
Rob
 
R

RobW

Did you try to edit this key while logged on the user cannot change the
background.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
In the right-hand pane, delete "NoChangingWallPaper" or change the value
to 0.
Click to expand...


Sorry,

In answer to your Q.
Yes, I was logged in as the user that can't change to wallpaper.

Rob
 
K

Kelly

Hi Rob,

Are you running any third party desktop enhancers? Which types of
backgrounds are you trying to change to? Where are they located and where
did they come from? What are the extensions, how does your desktop HKEY
desktop hives read, etc?

--

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com
 
R

RobW

Hi Rob,

Are you running any third party desktop enhancers? No
Which types of backgrounds are you trying to change to? Standard MS backgrounds
Where are they located and where did they come from?
Click to expand...
C:\Windows , just stock standard XP backgrounds.
What are the extensions, how does your desktop HKEY desktop hives read, etc?
Click to expand...
..bmap and I am not sure which registry hives you would like to know
about

Thanks Kelly.
Rob
 
W

WTC

RobW said:
Hi William,

Appreciate your help, but still no joy.
Ran wallpaperenable.reg and rebooted (just in case).
Still can't change wallpaper.
Click to expand...

Rob,

Could you look at see if these four items are located in the Registry,
they refresh current policies and make current policies revert back to
the correct values when the policies have been changed without using the
Group Policy Editor.

HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy
Object\{21A7BE9D-5027-49C1-B6F7-757B707E1C94}User\Software\Policies\Microsoft\Windows\System
If "GroupPolicyRefreshTime" and/or "GroupPolicyRefreshTimeOffset" are
there then delete them

HKCU\Software\Policies\Microsoft\Windows\System
If "GroupPolicyRefreshTime" and/or "GroupPolicyRefreshTimeOffset" are
there then delete them and then run the reg fix from Kelly's Page that
you downloaded earlier.

But I have a feeling they will probably not be present.
 
R

RobW

WELL DONE William!!!!!!
There was a default wallpaper called wp.bmp set in
HKCU\Software\Policies\Microsoft\Windows\System created by the
smitfraud.c virus.
I removed that and now I can choose different wallpapers.
Thank-you very much for your time and expertise.

Best regards,
Rob
 
R

RobW

Kelly,

Thank-you for taking the time to look at this.

There was a default wallpaper called wp.bmp set in
HKCU\Software\Policies\Microsoft\Windows\System created by the
smitfraud.c virus.
I removed that and now I can choose different wallpapers.
Thank-you very much.

Best regards,
Rob
 
W

WTC

RobW said:
WELL DONE William!!!!!!
There was a default wallpaper called wp.bmp set in
HKCU\Software\Policies\Microsoft\Windows\System created by the
smitfraud.c virus.
I removed that and now I can choose different wallpapers.
Thank-you very much for your time and expertise.
Click to expand...


You're welcome.
 
R

RobW

There were some other keys in there.
However they looked normal as far as I could tell. (not that I would
really know, lol)
The machine is back at my friends place now so I can't refer to it
right now.
Thanks again.
Rob :)
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Desktop background 19
Lost Desktop Background option due to Trojan.Desktophijack virus 14
Desktop Shortcut Icons' Background Color changed?! 2
Cannot set desktop background after virus attack 4
can't change desktop shortcut url 4
Users can't change background image 2
Desktop Problems 7
Help! Unable to change desktop background 3

Top