Background Issue

[Scribner]

When clicking on Signon Name to enter WindowsXP, "Tulips" wallpaper
background appears; but when computer finally boots into Windows and Icons
pop up on desktop, Wallpaper background reverts to Blue color.

When I go into "Display Properties/Desktop Tab" the ability to highlight
"Tulips" (or any other wallpaper) all Wallpaper is grayed out, along with
"Browse" "Stretch". I'm unable to highlight any one of them.

Any ideas? I've tried "Settings" tab, whatnot, to no avail.

How can "Tulips Wallpaper" appear while booting, and then disappear at
desktop?

Thank you for your help.

Ernie

 

[Malke]

When clicking on Signon Name to enter WindowsXP, "Tulips" wallpaper
background appears; but when computer finally boots into Windows and
Icons pop up on desktop, Wallpaper background reverts to Blue color.

When I go into "Display Properties/Desktop Tab" the ability to
highlight "Tulips" (or any other wallpaper) all Wallpaper is grayed
out, along with
"Browse" "Stretch". I'm unable to highlight any one of them.

Any ideas? I've tried "Settings" tab, whatnot, to no avail.

How can "Tulips Wallpaper" appear while booting, and then disappear at
desktop?

Assuming you haven't installed some third-party theming application that
has played havoc with your display options - Go to the Display applet
in Control Panel and look on the Desktop tab. Click on Customize
Desktop, and then click on the Web tab. You will see that there are
checkmarks next to "My Current Home Page" and probably "Lock Desktop
Items". Uncheck these. Apply and OK out. Now see if you can change your
desktop as desired.

Otherwise - If you can't enable desktop backgrounds after a virus, MVP
Kelly Theriot has a fix. Look under Wallpaper-Desktop-Disable Changing
here:
http://www.kellys-korner-xp.com/xp_w.htm

If Display tabs are missing, run Kelly's registry edit on line 285,
right-hand side "Restore all display tabs".

Malke

 

[Scribe]

Hi, Malke:

Tried everything you suggested, still with no luck.

And, you were correct about malware; the machine had Pesttrap on it. I was
able to remove it, but it was an effort. Machine running great now, but for
Display problem. Tabs are there, but unable even to use the scroll in
"Display Properties" under tab "Desktop".

Also, went through the msconfig disabling everything; still no luck.

Interesting enough, when I went into "Safe Mode" from boot using the F8 key,
Desktop choices and Themes - Tulips, Wind, etc. - were accessible and
functional. But, cannot replicate it booting into Windows with all
everything disabled in msconfig. So, something is loading and graying out
Desktop and Themes options.

Anyway, unless you have any other ideas, I thank you for your time and
effort. And, your help.

Ernie

 

[Malke]

Hi, Malke:

Tried everything you suggested, still with no luck.

And, you were correct about malware; the machine had Pesttrap on it.
I was
able to remove it, but it was an effort. Machine running great now,
but for
Display problem. Tabs are there, but unable even to use the scroll in
"Display Properties" under tab "Desktop".

Also, went through the msconfig disabling everything; still no luck.

Interesting enough, when I went into "Safe Mode" from boot using the
F8 key, Desktop choices and Themes - Tulips, Wind, etc. - were
accessible and
functional. But, cannot replicate it booting into Windows with all
everything disabled in msconfig. So, something is loading and graying
out Desktop and Themes options.

The steps I gave you assumed a clean machine. Your machine is still not
clean. Do the preparatory steps here first:
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Then do the Smitfraud removal steps here:
http://www.elephantboycomputers.com/page2.html#Smitfraud_Trojan

Finish up by running through at least some of the malware removal steps
in the first step.

Malke

 

[Scribner]

Hi, Malke:

Just read your email, tonight. I have perused thoroughly the information on
the links you've provided.

Just so you know, I'm here on the east coast of the U.S., in the State of
Rhode Island. The time right now is 7:08 p.m, EST. After reading
everything, I realize this is NOT a project to start tonight. And, luckily,
I have next week off. And, from my understanding of what you've proffered,
I MAY NEED every bit of that time just to hack my way through this!!!!! )

But, I enjoy a good challenge, and will start tomorrow morning.

Thank you so much for your time. It appears you have a business in this
very field and certainly are not obligated to help. Just know that I
realize that and am appreciative.

Assuming I'm able to "sing along from the same page of your spyware-removal
hymn book" without being "off key", I should be back with a post tomorrow
night to let you know of my success/failure. (Expect a good laugh)

Will be in touch,

Ernie

 

[Malke]

Hi, Malke:

Just read your email, tonight. I have perused thoroughly the
information on the links you've provided.

Just so you know, I'm here on the east coast of the U.S., in the State
of
Rhode Island. The time right now is 7:08 p.m, EST. After reading
everything, I realize this is NOT a project to start tonight. And,
luckily,
I have next week off. And, from my understanding of what you've
proffered,
I MAY NEED every bit of that time just to hack my way through
this!!!!! )

But, I enjoy a good challenge, and will start tomorrow morning.

Thank you so much for your time. It appears you have a business in
this
very field and certainly are not obligated to help. Just know that I
realize that and am appreciative.

Assuming I'm able to "sing along from the same page of your
spyware-removal hymn book" without being "off key", I should be back
with a post tomorrow
night to let you know of my success/failure. (Expect a good laugh)

You'll do just fine, Ernie. Let me know if you need more help, but I
expect you'll just be posting back to say all is well. Don't forget,
you always have the option to take the machine to a local professional
and go do something more amusing. There is no shame in doing this; I
take my car to the mechanic without hesitation.

I enjoyed your post a great deal.

Malke

 

[Scribner]

Hello, Malke:

Well, I followed your instructions explicitly, and got an education in
malware/virus removal. There were quite a few pieces of "crap", which was
able to be recognized and taken care of by the software installations you
recommended.

The only problem that still remains is: The "Tulips" wallpaper is now there
permanently; it's not just a blue background; but, still other selections of
wallpaper cannot be highlighted and applied.

I just now booted into safe mode under user name, and Display
Properties/Desktop is not functional. Am now booting into safe mode under
Administrator.

Guess what? The desktop wallpaper is now able to be highlighted and
utilized. Whatever is affecting Display Properties under User Name in Safe
Mode is NOT affecting it under Administrator.

I know you've indicated taking the machine to a "Professional", but a
Clean-Install is not a problem for me; I just didn't want to go through
that. Unless you have another idea, I'd druther do it.

Whatdayathink? )

mE



"cleaning" an infected machine.

 

[Malke]

Hello, Malke:

Well, I followed your instructions explicitly, and got an education in
malware/virus removal. There were quite a few pieces of "crap", which
was able to be recognized and taken care of by the software
installations you recommended.

The only problem that still remains is: The "Tulips" wallpaper is now
there permanently; it's not just a blue background; but, still other
selections of wallpaper cannot be highlighted and applied.

I just now booted into safe mode under user name, and Display
Properties/Desktop is not functional. Am now booting into safe mode
under Administrator.

Guess what? The desktop wallpaper is now able to be highlighted and
utilized. Whatever is affecting Display Properties under User Name in
Safe Mode is NOT affecting it under Administrator.

I know you've indicated taking the machine to a "Professional", but a
Clean-Install is not a problem for me; I just didn't want to go
through
that. Unless you have another idea, I'd druther do it.

Did you try Kelly's fixes yet? If not, here they are again:

If you can't enable desktop backgrounds after a virus, MVP Kelly Theriot
has a fix. Look under Wallpaper-Desktop-Disable Changing here:

http://www.kellys-korner-xp.com/xp_w.htm

If Display tabs are missing, run Kelly's registry edit on line 285,
right-hand side "Restore all display tabs".

And some additional info to try:

Check to see if these Registry entries exist (I've put the entry on 2
lines for the newsreader; obviously the registry key will appear all on
one line:

HKCU\Software\Microsoft\Windows\CurrentVersion\GroupPolicyobject
\{21A7BE9D-5027-49C1-B6F7-757B707E1C94}User\Software\Policies\Microsoft\Windows\System
If "GroupPolicyRefreshTime" and/or "GroupPolicyRefreshTimeOffset" are
there, then delete them.

HKCU\Software\Policies\Microsoft\Windows\System. If
"GroupPolicyRefreshTime" and/or "GroupPolicyRefreshTimeOffset" are
there, then delete them and then run the reg fix from Kelly's page.

A default wallpaper called wp.bmp may be set in
HKCU\Software\Policies\Microsoft\Windows\System created by the
smitfraud.c virus. Remove that and you will be able to choose different
wallpapers.

Malke

 

[Scribner]

Just got up, will be heading back to slumberland, but wanted to check my
email. (Are we sick? or, what?

Thanks for getting back to me. Yes, I tried Kelly's fixes that you had
mentioned. The "tabs" are all there and workable; as I said, just unable to
highlight and with the scroll bar grayed out. Even the preview screen is
grayed out, though Tulips is now the permanent wallpaper. Tried changing
the wallpaper under "Administrator", rebooted normally into Windows, and it
reverted to Tulips and grey-outs in Display Properties.

Also, I have perused "Programs" and "C" drive looking for third-party
themes, found none.

Anyway, Will do your current suggestions of registry tweaks later on today.
Though you've walked me through processes I was unfamiliar with - thus,
another learning experience for me - now that all malware is gone, this last
remaining issue is turning out to be a conundrum.

Will advise,

Ernie

 

[Scribner]

Hi, Malke:

Well, I finally found the culprit to the problem. (No, I could not bring
myself, yet, to do a clean install; this thing has been bugging me, and I
knew there had to be a reason.)

Apparently, under
Hkey_Current_User/software/Microsoft/Windows/CurrentVersion/Policies/Explorer,
there were a number of entries (Approximately 6) (None of which I wrote
down, unfortunately) which indicated background, wallpaper, etc. All these
bogus values were set to 0. I deleted each one; and, bingo, I can now
change the wallpaper, and all grayed out functions are now operable.

I did save a copy of the Registry, so the miscreant entries are still in the
copy.

Thought you would enjoy hearing some good news, and where, exactly, the
entries were. )

Again, thank you for your help. Believe it or don't, it was an education
following your instructions. I've printed/saved everything you wrote in
case something like this comes up again.

If you'd like the copy of the "registry" for your review, I'll be happy to
send it to you.

My very best wishes to you and your family, Malke.

Ernie

 

[Malke]

Hi, Malke:

Well, I finally found the culprit to the problem. (No, I could not
bring myself, yet, to do a clean install; this thing has been bugging
me, and I knew there had to be a reason.)

Apparently, under
Hkey_Current_User/software/Microsoft/Windows/CurrentVersion/Policies/Explorer,
there were a number of entries (Approximately 6) (None of which I
wrote
down, unfortunately) which indicated background, wallpaper, etc. All
these
bogus values were set to 0. I deleted each one; and, bingo, I can now
change the wallpaper, and all grayed out functions are now operable.

I did save a copy of the Registry, so the miscreant entries are still
in the copy.

Thought you would enjoy hearing some good news, and where, exactly,
the
entries were. )

You thought right - I'm very glad you found the cause and applaud your
perserverance and Sherlockian skills. No, I don't want the registry but
I have made a note of the key. I think you could have set the values to
"1", but if everything is working that's just fine.

Thank you very much for taking the time to post the solution. Stay safe
now!

Malke