Wallpaper cannot be changed

[brey]

Same problem as below:
Co-worker on XP sp2 would change her wallpaper and click apply, but it
wouldn't do anything - it just repaints the icons as IF the action was
applied. She ended up doing a system restore and problem goes away.
Ok No problem right?
I get the same problem on another computer, by another co-worker.
Trend, McAfee, Inoculate, AVG, Windows Defender, SpyBot - nothing
detects it. Finally after messing with her computer all day and talking
to Symantec (I submitted oleadm32.dll and wininet.dll for examination)
- I get back to my laptop and I discover I cannot change my wall paper.
Although the effects are very much trojan.alemod (and family) or
smitfraud, it must have a different delivery file.

Has anyone come across this?



From: Sharon F - view profile
Date: Tues, Oct 25 2005 11:20 am
Email: Sharon F <[email protected]>
Groups: microsoft.public.windowsxp.customize

I have a client who had several viruses and some spyware on her system. I
have disinfected the viruses and removed the spyware. One of the viruses was
similar to Smitfraud, in that it replaced her wallpaper with a "spyware"
message. However, it didn't infect the wininet.dll file. The problem she is
having now is that she can't change the wallpaper. She was able to change the
background color from black to white, but when she chooses a wallpaper theme
and clicks apply, nothing happens. The browse button on that page is ghosted,
so she can't browse to the picture that she has saved on her hard drive. When
she restarts the system, the picture that used to be her wallpaper briefly
flashes before the system restarts, so I know it's still there. It's almost
like the wallpaper "function" is corrupted. I have seen this a couple of
other times on other people's systems, but can't figure out how to solve the
issue. Any ideas are appreciated.

Some of these things add a web item. The web item will behave as a
"wallpaper overlay." Remove the web item and the normal
desktop/wallpaper
is revealed. Try Display> Properties> Desktop> Customize Desktop> Web.
Uncheck web items and/or delete them.

Or the spyware may have changed a policy that is blocking the change of

wallpaper (not as common but could happen). See "Wallpaper - Desktop -
Disable" on this page for directions on how to remove that restriction:

http://www.kellys-korner-xp.com/xp_w.htm

 

[brey]

And sorry -
I don't use roaming profiles or GP.
Also I noted when the PC was idle and not running IE - there were IP
entries in netstat that I didn't recognize...

 

[Kelly]

Go to Start/Run/Regedit and navigate to this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

Once there if REG_SZ (type) Wallpaper is listed, delete it.

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm