Please register or login. There are 0 registered and 193 anonymous users currently online. Current bandwidth usage: 326.30 kbit/s November 27 - 03:30am EST 
Hardware Analysis
      
Forums Product Prices
  Contents 
 
 

  Latest Topics 
 

More >>
 

    
 
 

  You Are Here: 
 
/ Forums / General Technology /
 

  My desktop has been hijacked! 
 
 Author 
 Date Written 
 Tools 
Rayomand N. May 17, 2005, 02:01pm EDT Report Abuse
My desktop background is now white and flashes to a light
grey. Right click/Properties on desktop and only get a
general tab - no options to change anything. The address
[URL] is file://C:\WINDOWS\Web\desktop.html. This is the
name of one of the files that I deleted after my pc was
infected by several files containing trojan viruses etc
[e.g. mstasks2.exe, system.exe, wintime.exe etc...] and
my desktop was taken over by this desktop.html and made
up of circa 20 gifs that had been created in
c:\windows\web directory.

Try to change desktop background via control
panel/Appearance and Themes - the Display
Properties/Desktop tab is available and indeed shows my
desired background picture, the name is highlighted but
the apply function is greyed out. Selecting ok does not
change the desktop background. Also my desired desktop
background is momentarily visible during windows shutdown.


Want to enjoy fewer advertisements and more features? Click here to become a Hardware Analysis registered user.
John P May 17, 2005, 06:27pm EDT Report Abuse
>> Re: My desktop has been hijacked!
Have u tried using any spyware removal programs. try the one from microsoft.

--------------------------------------
Core 2 duo. E6400 - (Coolermaster 92mm UFO Cooler)
Biostar 94P-A7A
2 GIG- 2 X 512 DDR2 667 (Patriot)
Evga 7900gs - (ZALMAN CNPS7700)
Vista Ultimate
Adam J May 17, 2005, 06:47pm EDT Report Abuse
>> Re: My desktop has been hijacked!
Try putting some anti-spyware or virus programs on a flash drive and boot into safe mode and run them. Also run msconfig from start > run and disable anything that looks out of place in the startup tab.

Antec Nine-Hundred
OCZ Modstream 450w
Gigabyte 965P-S3
2x512 DDR2-800 Corsair XMS
Intel Core 2 Duo 1.83Ghz
400GB SATA2 Seagate 7200.10
Arctic Cooling Freezer
Audigy 2 ZS

Apple iMac Core 2 Duo 2Ghz 2GB Ram
Rayomand N. May 18, 2005, 02:12am EDT Report Abuse
>> Re: My desktop has been hijacked!
Hey,
I am currently running 2-3 spyware programmes
1) Spyware Doctor
2) Ad-aware
3) Spybot search and destroy

All three have identified the trojan or whatever is on my computer and have removed it, yet my screen is blank, if I edge my mouse to the topmost of my screen and right click, thats where I get the normal options which I would have had, had my background/desktop not been hijacked.
Any more suggestions would be appreciated.

Craven Moorehead May 18, 2005, 02:51am EDT Report Abuse
>> Re: My desktop has been hijacked!
Right click on desktop and goto desktop setting and goto customize desktop. Under these options you will find a Web option and check to see if current home page is set to desktop mode and check also under properties if web documents are being used offline and uncheck it this might help your problem along with spyware used . I prefer the new beta from Microsoft which is free to download under there web. Since Ive been using I had virtually any problems in spyware at all.

Good Luck

Craven Moorehead May 18, 2005, 02:51am EDT Report Abuse
>> Re: My desktop has been hijacked!
Right click on desktop and goto desktop setting and goto customize desktop. Under these options you will find a Web option and check to see if current home page is set to desktop mode and check also under properties if web documents are being used offline and uncheck it this might help your problem along with spyware used . I prefer the new beta from Microsoft which is free to download under there web. Since Ive been using I had virtually any problems in spyware at all.

Good Luck

Rayomand N. May 19, 2005, 12:44am EDT Report Abuse
>> Re: My desktop has been hijacked!
Hey thanks a lot, that was the problem I still had. I shall take your advice on spyware.
Thanks again.

Merithiel May 21, 2005, 10:49pm EDT Report Abuse
>> Re: My desktop has been hijacked!
This thing started showing up recently, as I see it. In any case, here are a few thigns you should do.

1. Run Lavasoft's AdAware.
2. Run HijackThis. (Both of these are famous progs).
3. Turn off Active desktop in the Group Policies.
4. If these things don't solve it, run Housecall at http://www.trendmicro.com and follow their instructions for getting rid of it. They are usually very good.

If after this, you are unable to change your desktop etc or if the changing desktop stuff is still grayed out, there are some things you can do. I had this thing and it turned off my SP1 and SP2 stuff, so heres a script you can paste directly into notepad and save it as unlock.reg:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktopChanges"=hex:00,00,00,00
"NoActiveDesktop"=dword:00000000
"NoSaveSettings"=dword:00000000
"ClassicShell"=dword:00000000
"NoThemesTab"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoDispSettingsPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"SetVisualStyle"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallPaper"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager]
"ThemeActive"="1"
"DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,72,00,65,00,73,00,6f,00,75,00,72,00,63,00,65,00,73,00,5c,\
00,54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,6c,00,75,00,6e,00,61,00,5c,00,\
6c,00,75,00,6e,00,61,00,2e,00,6d,00,73,00,73,00,74,00,79,00,6c,00,65,00,73,\
00,00,00

***********************************************************************

Here is another one you may need, save it as unlock2.reg or something like that:

REGEDIT4

[-HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Policies\System]

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

***********************************************************************
This should make it possible for you to change your desktop wallpaper and themes, etc AFTER you do the aforementioned steps and scan with TrendMicro's Housecall.

Finally, most importantly, drop the porn.

Damn my computer is old.

Intel P4 1.6 GHz
512MB SDRAM
ATI RAGE 128 Pro AGP 4X
Win XP Pro.


 

    
 
 

  Topic Tools 
 
RSS UpdatesRSS Updates
 

  Related Articles 
 
 

  Newsletter 
 
A weekly newsletter featuring an editorial and a roundup of the latest articles, news and other interesting topics.

Please enter your email address below and click Subscribe.