Member Avatar for trevari

Hey,

I got a nasty virus about a week ago which my virus protection took care of. The virus had put a picture on my desktop that said something like, computer has been infected please run so and so spyware removal (their virus program lol). My virus protection got rid of it, but I'm still unable to change my desktop background. When I goto display properties background is grayed out and i'm unable to scroll up or down in the box of pictures. The only thing I can do is set the color of my blank background. Does anyone know how to fix this? I remember once you could go into the registry and there was a place that had a value of 0 or 1, 0 being disabled and 1 being enabled. If anyone knows where this is or a way to fix it other then that it would be great. Thanks! :lol:

  • 7 Contributors
  • 9 Replies
  • 865 Views
  • 6 Months Discussion Span
  • Latest Post Latest Post by tayspen

Dani AI

Generated

A short, practical summary and fix (keeps the thread suggestions together)

This symptom — a forced wallpaper plus a greyed-out Background tab — is exactly what many SmitFraud/SpySheriff–type infections do: they replace the desktop image and flip policy/registry entries so users cannot change it. As and others suggested, the right place to look is the registry policy keys that control the Background tab and wallpaper changes. (f-secure.com)

Quick, safe steps (backup first)

  1. Back up the registry (Registry Editor > File > Export) or create a System Restore point before doing anything. (support.microsoft.com)
  2. Create a small .reg file with these entries and save it as fix.reg (exactly as shown), then double-click to merge or import with Regedit:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallPaper"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispBackgroundPage"=dword:00000000

Merging sets those policy values to 0 (enabled = 0, disabled = 1) and restores the Desktop Background controls. If the ActiveDesktop key does not exist, create it first. After merging, reboot or sign out/in. (If you prefer manual edit, navigate to the same keys in regedit and change the DWORDs instead of using a .reg file.) (support.microsoft.com)

If the settings come back or the patch has no effect
A returning value means remnants of the infection are still present — run current antivirus/antimalware scanners in Safe Mode, follow malware‑removal guidance, and post your diagnostic log (as / recommended) so helpers can verify remaining entries. Also check the Themes service (start it and set to Automatic) if themes/wallpaper still won’t apply after the registry fix. Edit the registry only after backing it up. (learn.microsoft.com)

Recommended Answers

All 9 Replies

Member Avatar for tayspen

Hey,

I got a nasty virus about a week ago which my virus protection took care of. The virus had put a picture on my desktop that said something like, computer has been infected please run so and so spyware removal (their virus program lol). My virus protection got rid of it, but I'm still unable to change my desktop background. When I goto display properties background is grayed out and i'm unable to scroll up or down in the box of pictures. The only thing I can do is set the color of my blank background. Does anyone know how to fix this? I remember once you could go into the registry and there was a place that had a value of 0 or 1, 0 being disabled and 1 being enabled. If anyone knows where this is or a way to fix it other then that it would be great. Thanks! :lol:

Welcome to DaniWeb

I would post a log of HiJackThis. in the spyware section. One of our spyware experts will be able to tell you if you are completley Clean. I would imagine you still have parts of the virus on your computer. And that is what is causing your problems.

Get hijackthis
here

http://www.majorgeeks.com/download3155.html


-T

Member Avatar for jaishankar

Hey,

I got a nasty virus about a week ago which my virus protection took care of. The virus had put a picture on my desktop that said something like, computer has been infected please run so and so spyware removal (their virus program lol). My virus protection got rid of it, but I'm still unable to change my desktop background. When I goto display properties background is grayed out and i'm unable to scroll up or down in the box of pictures. The only thing I can do is set the color of my blank background. Does anyone know how to fix this? I remember once you could go into the registry and there was a place that had a value of 0 or 1, 0 being disabled and 1 being enabled. If anyone knows where this is or a way to fix it other then that it would be great. Thanks! :lol:

yes trevari go ahead and post HijackThis Log

Member Avatar for DMR

Hi trevari, welcome to DaniWeb :)

1. I've moved your thread to the appropriate forum.


2. The problem you describe is a symptom of the SpySheriff/Smitfraud group of infections; here's the specific fix for regaining full functionality of your desktop properties:

Download the smitfraud.reg file by right-clicking on this link and choosing "Save link as..." or "Save target as..." from the resulting pop-up menu. Save the file to your desktop.

- Double-click the smitfraud.reg file you saved, and when it asks if you want to merge with the registry, click YES.

- Reboot your computer; your display properties should be returned to normal.


3. As the others have suggested, post a HijackThis log for us to review:

Download the (free) HijackThis utility:

Once downloaded, follow these instructions to install and run the program:

Create a folder for HJT outside of any Temp/Temporary folders and move/extract HijackThis to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

The log contents will tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.

Member Avatar for ashwani77

Hi,
If you got resolution to your problem, can you please share with me. I am also facing similar problem.

Thx,
Ashwani.

Hey,

I got a nasty virus about a week ago which my virus protection took care of. The virus had put a picture on my desktop that said something like, computer has been infected please run so and so spyware removal (their virus program lol). My virus protection got rid of it, but I'm still unable to change my desktop background. When I goto display properties background is grayed out and i'm unable to scroll up or down in the box of pictures. The only thing I can do is set the color of my blank background. Does anyone know how to fix this? I remember once you could go into the registry and there was a place that had a value of 0 or 1, 0 being disabled and 1 being enabled. If anyone knows where this is or a way to fix it other then that it would be great. Thanks! :lol:

Member Avatar for swatkat

Hi,
If you got resolution to your problem, can you please share with me. I am also facing similar problem.

Thx,
Ashwani.

Hi Ashwani,
Welcome to Daniweb :D. Please start a new topic in this section and post a HijackThis log in that topic.

Member Avatar for DMR

Hi maraniba,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

In light of the above, I've split your post into its own separate thread, which can be found here: http://www.daniweb.com/techtalkforums/showthread.php?t=38916. We'll follow up on your problem in that thread.


For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies.

Thanks for understanding.

Member Avatar for maraniba

Thanks DMR, I'm very sorry about that. Should've looked at the rules of conduct first. I've never actually posted to a forum before. I will try what you suggested.

Member Avatar for DMR

No worries on the "piggybacked" post; it's a common and totally understandable thing for people who are new to online forums to do. :)

As for your problem with running the smitfraud.reg file, check out the suggestion I posted in your new thread, and post a follow up there.

Member Avatar for tayspen

Hello fuz47, and welcome to DaniWeb. I have split your post into its own topic. As we ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem).

You can find your knew thread here.

http://www.daniweb.com/techtalkforums/thread49211.html


To prevent furthger bumps\Piggybacks, this thread has been locked. - Anyone with a similar problem, please start your own thread

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.