Member Avatar for Engineer

hello..

i have a trouble with spyware on my desktop with red background.. i think it's a web page because i can't right click on desktop...
Can you help me about this topic??

  • 2 Contributors
  • 1 Reply
  • 112 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by tayspen

Dani AI

Generated

The symptom described by — a solid red desktop that behaves like a web page and disables right‑click — most commonly comes from either an HTML/web wallpaper (Active Desktop or an HTML file set as the desktop) or a process overlaying/replacing Explorer (a browser or malicious shell). 's suggestion to produce a HijackThis log and run a cleanup utility is a good starting point; those logs show the startup and shell changes that cause this behaviour.

Quick diagnostics to try without reinstalling anything: open Task Manager and look for browser processes (iexplore/firefox/chrome) or any unfamiliar processes running as the logged user. Ending an offending browser process will often restore the desktop if the problem is simply an overlay. If Explorer itself is unstable, restarting the Explorer shell will restore context menus. Also test whether the problem is per‑user by logging in as a different user (or the built‑in Administrator); a per‑user issue points to user profile settings or per‑user malware, not a systemwide infection.

What to watch for in logs: HijackThis items that affect the shell or startup (Run/RunOnce, O4 entries), Browser Helper Objects (O2), URL search hooks and other R‑entries, LSP/network hooks, and any Winlogon/Shell changes. SmitRem output documents files removed; compare its list to running processes and startup entries in the HijackThis log. Never use "fix checked" blindly — removing the wrong shell/startup entry can break Windows. Always export the registry or create a system restore point before making changes.

If automated cleaners do not fully clear the problem, use current anti‑malware tools (Malwarebytes/AdwCleaner/Microsoft Safety Scanner or an offline rescue disk) and check these registry locations carefully (for example, the Winlogon Shell and policies such as NoViewContextMenu). Back up settings before editing. These steps will locate whether the red desktop is a removable HTML wallpaper or part of a deeper persistence mechanism that needs targeted removal.

Member Avatar for tayspen

Hi, please do the following.

Download HijackThis. Extract it to its own folder. Then run it and select. Do system scan and save log. Post the contents of the log that pops up.

That should get us going.

Also, go ahead and do this.

Download smitRem.exe (), saving the file to your desktop. Double click it to extract the contents to a folder of it's own. Restart your computer in safe mode, logon to the user account that is infected, open the smitRem folder and double click the RunThis.bat file to start the tool. Follow the prompts on screen and allow disk cleanup to complete. Upon reboot, you can reset your desktop background. Note: XP users using the XP theme may ex-perience a change to the Classic Windows theme. This can be changed on the themes tab of desktop properties.

Please include the C:\smitfiles.txt contents in your next post :).

And in case you dont know how to get into safe mode.

1. If the computer is running, shut down Windows, and then turn off the power
2. Wait 30 seconds, and then turn the computer on.
3. When you see the black-and-white Starting Windows bar at the bottom of the screen, start tapping the F8 key. The Windows 2000 Advanced Options Menu appears.
4. Ensure that the Safe mode option is selected. In most cases, it is the first item in the list and is selected by default.
5. Press Enter. The computer then begins to start in Safe mode.

-T

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.