Desktop Wallpaper been hijacked

hamsterboy

Hi All
My work computer has been infected with something and now the desktop wallpaper is a message telling me my computer is infected and I need to download software!!!

Anybody know a quick way of gettin rid of this?
My boss will freak if he sees it

Cheers

HB

biko

Read and perform this

seamus

Start > Settings > Control Panel > Display

The General tab (I think, it's disabled on this machine) has the option to change your desktop.

Sounds like the machine could be infected already. Get someone to do an anti-virus/anti-spyware sweep.

Keano

Once you clear it you might need to get a decent anti-virus and anti-spyware program.

hamsterboy

Cheers for all the advice, am running bikos progs now.
The funny thing is the machine has a very strong anti-virus program running all the time, as its a work computer with critical data on it.
Anyway, I'll let ye guys know how I get on.

Cheers again

HB

Sherifu

hamsterboy wrote: »

Cheers for all the advice, am running bikos progs now.
The funny thing is the machine has a very strong anti-virus program running all the time, as its a work computer with critical data on it.
Anyway, I'll let ye guys know how I get on.

Cheers again

HB

Sounds like adware/spyware. Does your AV program cover adware/spyware?

Nichololas

Maybe it is a co-worker prank, if you say it already has strong anti-virus..

edit: Is it Norton?

yoyo

http://www.pchell.com/support/smitfraud.shtml

This any help?

Nick

hamsterboy

Hi All
Went throught the firs few steps in bikos suggestions and the damn thing is still kinda there.
Instead of the message page its now showing what look like a windows explorer page as a desktop wallpaper.
Any ideas?
Also, the AV is a corporate Symantec one, should pick up everything
Doubt its a prank, won't be funny if the boss sees it

Cheers in advance

HB

yoyo

hamsterboy wrote: »

Hi All
Went throught the firs few steps in bikos suggestions and the damn thing is still kinda there.
Instead of the message page its now showing what look like a windows explorer page as a desktop wallpaper.
Any ideas?
Also, the AV is a corporate Symantec one, should pick up everything
Doubt its a prank, won't be funny if the boss sees it

Cheers in advance

HB

Its prob a smitfraud varient, infectged my uncles pc years ago and did simular crap , Malware Bytes Anti Malware might also remove the thing for you so have a look at that, try run scan in safe mode

Nick

Username!

I've seen this kind of behaviour before on my old PC.

Right click on the Desktop > Properties > Desktop > Customise Desktop > Web.

Now untick anything in the 'Web Pages' box as well as 'Lock Desktop Items' at the bottom.

Keep us updated...

hamsterboy

Have already run that dude, as well as two other tools
Cheers anyway

Username!

Did you try my advice hamsterboy?

hamsterboy

Username! wrote: »

I've seen this kind of behaviour before on my old PC.

Right click on the Desktop > Properties > Desktop > Customise Desktop > Web.

Now untick anything in the 'Web Pages' box as well as 'Lock Desktop Items' at the bottom.

Keep us updated...

When I right click on the desktop it just treats it like I was right clickin in windows explorer, so I can't change those settings. I can even click the files in the explorer window that is currently my wallpaper

Username!

Any chance of posting us up a screenshot?

Press PrntScrn and then open Paint and paste in the image...

hamsterboy

Here ye go

Username!

Can you change the wallpaper? Because that's all like it looks like it is...

Go to the Start Menu > Run > Type in here 'desk.cpl' and it will open up the Desktop Properties. Click Desktop and try 1. changing the wallpaper and 2. what I previously advised about the possible Web Pages...

EDIT: Have you click the X up the very right hand corner? And that down facing arrow on the very top left?

hamsterboy

Hey Username
I've tride that a few times now. The machine is seeing the wallpaper as an explorer page and nothing else, so right clicking on it does nothing.
Also, when I go into control panel it shows me my old wallpaper as the current one, and changing it here does nothing

Cheers

HB

hamsterboy

SORTED
Simple clicking of the x in the top right hand corner like Username said. It's only there when the mouse is in ths same area
Thanks heaps everyone, sp. Username.
I'm sending some serious good vibes your way for hte weekend, expect good things to happen to you

HB

Username!

Class sorted, appreciate the good vibes... now if I only just didn't get my appendix out

MarkR

Do you have access to a system restore? Changes settings back to a previous time. You can find it by going start, all prog, acc, sys tool, sys restore. Choose to restore computer to an earlier time, select a date in bold when computer was ok and follow onscreen instructions.

Assuming that all works and you're back with a non-dodgy looking pc, manually update your antivirus definatitions etc.

hamsterboy

WTF!!!!....came in this morning, turned on the computer and surprise surprise.....the bloody "Your computer is infected....." wallpaper is back.
Just running the tool that got rid of it last time but how the hell did it come back as the computer was off all weekend

HB

Overheal

I remember faststone image viewer....

Anyway OP I dont know what to say. I saw the same error on a machine this week with the wallpaper and everything. But not having to worry about data/program retention I just wiped the whole thing and reinstalled windows.

If you pay/subscribe to your anti-virus provider: contact them. They're payed to figure out what it is.

Loomis

Had a similar problem last year. Downloaded smitfraud and following the steps on this page worked link

MarkR

Most AV software won't scan compressed files, like in your system restore check points. If you're not going to do a system restore, delete these checkpoints and do a full scan again.

You may also want to run msconfig to limit the amount of applications that run on start.

Vokes

Yeh, its probably in your window registry and reloading upon startup or something.

Best to ask ASJ for this help over in the AV forum. That dude is a lifesaver.