PDA

View Full Version : Possible virus - assistance sought



Anteraan
06-18-2004, 12:10 AM
Hey all,
For some reason, a trojan horse got through Norton, and although both files are quarantined, I have been unable to get my desktop back to normal. In fact, I can't get anything other than a white screen. Each time I start windows, my "desktop" is all white, and the source code reveals this:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!----
***** This file is automatically generated by Microsoft Windows *****
--------><HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252"></HEAD>
<BODY
style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none"
bottomMargin=0 bgColor=#004e98 leftMargin=0 background="" topMargin=0
rightMargin=0>
<DIV
style="LEFT: 0px; WIDTH: 1280px; POSITION: absolute; TOP: 0px; HEIGHT: 960px"><IMG
style="LEFT: 0px; WIDTH: 100%; POSITION: absolute; TOP: 0px; HEIGHT: 100%" cache
src="file:///C:/Documents%20and%20Settings/Scott/Local%20Settings/Application%20Data/Microsoft/Wallpaper1.bmp">
</DIV><IFRAME id=0
style="BACKGROUND: none transparent scroll repeat 0% 0%; LEFT: 0px; WIDTH: 1280px; POSITION: absolute; TOP: 1px; HEIGHT: 931px"
name=DeskMovrW marginWidth=0 marginHeight=0
src="file:///C:/WINDOWS/Web/desktop.html" frameBorder=0 scrolling=no
subscribed_url="C:\WINDOWS\Web\desktop.html" resizeable=""> </IFRAME>&nbsp;
</BODY></HTML>

Now, upon peering into the folder C:\WINDOWS\Web, no desktop file can be found, and Windows' file search also comes up empty. Even choosing a wallpaper from Windows XP folder and selecting "set as background wallpaper" doesn't do anything, except that I can see that image as I shut down/restart the computer.

Any ideas? Please?

wirthi
06-18-2004, 07:02 AM
You could try the following: open the options dialog of the desktop, go to the second tab ("desktop"), select "adjust desktop ..." at the left bottom. There again go to the second tab "web" and deselect or delete everything that looks suspicous.

That's just a guess, if it would be w2k i would have deactivated that "active desktop" but I don't know how to do that on xp or if it's possible at all.

(hint: the names of the tabs or buttons could be slightly different, I'm using the german version of xp so I have to guess how they are called in English)

Moogie
06-18-2004, 09:43 AM
I also would suspect "Wallpaper1.bmp".

Do a search for "Wallpaper1.bmp". Deleting the file, or renaming it to something like "Suspect.bmp", then doing a restart would tell you if that's the evil culprit.