My desktop has been hijacked, help please.

Status
Not open for further replies.
I accidentally visited a webpage that brought all kinds of spyware with it, including a couple of trojans, and a fake anti-spyware program, I think it called itself Spysheriffbut I'm not sure. It also replaced my desktop walpaper with a phony message saying my system had been infected, and needed cleaning (probably to get me to run its fake software.) I ran my own software, starting with Microsoft AntiSpyware, then a scan with AVG Anti-Virus free edition. It seems to have cleaned everything up, but the desktop. My desktop is still this phony message, and it's locked me out of the windows wallpaper controls. All controls, that is, except the ones to set a webpage as your desktop. I tried doing that to get rid of it, and it only changed half the screen. Here is a picture of what my desktop looks like now:
desktop.jpg


Any help at all would be much appreciated, let me know of any files you need me to attach for you to look at.

<edit> Well, I found out what it's called this website: http://www.sophos.com/virusinfo/analyses/trojspywadi.html Describes it perfectly, but I'm still not quite sure how to remove it.
 
Delete desktop.html from your Windows directory.

Then copy & save the following code as something.reg and run it (delete the spaces from "Explorer" part).

It disables Active Desktop (you have to restart Windows Explorer for the changes to take effect).

Run HijackThis after that and post the log here.

Code:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "ForceActiveDesktopOn"=dword:0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoActiveDesktop"=dword:1
 
Status
Not open for further replies.
Back