President dancing on desktop

**WildTech** · May 16th, 2005, 10:05 AM

Hi Gang,

I have a client that brought in a machine that has a gray box on the desktop with President Bush dancing in it. LOL

I have ran Adaware, Spybot, CWSHredder, HijackThis, ProcessKiller, Norton, TrendMicro, AVG and MS Antispyware programs and have removed a great deal of spyware but this box remains. It does not appear to be controlled by MSCONFIG startup because I have disabled the entire msconfig and it still pops up when you reboot the computer. It is only effecting one of the three users on this machine.

Any ideas on how to get rid of this thing or what it is??

Thanks

**shamus** · May 16th, 2005, 10:27 AM

Anything in the Add\Remove Programs applet in the control panel?

**Ya_know** · May 16th, 2005, 10:29 AM

Well, although not the exact solution, recreating his user profile would probably eliminated the problem. You login as an Admin, rename the user profile for him in Documents and Settings folder, and then log in as him it will create a new profile folder for him. You can then copy over document files from his renamed profile. But you'll have to reconfigure his menus and network printers, and what ever else he doesn't desire from the default profile.

It's an option...

**WildTech** · May 16th, 2005, 10:33 AM

thanks for the quick replies!! Wow!!

nothing in the add\remove programs area. I went into the registry and searched runonce and looked for anything starting up from there.........nothing! I searched Google and comeup with no info there either. The kid said this showed up after his roomate used his computer so he is no help. It isn't using any resources that I can detect and I've used a process viewing program that doesn't show it either.........WTH????

I really don't want to mess with his profile if I don't have to.

Thanks again!!

Anyone else

**Zonie** · May 16th, 2005, 10:49 AM

Hve you checked in the Desktop background? I found once a HTML page located in the root directory of C:\ an HTML being used as the background thatwas caused by a spyware program. After I had removed the spyware it was still on the desktop. After I removed the HTML page the PC no longer showed the background.

**WildTech** · May 16th, 2005, 11:54 AM

Thanks for the reply Zonie!

I don't see anything like that.................I'm currently searching for animated gifs on the machine. That is what this appears to be........I'm hoping to get lucky with the old search *.gif routine..........

)

Thanks again

anyone else have any ideas??

**Matridom** · May 16th, 2005, 12:19 PM

Originally Posted by WildTech

Thanks for the reply Zonie!

I don't see anything like that.................I'm currently searching for animated gifs on the machine. That is what this appears to be........I'm hoping to get lucky with the old search *.gif routine..........

)

Thanks again

anyone else have any ideas??

right click desktop, properties, change the wallpaper. if it's 98, disable webview.

**Richard1** · May 16th, 2005, 12:37 PM

What OS are you using? Have you noticed any new apps or process running?
You may try emptying your temp internet folder.

Is it XP? If so, have you tried a "system restore" to a date prior to the problem

**WildTech** · May 16th, 2005, 12:50 PM

Thanks Matridom!!

It actually turned out to be easier than that!! While clicking around I discovered that the desktop was locked. After unlocking it I was able to do a properties on the offending block and find its origin. After that it was simply a matter of removing it.

Thanks for all the help guys!!