Active desktop recovery error

[HipHoper]

Hi All,

One of my clients made a mess and now every time he's computer starts, It gives the Active desktop recovery error on a white background.
When I press to recover the desktop it give some script error.
I tried to fix it remotely via LogMeIn, And changing his wall paper by right clicking the desktop properties, but It didn't fixed it, And I cant see the WEB tab in the "Customize desktop" settings.
The other thing is that I don't see ANY icon on his desktop and the START bar is not visible too.

I'm going to visit him on sunday, But I don't really know from where to begin.

Help would be appreciated.

[NooNoo]

Safe mode!

What OS and What IE version?

[HipHoper]

Hey Noo

Xp pro SP3 + IE8 and latest patches

[NooNoo]

For IE7 but the reg hack

To fix this problem, follow these steps:
Click Start, and then click Run.
In the Open box, type regedit, and then click OK.
Locate and then click the following registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components
In the right pane, right-click DeskHtmlVersion, and then click Modify.
In the Value data box, type 0, and then click OK.
Exit Registry Editor.

should get it. Failing that try this, the user profile has probably got corrupted.

[HipHoper]

Thanks Noo. Will try it and let you know how it went

[slgrieb]

Hip, some malware, usually SmitFraud variants, can cause the same behavior. Personally, I think I'd use that as a starting point. If the machine is infected, I'm not quite sure what the result of a Registry edit might be. But, it might be really interesting to find out

[HipHoper]

Thanks Slg.
The thing is that I just sold 3 computers to this client few weeks ago, And he have 3 kids which 2 of them sound inexperienced users.
The 1st moment one of them laid his hand on the computer, He installed Imesh....And I've installed only Avira free AV on all of the computers.
On my visit I'll try to figure out what happend, And might bring a NIS 2009 licenses with me, So I can install if I feel that they are messing to much with file sharing and other risky stuff....

[HipHoper]

Well...I didn't managed to fix the problem with some specific util (Desktop hijack fix) or by changing resolution or changing some registry value, And I re-imaged the computer, Which seems the fastest way to do it. Good for me that I had G31 chipset image that was as same as this motherboard, So it only took me 1.5 hours to backup all his data, Re image the drive and restore data + All in one wireless drivers..

[NooNoo]

Reimage is the quickest way... but you never find the cause... so I expect you will be getting that call again.

[HipHoper]

I don't think so Noo. The user complained that he did something without understanding, And it might be a virus. I just didn't wanted to get into the exact cause, So I reimaged the computer. I guess after the invoice the client will get he will be more cautous....LOL