Background message "Warning! Spyware detected

try to do it in safe mode

ok Ann, pls follow the below given info

The first time this thing runs it changes entries in your registry to hide the 'Desktop' and/or 'Screen Saver' tabs
-In the registry navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
-delete entries 'NoDispBackgroundPage' and/or 'NoDispScrSavPage'


Check out your display properties again, they should be back to normal.

Empty your recycle bin to get rid of it for good

Rebooting at this point is probably a good idea.


Melisio Mascarenhas
India

I read the instructions you provided to remove the annoying background screen, however I wish I would have read this before I installed an anti virus software the removed the annoying screen and the pop ups forcing consumers to purchase their product. I now have the screen saver problem that appears when computer is idle advising there was an error in the installation of a new software and it names all these files and suggest a reboot. The computer appears to be rebooting but it is not. Its like some sick persons way to annoy you with a screen saver that is an eye soar. So my question is how do I get rid of this and I know you have posted directions several time sorry if I am not getting it. Each time you posted it you ask that we look for the original file or even a file with bogus numbers. When I do the search for the file .bmp it pulls of 1400 files of pics which I totally understand. What I dont get is which file it could be if it is in that section or did I miss my chance when the anti virus software I installed deleted it. I just want to change the background on my computer and take the screen saver off. I dont have these tabs and maybe I was just fast reading but it appears to be a problem that is linked. Also I dont mean to sound like an air head but a little fix it for dummys instructions would be helpful. I also want to point out this is sad I can not fix it my self as I did get an associates degree in IT. Maybe it was not the major for me but I am very fasinated by it.

Thanks! it worked. I have my bg back now

Thanks, I followed Ebomb and your instructions and I got rid of it completelly....after 3 days of downloading all sort of crap.

Thanks again!!!

Thank you sooooo much I had this damned thing for a few days before I finally found it, but still had the issue with the background you made it sooo simple, but one last thing. Every time I click anything in an webbrowser I am redirected to other pages that have nothing to do with what im searching for. any clues?


Thanks
Robert S

I tried to do the following:

-In the registry navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\­Policies\System
-delete entries 'NoDispBackgroundPage' and/or 'NoDispScrSavPage'


and now I have no desktop just a blue screen. Can anyone help?

hey I cant find registry what is it

Click Start -> Run -> Type regedit

Be careful. You can screw your entire computer up.

wait

1) which method did you use ??

2) the scan spyware method??

or the other ones (search sepecific files one)

if the spyware method

then the software hasnt been installed properly

try uninstalling and reintall it once more

follow the steps again

then try to fix it

if its the second method then u have to run ur system in safe mode, then delete it

awaiting comments

Melisio Mascarenhas

I have already have posted the solution of this problem in my earlier posting

but here it one more time

REMOVE THE FILES FROM YOUR HARD-DRIVE:
-Right-Click on My Computer and select Search...
-click All files and folders
-search for *.bmp (all or part of file name)
-Find the one that matches your background
-Note the name of the .bmp file - mine was called phccekj0e3cn.bmp (copy and paste into notepad or something as you weill need this later, or write it down as your computer can reboot)
-Search your drives for the last 3 characters noted in previous step. in my case I searched on *3cn
-This search resulted in 4 files for me.
-Go to your task manager, look under the processes tab, and find the process that matches the name of one of the files you are trying to delete (the .exe file)
-end the process - mine was called lphccekj0e3cn.exe
-delete all files found in your search

REMOVE REGISTRY ENTRIES: (not as important since the files are no longer there but still good idea)
-Start -> Run
-regedit
-Edit -> Find
-I searched on *3cn (the last 3 characters) but this returned some valid registry entries. I suggest you either carefully delete all entries that look they are related. I found 5 or 6 valid entries, but they were obvious to me to not be related.
-typically they will have the full name like "lphccekj0e3cn" In fact you could probably search on whatever the .exe name was (minus the .exe extension) and you can surely delete all those entries.

FIX REGISTRY ENTRIES:
-this is what I missed in the previous post. The first time this thing runs it changes entries in your registry to hide the 'Desktop' and/or 'Screen Saver' tabs
-In the registry navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
-delete entries 'NoDispBackgroundPage' and/or 'NoDispScrSavPage'


Check out your display properties again, they should be back to normal.

Empty your recycle bin to get rid of it for good

Rebooting at this point is probably a good idea.

p.s. if u have prob finding the bmp files try to find it as file named as "pch or else try 3cn"


awaiting comments

Regards
Melisio Mascarenhas
India

I was so thrilled with your instructions & I did everything. It took the spyware message off. I rebooted,
and then it said, malicious spyware was taken off computer. I was so thrilled, I thought I fixed it.

But, when I try to click on the internet, it
tries to & flips back off. What else can I do?

You've been very helpful. Thank you & I hope maybe you can help with this.

Thanks

i know this is an old thread, but the problem of spyware changing wallpaper is still around. however, it now is using a .html file, rather than a .bmp file, and it is named 'critical warning.html' and is in the system32 folder, so do you happen to have another solution to restore the wallpaper? I do have the desktop tab showing, I just cannot click on any of the wallpapers, so I am sure it is just a setting somewhere that I have yet to find....thanks buddy

I get the same thing! I dont know what to do.. Please help someone.. I thought about reformatting my computer. But I wonder if there's another way