file://C:\Windows\warnhp.html on Desktop

noah, I was infected by the file://C:\WINDOWS\warnhp.html. thing and I downloaded your program and followed your direction to delete it and it worked. Thank you!

 

warnhp help please

I've gone through this thread and run the software noah has, looked at my desktop, and all of that, but I still only have a white screen. When I right-click on my desktop, the properties have warnhp but only the General tab. I deleted all warnhp files from my PC but still only a white screen. help!

 

Did you do this:

 

Reply to Lazarus

Yes. When I do that, I only get the 'general' tab that lists the warnhp.html source but no other tab. I went into the Control Panel ->Display -> Desktop -> Web but I do not see warnhp.html. I only see bubbles.bmp (which is what I set my background to) and Desktop Uninstall. I checked properties on bubbles, looks good. I can't check properties on desktop uninstall.

I deleted the 'e' files with warnhp.html from my pc, too.

What's weird is when I move my taskbar I get a quick glimpse of my bubbles background, but as soon as I release my mouse it goes straight to the white screen. So, I know there's something there. I just can't find it.

I'm on XP, and I loaded all the latest updates after I had this problem but that didn't help either.

 

WOW thank you very much. I tried it and it worked. Very simple. I tried other ways to remove it and couldn't.. My hubby will be very happy as it was on his computer
Thanks again
cand

 

Finally Got It

Ok, I finally figured it out. I had to unselect all the items listed under web, not just the one 'warnhp'. Once I did that, it worked. I'm once again a happy camper!

 

Help me... 4/30/06

Got rid of some viruses... and that warnhp.html, in the customize desktop the only thing there under web is my current hompage, deleted the web page stuff, and my current homepage is NOT checked in the box. My desktop screen is STILL white (with icons), but when starting up and shutting down for a BRIEF moment my desktop image appears, then disappears. I know you're going to ask if I tried system restore, yes I did, over the phone with Dell, and it didnt work,twice, it failed. I will not pay them ANOTHER $99 (which I payed for a problem 2 months ago) on top of over a thousand dollars for the laptop. I am SOOOO frustrated. PLEEEEASE help meeeeee...

What to doooooo??

 

I had the same problem.

Control Panel -> Display -> Desktop -> Web folder -> Make sure EVERYTHING is NOT checked. Even what you think is a valid web page.

Only when I did that, did it finally get fixed.

 

Help me...

"Control Panel -> Display -> Desktop -> Web folder -> Make sure EVERYTHING is NOT checked. Even what you think is a valid web page. "

Jenkins... I've tried that... numerous times... it doesn't work for me. Now what :sniffle:

 

Here's a couple more options. Hopefully, one of these will help.

[1]
Your antivirus programs probably deleted C:\WINDOWS\warnhp.html
It may be still in your registry.
Start/Run/type regedit/ok.
Look for:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0\]
"Source" = "C:\WINDOWS\warnhp.html "=-

If the warnhp.htm is there, that will be the cause.

[2]
Navigate to this :
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
There should be only one entry here,
(DEFAULT) REG_SZ (value not set)
if you find anything else, delete it.
Click on the plus sign next to Policies, there should be only one entry: Explorer
any other folders, delete them
now click on Explorer, this is all you should see:
(DEFAULT) REG_SZ (value not set)
NoDriveAutoRun REG_DWORD 0x00000091 (145)
if you see any other entries, delete them

Close regedit and reboot, your wallpaper settings will now be back to normal!

 

Cured--by accident

[FONT= "Comic Sans MS"][/FONT]

Thanks to a combination of suggestions from this group, I did remove the pesky virus. If I could remember all the things I did, I'd list them for all, but alas, I can't remember.
Thanks for your collective help

 

Fix for warnhlp.html

I had the same problem and all I had to do was:

1) Control Panel -> Display
2) Desktop (tab) -> Customize Desktop
3) Web (tab)
4) Select 'Desktop Uninstall' and then click the DELETE button.
5) Click OK. Click OK. Done!

 

After I got rid of the thing, I got it again. Norton AV (corporate version) caught a virus but said access denied, but also stated computer infected. I believe the file identified was "Identi.... "-- the one associated with the virus I got. I looked, and yup the red letter message was back. I deleted the 'Desktop Uninstall' file and it went away. I looked for the other files that were added on the previous infection, but none were there. I do wonder why NAV didn't prevent the thing. The definitions had been updated, the computer scanned by NAV while sytem restore was disabled so, I have no clue. Another accidental cure. Thanks again to all.

 

Forgot the printer hiccup.

I forgot one other result from the infection both times. My HP 1100 printer started spitting out blank pages and I couldn't get it to stop from the open printer box. On the second infection I could determine that the instructions were addressed to a different HP 842 printer (not the default) and I deleted, cancelled all print jobs and then unplugged the HP 1100 and that seemed to work. Weird.

 

It never ends!

I got infected with another Trojan that's almost exactly like warnhp! It took me 2 days, but it's gone. The only remnant now is that I STILL can't get to my desktop background! I can only set the color. I can't select any of the backgrounds It's as though it's not an option anymore though the scroll bar isn't faded out (to show it's not available). Anyone experienced this??

 

Make sure you have deleted all copies of smitRem and download a fresh copy.

smitRem 2.9

Double click, then click Start to extract it to it's own folder. Reboot to safe mode and double click the RunThis.bat file in the smitRem folder. Follow the prompts and allow disk cleanup to complete. Reboot back to normal mode and you should now be able to reset your background, theme, etc.

Please post the contents of C:\smitfiles.txt

 

Bear with me here. I did everything listed, and the smitfiles.txt is listed below. BUT I still can not reset my wallpaper. I can reset my theme, screen saver, etc. But not the wallpaper. When I boot up, and when I boot down, I see the one we set up for about 5 seconds, then it's gone. And yes, Desktop -> Customise -> Web is absolutely empty. It won't let me do anything to the Desktop Background except change the color.

I can post a screen print if you tell me where, that way you can see what I'm hitting. I'm getting a bit frustrated. Thanks.


smitRem © log file
version 2.9

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
"IE "= "6.0000 "
The current date is: Mon 05/29/2006
The current time is: 20:26:17.26

Running from
C:\Program Files\Hijack This\smitRem\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1} "= "Browseui preloader "
"{8C7461EF-2B13-11d2-BE35-3078302C2030} "= "Component Categories cache daemon "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@= "%SystemRoot%\System32\browseui.dll "


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@= "%SystemRoot%\System32\browseui.dll "


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
AlfaCleaner uninstaller NOT present
SpyFalcon uninstaller NOT present
SpywareQuake uninstaller NOT present
SpywareSheriff uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

amcompat.tlb
nscompat.tlb


~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 968 'explorer.exe'
Killing PID 968 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1} "= "Browseui preloader "
"{8C7461EF-2B13-11d2-BE35-3078302C2030} "= "Component Categories cache daemon "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@= "%SystemRoot%\System32\browseui.dll "


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@= "%SystemRoot%\System32\browseui.dll "


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~


~~~ Wininet.dll ~~~

CLEAN!

 

Lets have a look at a registry key or two. Start with the one below by copying the full text into the run dialog box (Click Start>run, paste then hit enter)

regedit.exe /e c:\policies.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies "

Post the contents of the export C:\policies.txt

 

Here's the contents. Shouldn't something be in wallpaper?

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallPaper "=dword:00000000
"NoAddingComponents "=dword:00000000
"NoComponents "=dword:00000000
"NoDeletingComponents "=dword:00000000
"NoEditingComponents "=dword:00000000
"NoCloseDragDropBands "=dword:00000000
"NoMovingBands "=dword:00000000
"NoHTMLWallPaper "=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun "=dword:00000091
"NoLowDiskSpaceChecks "=dword:00000001
"NoActiveDesktop "=dword:00000000
"NoSaveSettings "=dword:00000000
"ClassicShell "=dword:00000000
"NoThemesTab "=dword:00000000
"ForceActiveDesktopOn "=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr "=dword:00000000
"NoDispAppearancePage "=dword:00000000
"NoColorChoice "=dword:00000000
"NoSizeChoice "=dword:00000000
"NoDispBackgroundPage "=dword:00000000
"NoDispScrSavPage "=dword:00000000
"NoDispCPL "=dword:00000000
"NoVisualStyleChoice "=dword:00000000
"NoDispSettingsPage "=dword:00000000
"Wallpaper "=" "

 

Copy the contents of the quote box below to a blank notepad, making sure the formatting stays the same. Save it to your desktop as:

Filename: fix.reg
Save As Type: All Files (*.*)

Double click the file and allow it to merge with the registry. Log off and then back on or reboot. See if you can now set your background.