Link to home
Avatar of johnjames123
johnjames123

asked on

desktop.html

I have the same desktop.html but it keeps coming back.  In control panel \display\desktop \web  there is a file that states security which is this desktop.html that refers to some spyware page.  On every reboot this file is recreated and added back to the desktop active items.  There is some program that keeps adding this back to desktop active items per each boot.  Ran all kinds of spyware utilities. Some free some bought still cannot find program.  Spent alot of time going thru current processes running spyware programs cant find the problem
ASKER CERTIFIED SOLUTION
Avatar of sunray_2003
sunray_2003
Flag of United States of America image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
If you have windows xp , disable system restore.

Then clear temp files

Remove temporary internet files, folders and cookies
How to Delete the Contents of the Temporary Internet Files Folder
http://support.microsoft.com/default.aspx?scid=kb;en-us;260897

Also remove windows Temp files going to

1) Start --> run --> typein:  %systemroot%/temp
2) Start  --> run --> typein: %temp%
Avatar of SheharyaarSaahil
John i think here your problem is decribed >> http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_FAVADD.A
 "It also replaces the desktop view with a warning about a security threat. The warning also provides a link on how to remove itself. This link points to the Web site of a security product."
Avatar of johnjames123
johnjames123

ASKER

found the program it was runsrv32.exe.    Using Security task manager and it is quarantined. Reboot now and I dont get the security(desktop.html in active desktop folder anymore on bootup)  But the task manager states that this is a windows spool service.  ON reboot the machine complained onetime and has not complained again.  However I have not tried to print yet will try now.  Do  I need to replace this file from Microsoft.  Do you have this running on your xp machine.
SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
>> However I have not tried to print yet will try now.

please do that and post back if everything is fine..
printed fine.  find out anything on that runsrv32.exe.  Probably not a windows program.
no its now a windows file... as i said ita faked process which is just a junk file :)
have a search on google and you will find all the links having HJT logs having this process as Srv32 spool service >> http://www.google.com/search?hl=en&lr=&q=runsrv32.exe