removed CWS_NS3 but desktop still isn't restored

Hello all,

I just spent the entire weekend getting rid of that stupid CWS_NS3, however there is another layer on my desktop........in front of my webshots wallpaper and behind my desktop icons.  It is just a white screen and I cannot seem to get rid of it.  When I right click on it, I go to view source and it shows me this file:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!----
***** This file is automatically generated by Microsoft Windows *****
--------><HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252"></HEAD>
<BODY bgColor=#004e98>
<DIV
style="BACKGROUND: url(file:///C:/WINDOWS/WebshotsForJohn%20Bernard%20Maher.bmp) no-repeat 50% 50%; LEFT: 0px; WIDTH: 1280px; POSITION: absolute; TOP: 0px; HEIGHT: 960px"></DIV><IFRAME
id=1
style="Z-INDEX: 1002; BACKGROUND: none transparent scroll repeat 0% 0%; LEFT: 0px; WIDTH: 1248px; POSITION: absolute; TOP: 1px; HEIGHT: 925px"
name=DeskMovrW marginWidth=0 marginHeight=0 src="file:///C:/WINDOWS/screen.html"
frameBorder=0 scrolling=no subscribed_url="" resizeable="&#62084;&#31926;&#53624;&#22;&#29911;"> </IFRAME>
<OBJECT id=ActiveDesktopMover
style="LEFT: 0px; VISIBILITY: hidden; WIDTH: 0px; POSITION: absolute; TOP: 0px; HEIGHT: 0px; container: positioned; zIndex: 5"
classid=clsid:72267F6A-A6F9-11D0-BC94-00C04FB67863></OBJECT>
<OBJECT id=ActiveDesktopMoverW
style="Z-INDEX: 1001; LEFT: -1px; VISIBILITY: hidden; WIDTH: 1250px; POSITION: absolute; TOP: 0px; HEIGHT: 927px; container: positioned"
classid=clsid:72267F6A-A6F9-11D0-BC94-00C04FB67863></OBJECT>&nbsp;
</BODY></HTML>


The name of this file is screen.html and I went into C:\WINDOWS\screen.html and deleted it..........and even though it is gone and deleted, I still have this white desktop.  Any ideas on how to get rid of this?
LVL 1
nothing8171Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

nothing8171Author Commented:
I need to clarify.......the file which I just copy and pasted is called "C__WINDOWS_screen[1]" and the file on my desktop is the C:\WINDOWS\screen.html.
war1Commented:
Greetings, nothing8171!

Did you get rid of all parts of CWS_NS3.  See this tutorial

http://www.bleepingcomputer.com/forums/tutorial85.html

If you ran all the adware scanners and did the registry edits, then HijackThis may get rid of it

Download HijackThis from http://www.hijackthis.de/

Run the program and you will find many entries. Most are OK. Post the log at the Hijackthis forum and click Analyze, Save.  Post a link to the saved list here.


Cheers!
rossfingalCommented:
Hi!

Here are the locations Windows loads Desktop images (backgrounds) from:

%Systemroot%\Web\Wallpaper
%USERPROFILE%\My Documents\My Pictures (& sub-folders)
%AppData%\Microsoft\Internet Explorer
%ProgramFiles%\Plus!\Themes (& sub-folders)

Check to see if any "strange" files are located in any of these.

If you're running XP and you can't access any parts of "Display Properties" or
your attempts to change something in Display Properties fails - here's a reg fix which may help:
http://ralphcaddell.com/Uploads/Background.zip
Unzip it to your Desktop and double-click it or right-click and choose "Merge"
to enter it into the Registry.
Backup the registry keys it changes before you do this -
right-click on the file and choose "Edit" to see the keys it effects.

Good luck!
RF
Fundamentals of JavaScript

Learn the fundamentals of the popular programming language JavaScript so that you can explore the realm of web development.

nothing8171Author Commented:
war1 and rossfingal,

Both your suggestions did not work, unfortunately.  I really need to find out what file is generating this C__WINDOWS_screen.  I found the location of it......under C:\Program Files\Common Files\System\Mapi\1033.  I'm at work now and checked to see if that file is on my computer and it isn't!  Please please.....I need more suggestions.......and yes, I completely got rid of the infamous CWS_NS3.  I'm thinking it damaged some files and those are the ones I need to fix.

rossfingal, when I merged the background reg file, I did notice the change in the C__WINDOWS_screen, but all it did was replace my webhots background to just a normal blue background.  I noticed this by looking at the code in C__WINDOWS_screen.  I will post the hijackthis file when I get home tonight.
war1Commented:
>> I'm at work now and checked to see if that file is on my computer and it isn't!

It may be a hidden file, so you need to unhide hidden files.

To unhide all the hidden files on your system, follow these steps:

   1.  From the Control Panel, click the Folder Options icon.
   2.  When the Folder Options dialog box appears, select the View tab.
   3.  Open the Hidden Files and Folders item and check the Show Hidden Files and Folders option.
   4.  Click OK to register your changes.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ckratschCommented:
I had good luck yesterday using About:Buster to remove a CWS variant:

http://www.malwarebytes.biz/
nothing8171Author Commented:
everyone, I found the answer at this url ----> http://www.wilderssecurity.com/showpost.php?p=473889&postcount=4

war1Commented:
nothing8171, glad you found a solution.  If experts' comments led you to the solution, please accept their comments.  If not, ask Moderator in Comunity Support to close this question and refund the points.

http://www.experts-exchange.com/Community_Support/
nothing8171Author Commented:
please delete this question
war1Commented:
nothing8171, you have asked in Community Support. Moderator do not normally visit the topic areas.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.