Link to home
Start Free TrialLog in
Avatar of learn
learn

asked on

What is windows.activedesktop ?

Hi,

Every time using Spybot - Search & Destroy, I found an item windows.activedesktop. I removed it but it came back again and again.
Is this a virus and how to remove it?

Thank you in advance.
Avatar of rpggamergirl
rpggamergirl
Flag of Australia image

Try using the regfile mentioned here:
http://forums.spybot.info/showthread.php?p=2137#post2137


Spybot S&D Windows Active.Desktop info here:
http://forums.spybot.info/showthread.php?t=528&highlight=ActiveDesktop


If you're worried about it, scan your computer with viruses/trojans:

1. http://www.ewido.net/en/download/
Update first then scan in safe mode.

Or do these free online scanners:
2. http://www.pandasoftware.com/activescan/com/activescan_principal.htm

3. http://housecall.trendmicro.com/

or for Spyware:
Download the trial version of Spy Sweeper.
http://www.webroot.com/consumer/products/spysweeper
Avatar of learn
learn

ASKER

Hi,

Thanks a lot.

I have tried ewido. But when run Spybot - Search & Destroy again, I found windows.activedesktop again: the item is
......\ActiveDesktip\NoChangingWallpaper!=W=0
As you can see, only one item. However, the link you suggested includes a few istems I don't understand, can you explain what they will do for my system:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoHTMLWallPaper"=-
"NoAddingComponents"=-
"NoChangingWallpaper"=-
"NoComponents"=-
"NoDeletingComponets"=-
"NoEditingComponents"=-
Avatar of learn

ASKER

Moreover, after remove the item by Spybot - Search & Destroy, I always found my windowsXP cannot open properly: it stopped only  and most of the icons on the desk were default picture and black-white. I then got to restart to safe mode and then restart to nomal mode.
ASKER CERTIFIED SOLUTION
Avatar of rpggamergirl
rpggamergirl
Flag of Australia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I assume everything is okay now?
If not, I'm still subscribed to this thread.

Thanks for the "A" grade.

Best wishes!
Avatar of learn

ASKER

In fact, I downloaded a new version of Spybot and there is no  "windows.activedesktop" anymore.....

One thing I don't understand is why Spybot not give us the new version  when we update it.
>>One thing I don't understand is why Spybot not give us the new version  when we update it. <<

All I could say is Spybot is not very efficient with its configurations, updates, etc.
There are many better spyware scanners out there. Ad-Aware is good compared to Spybot. The only thing I like about Spybot is the "immunize" feature, but if you have SpywareBlaster you don't need Spybot's "immunize" feature.



Avatar of learn

ASKER

Actualy, I used to have SpywareBlaster but I removed it now. I just don't know how to use it!! It stays in my desktop silently looks never do anything. How to know if it blocked how many items, items' name and when.....
Spywareblaster is good! I also use its database to check for the 016 entries in hijackthis logs.

SpywareBlaster doesn't run in the background to protect you.
You don't need to have it open, so it doesn't use any resources at all. All You need to do is check for updates like weekly of fortnightly and download if there are any, then click "Enable all Protection"
After you have enabled all protection, you are then protected from activex-based malware from installing into your system.

The way SpywareBlaster's protection works is, it adds all the bad urls into IE's restricted zones, so when IE visits those sites activex will not load/the site will not load and nothing is installed.
Avatar of learn

ASKER

>I also use its database to check for the 016 entries in hijackthis logs.
I have never realize this.....can you tell me where is the database?
Open SpywareBlaster, click on "Internet Explorer" tab
it will then open a "blocked list".

Just rightlick anywhere in any item name, and click "find"
a "find" window will come up, you then paste a CLSID from the 016 entry in Hijackthis log.

CLSID are the numbers in brackets, copy and paste including brackets, and if SpywareBlaster says, "no file" found, then that 016 entry is okay.
If SpywareBlaster found that clsid in its database, then that means it is bad.
>>can you tell me where is the database?<<

the exact database is in IE's restricted zones, those urls that Spywareblaster blocks are added to IE's restricted sites.
Avatar of learn

ASKER

Thanks a lot! I will get SpysareBlaster again!!
You're welcome!

Bear in mind that SpywareBlaster only blocks activex-based malware, so you still have to be very careful of the others as well.
Have the basic necessary security protections that every pc should have:

1. Updated resident antivirus
2. Firewall (you can get free ones like Zone Alarm, etc)
3. And a good spyware/malware scanner to scan your system with regularly;
SpySweeper is good but not free  
AdwareAway is good but not free
MS antispyware is free
AdAware or Spybot

And never open email attachment unless you know for sure it is safe.
Don't click any links on any IM.

Good luck!
Avatar of learn

ASKER

I am going to copy and keep your suggestions.
Thank you so much.