XP background

mrhaun03

I gotta question for all you smart people. Why is it that when I change my background, when I shutdown or startup the computer, it temporarily shows the previous background?

My gf's computer had a virus that changed the background to say something like Virus Alert! I cleared out the viruses and changed the background. But now when she shuts down, it shows that background that had the Virus Alert message. It does this on startup too, when I first login, but then it changes to the background that I changed it to. Any ideas?

mrhaun03

Just curious as to why it might do this. I've seen it happen on several other computers that were not infected with any type of virus, but still it would show the previous background during logon/logoff.

laneh

I had that happen - if I remember, there was a leftover .dll file in the System32 folder after I cleaned the virus. Have slept many moons since, but I think deleting that finally made it go away.

rfult001

is your current background a BMP file? this OCCASIONALLY causes issues. try changing through a couple JPG images and it MAY clear up.

mrhaun03

rfult001 wrote:

is your current background a BMP file? this OCCASIONALLY causes issues. try changing through a couple JPG images and it MAY clear up.

Its just an XP image. So, yea I think it may be the .BMP file. I'll have to try that and get back to ya.

Thanks for the replies!

tiersten

The sign on screen has its own settings. Maybe its that background image?

mrhaun03

tiersten wrote:

The sign on screen has its own settings. Maybe its that background image?

It doesn't show when I'm at the sign on screen. It's while its loading my personal settings and such....the previous background shows up. After the desktop is loaded, it goes to my normal background.

tiersten

Ah. Turn off Active Desktop and then try resetting your background. Just set it to any BMP file.

Kaminsky

mrhaun03 wrote:

I gotta question for all you smart people. Why is it that when I change my background, when I shutdown or startup the computer, it temporarily shows the previous background?

My gf's computer had a virus that changed the background to say something like Virus Alert! I cleared out the viruses and changed the background. But now when she shuts down, it shows that background that had the Virus Alert message. It does this on startup too, when I first login, but then it changes to the background that I changed it to. Any ideas?

When you cleared out the virii (ok viruses for those that don't like grammer) did you clear them out of the registry too ? If they kick in and then change to something else, my bet is you did't.

run-> "regedit" (it's not scary.. it's just like the old ini files but all in one place)

goto

HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/ [Run | RunOnce] and look in there.

Whats in here kicks in when windows loads but before it hands over control to the user. (which sounds like what you are experiencing) Novice virus writers like to put stuff in here.
Highlight the offending key and delete the whole key. BE CAREFULL .. Windows itself puts a lot of stuff here too.... at your own risk.... [if in doubt .. do not delete it] typically, there will be an obvious bot in here... Get used to what is usually in here so you can easily spot new additions and get rid of the little buggers.

Do the same for RunOnce and then do the same thing all over again in HKEY_CURRENT_USER and you should be sweet.

Please, please be carefull what you delete in here... Windows will die big time if you kill off one of the things it needs to startup. You will have to completely reinstall if you cock it up.

When you get a new PC or install a new OS, you should immediately go here and see what is the normal baseline so you can then easily spot new stuff. Bloody annoying printer driver popups, etc.

This is also a very good thing when a friend asks you to sort out all the popups on their PC for them.. Do this real quick and say there ya go and you get major cred points.

Also, tell your misses to stay clear of downloading all the pron and the dodgy websites

dps

Try to scan it first for Spyware and such. I usually use SuperAntiSpyWare and/or Malwarebytes. Then check for it on the registry HKCU>Control Panel>Desktop>WallPaper. See if any weird file name is there.
Had a couple of problems with AntiVirus 2008 or something and it changed background settings. Deleted the rogue files and was able to clean em.

mrhaun03

dps wrote:

Try to scan it first for Spyware and such. I usually use SuperAntiSpyWare and/or Malwarebytes. Then check for it on the registry HKCU>Control Panel>Desktop>WallPaper. See if any weird file name is there.
Had a couple of problems with AntiVirus 2008 or something and it changed background settings. Deleted the rogue files and was able to clean em.

Antivirus 2008 is what got me too. It changed the registry so I didn't even have the option to set a Desktop Background or Screensave. I did clean out anything that I seen in the registry that wasn't supposed to be there. I'll take another look and seeing changing the background again works.

vsmith3rd

Kaminsky wrote:

mrhaun03 wrote:

I gotta question for all you smart people. Why is it that when I change my background, when I shutdown or startup the computer, it temporarily shows the previous background?

My gf's computer had a virus that changed the background to say something like Virus Alert! I cleared out the viruses and changed the background. But now when she shuts down, it shows that background that had the Virus Alert message. It does this on startup too, when I first login, but then it changes to the background that I changed it to. Any ideas?

When you cleared out the virii (ok viruses for those that don't like grammer) did you clear them out of the registry too ?:

It is unclear how a plural might have been formed under Latin grammar if the word had acquired a meaning requiring a plural form. In Latin virus is generally regarded as a neuter of the second declension, but neuter second declension nouns ending in -us (rather than -um) are so rare that there are no recorded plurals. The form virii would not have been a correct plural in Latin, since the ending -ii only occurs in the plural of masculine and feminine words ending in -ius. For instance, take radius, plural radii: the root is radi-, with the singular ending -us and the plural -i. Thus the plural virii would be that of the nonexistent word virius. The form viri would also be incorrect in Latin. The ending -i is normally used for masculine or feminine nouns, not neuter ones such as virus. In fact there is a Latin word viri, meaning "men" (the plural of vir) but it has a short i in the first syllable: the difference in vowel quantity is reflected in the pronunciation of the English word virile as opposed to viral.

For those that like grammer.

undomiel

And for those who like spelling: Grammar

http://dictionary.reference.com/browse/grammar
http://www.merriam-webster.com/dictionary/grammar

Claymoore

The background that is displayed during logon/logoff is the desktop wallpaper for the Local System account. The Local System account works like a regular user in a lot of ways and can even be subject to local group policies. When a user is not logged on to the workstation, this is the profile and settings that are loaded as if the system account were the logged on user (and it technically is logged on). Since you can't log on as the Local System directly and change the wallpaper, you will have to edit the following registry key.

(As always, the standard chicken little warning about editing the registry applies)

Key: HKEY_USERS\.DEFAULT\Control Panel\Desktop
Value:Wallpaper
Default Setting: (None)

(None) is literally the default value - not blank. You can change this to anything image file that is suppported, but you will have to provide the full path if the file is not in the default wallpaper path - C:\Windows\Web\Wallpaper for XP. This is a handy setting to change if you work with different workstations on a KVM that doesn't support input labeling and want to use different backgrounds to tell the workstations apart.

*Please do not confuse the .Default registry key with the Default User Profile, they are not the same thing.*

vsmith3rd

undomiel wrote:

And for those who like spelling: Grammar

http://dictionary.reference.com/browse/grammar
http://www.merriam-webster.com/dictionary/grammar

No. I meant Kelsey. <jk>