If you’re looking for a way to remove a trojan/virus that keeps making your wallpaper change into the image of a windows warning message that states, “Warning! Spyware detected on your computer! Install antivirus or spyware remover to clean your computer,”…
…then try out this guide. It worked for me (and is not originally mine, but attributed to Ebomb from this message board, but I just fleshed it out with better step-by-steps), so give it a shot to see if it works for you. As always, you must acknowledge that fiddling with your settings and whatnot are your own responsibility — not mine. I’m just showing you how I got rid of my problem, so no guarantees for your success or demise either way ^_^ Read thru the whole guide first, before you do anything.
The virus appears, to my limited knowledge, to simply be a kind of prank virus that doesn’t actually cause any real malfunction. The blue-screen error that pops up after 20 minutes or so and possibly appears to make it reboot is actually just a screensaver, with an animation simulating the reboot. If you hit ENTER during the reboot or bluescreen, you’ll come back to the desktop just as you would with any screensaver.
One thing about this sucker is that it disables the “desktop” and “screensaver” tabs in the properties menu for the desktop so you can’t change them back quite so easily.
Here’s how to eliminate this buzzard, all without using antivirus software. My suspicion as to the reason antivirus programs don’t seem to pick this up is that it doesn’t really do any virus-like harm, it just does prankstery things such as changing the screensaver and turning off function to a few menus. I haven’t analyzed the code so I don’t actually know if it really does bad stuff, though either. But anyway.
1. Click on START in the bottom corner and select RUN, and type in regedit.
1a. Navigate the directory tree to this path: HKEY_CURRENT_USER, Software, Microsoft, Windows, CurrentVersion, Policies, System.
1b. Once you’re there, right-click on NoDispBackgroundPage and set the value to 0 (zero). Do the same for NoDispScrSavPage. This will let you see the wallpaper and screensaver tabs in display properties again.
Just close out the REGEDIT program and the changes will have taken effect, without having to reboot. Go to your display properties (right-click on a blank area of the desktop and select properties from the menu), and the Screensaver and Desktop tabs should now be back.
2. Go to the Screensaver tab in Display Properties and look for a screensaver with a gobbledegook name. The name will probably be different for each infection, but looks something along the lines of this one highlighted. Write this name down somewhere.
2a. Using Windows Explorer (not Internet Explorer), navigate to C:\WINDOWS\SYSTEM32 and look for filename with the same name you wrote down in step 2, and delete it. This makes the blue screen stop showing up. It was a fake blue screen anyway.
2b. Now hit hold down the CTRL, ALT and DEL keys on the keyboard and if you’re given the option, select something to the effect of “active processes” and look for a similar gobbledegook program running (ends with .exe). Write down the name of this one, then click on it and END PROGRAM, and click YES on the warning about shutting a program down this weird way.
2c. Go back to Explorer and look for a filename just like the one you wrote down in step 2b. You’ve now deleted the main virus.
2d. Go back and re-open REGEDIT and do a search (CTRL-F) for the name you wrote down in 2b, and delete the entry that points to it. This deletes the command to run the virus.
3. Go back to Display Properties and open the Desktop tab, and scroll down to see a similar (if not duplicate) gobbledegook name — this is the file that makes the background look like a warning window. Write this name down (if it’s not a duplicate), and go back to Explorer and delete this file also. That’ll prevent the background from changing to that warning again.
4. Empty your Recycle Bin, and you should now be set!
…Let me know if this helped you out — however, please do not ask me more questions about it. I’m no expert in the field, and the guide (invented by the guy listed at the top of the article) is simply a method that worked for me. Good luck!