Hypoteches.com Pest Trap has desktop background

Hello,

I ground the rest of the Pest Trap and hypoteches.com crap to dust between multiple runs of Spybot, Ad-Adware, AVG, etc etc and editting the resgistery. I see no evidence that any of the malware is running anywhere with the one exception; the bogus message on the desktop that replaces the photo the guy wants for a background. It is a friend's computer and sadly to say there were reams of spyware, adware, viruses, and trojans that I removed. I addition to cleaning off a lot of unwanted software and making the startup more streamlined. Anyway, does anyone having a fix for the desktop background? Obviously, there is still at least one garbage file on the machine doing this, but... Any help would be great. As I said I have been watching the executing tasks carefully and I don't see anything running on the machine that looks questionable. Just the stupid wallpaper issue, which covers the photo that was set as wallpaper (you see the photo when shutting the machine down). Thanks.

 

I appreciate the help, but that seems like a long and winding road to fix the wallpaper. I would have thought that there would be one corrupt file causing the bogus wallpaper to display that could simple be fixed or deleted? Now that stupid spyware itself is apparently dead. I guess if I can't find a simple solution then I will have to walk thru all those steps, but as I said that is more than a bit daunting for the relative size of the problem.

 

for a temporary fix i just changed the file "C:\WINDOWS\warnhp.html". thats the page that comes up as a display.

though about 5 minutes ago i noticed that if i put my mouse near the top of the screen a little drop down box apears. you then have the option of disabling the background it displays and it restors your desktop. as to remove the program that does it in the first place i don't know yet. I'm not sure if the drop down was a mistake that i was lucky to catch, so good luck.

 

THESE STEPS WILL NOT REMOVE THE OFFENDNING PROGRAM!!!

But they will remove the message from your desktop.
Go into display properties (Click on Dislplay in the Control Panel)
Go to the Desktop Tab
Click on Customize Desktop
Click on the Web Tab
Uncheck any web pages that are checked. (Possibly called Desktop Uninstall)
Click OK.

Remember this only fixes the visable page, you still need to remove the spyware/virus that changed this setting.

 

Pest Trap seems to corrupt the file NTUSER in the C:\Documents and Settings\*USER* directory. To change the desktop background, etc., you must replace this file with a fresh one. The process I used involved creating a new empty account, shutting down, loading the drive from another OS, and swapping the files. Also recommend clearing the ntuser Config Settings file using notepad.

This obviously won't work unless you have rid the PC of Pest Trap first. (NAV, Microsoft Defender, & ewido seem to have cleaned mine up)

 

You can use SmitFraudFix to remove the bad files and the infection. It will also change you desktop to a generic blue color. After that, you can change it back to what you want to do. I'd recommend running this fix in safe mode along with a scan from Ewido Antimalware as well.

Here is my illustrated example of this.

You can also use the instructions at Bleeping Computer to remove Pest Trap. SpyFalcon and Pest Trap are the same thing, so don't worry about the names being different.

 

OK then you will like this... I didn't listen to anything those guys said all i did was go to RUN>REGEDIT and go to the tabs: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\ and delete the file that says walpaper

TOOK 10 SECONDS!!!

 

WOW that was easy any fixed the desktop problem .
Thanks