Please help get rid of smitfraud remnants

[Millslord]

I will post replies tomorrow afternoon.

Many thx

[Mosaic1]

You're welcome. Have a good night.

[Millslord]

Dear Mosaic,

When I open display properties and click the desktop tab, the list of files is white. It's normal.


I' ve emailed you the files.

thx

[Mosaic1]

I had a look at your results. You sent me two searches for Restrictions.

Please do one for policies and send it.

Did you do the other where I asked you to look for the .pol files?


The fact that the Display properties list is white points to no policy in place. But Smitfraudfix can fix the problem until reboot. So this would point to some restriction in the registry. But none has shown up anywhere in any log.

[Millslord]

Dear Mosaic,

No reg.pol under Adm.

I have emailed you the files requested.

thx

[Mosaic1]

Hello Millslord,

Thanks for the files. We have no added information from them.
This is quite a mystery. So far there has been no progress.

Will you do something for me please?

Fix using smitfraudfix again. Then change your wallpaper to be sure it can be done.

then gio to start >Run and paste in this command:

sc stop Themes
Press enter

This is going to stop the themes service. You taskbar and windows will look different. The taskbar will be tan. Don't be concerned.
Wait a minute to let everything settle. Now go back to start >Run

Paste this comand in:
sc start themes

Press enter.

Let the themes load back up. It will take a minute.
Now go into display properties and see if you can change your wallpaper.


This is a test only.

[Mosaic1]

Well do one more registry export after you reboot and know that display properties is broken.

[Millslord]

Dear Mosaic,

I followed all the steps. Before reboot I was able to change the wallpaper. After reboot the chosen wallpaper remained as the background of choice but I could not even open display properties. I had to rerun smitfraud fix to correct the problem i.e. to be able to open display properties, since as to the wallpaper issue things are the same. Unable to effect any change after reboot.

Another thing I have noticed after all times I have run smitfraud, is that the NETGEAR configuration utility on taskbar disappears. I have to reboot for it to reappear.

Thx

[Mosaic1]

So then shutting down and restarting themes didn't disable display properties?

I wonder if you have a problem registering themeui.dll now.

When Smitfraudfix is run it kills explorer and restarts it.

When Explorer is killed, the systray icons disappear. Most come back because the programmer who wrote the program coded it so the program would recognise the crash, ir check periodically to be sure its icon was there.

This one must not be putting its icon back in the tray. If you look in Task Manager, though, the program is generally running. Closing and restarting the program manually should put the icon back. If not, try a log off and back on.

[Mosaic1]

I use this little utility on my own system. It may not be much help here, but let's give it a try.

Download Regshot from this link, extract and put it in its own folder. That folder will have two zips. The one you want to extract and use is:regshot1_7_2.zip
http://www.snapfiles.com/get/regshot.html

Be sure the display properties is broken.

Double click on regshot.exe to run it.

Click the 1st shot button. This is going to make a snapshot of your registry. Let it go. Do not close the program. When it has finished , then run Smitfraudfix.

When smitfraudfix finises, go back to tyhe regshot window and click the 2nd shot button. This will take a snapshot of your registry in its current state.


When this finishes, click the compare button. This will do a comparison of the two registry snapshots and when finished, will open a file with the results.


Do not close that file. Save it as a text file and upload here please. Let's see if we can spot something in the registry changes.