Hi,
Whilst using spybot-search-destroy scan the following came up.

Smitfraud-C

HKEY_LOCAL_MACHINE\SOFTWARE\POLICIES\{06849E9F-C8D7-4D59-784B7D6BEOB3}=...MTE3ND160D...oxNg

It shows as a registery file,can I delete this,at present I have left it where it is.
Thanks guys...

Lets have a look , download this regfix HERE Save it to your desktop.

Locate "smitfraud.reg" on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the "merged successfully" prompt then follow the rest of the instructions below.



Download Smitrem to your desktop
http://noahdfear.geekstogo.com/click...click.php?id=1
Run the installer and then press Start to Extract the
files to the desktop, Do not run it yet.


Reboot into safe mode (Reboot and keep tapping F8 then
choose safe mode from the list)

Run SmitRem:

Open the SmitRem folder and double click the "RunThis.bat"
file to start the tool , Follow the prompts on
screen. Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of the drive that you ran the batch file on, eg; Local Disk C: or partition where your operating system is installed.

reboot back into normal mode

You will need to reload your wallpaper as the SmitRem
tool will reset it, you can do this by right clicking
desktop and choosing properties, First check Theme and
set it to Windows XP then click the Desktop tab and
choose the one you want to use and press apply.

Then post the smitrem log.

Ok, here is the log thanks Joe

smitfiles.txt

Looks good to me , does spybot still show that reg entry?

Hi Joe,
Smitfraud does not come up when I scan with spybot,but the following registry change has appeared

HKEY_USERS\S-1-5-21-1096576040-2038748391-2109389999-1007\Software\Microsoft\Windows\CurrentVersion\Pol icies\ActiveDesktop\NoHTMLWallPaper!=W=1

also when I go to display properties for my desktop background, the icons in my desk top tab have changed to a blackoutlined box with the top right corner sort of folded over and in that it is like a blue line with a red and a blue (dot) below it in the box, (eye sight is not to good here) where prior it had like a paint brush in some of the boxes (to be honest I cant really remember what they all looked like.
Also Joe can I delete what you asked me to download in regards to Smitfraud which includes the smitfruad registration entries?
Thankyou again Joe

Are you using Active Desktop?

NoHTMLWallPaperonly is a restriction that only allow bitmaps (BMP) as wallpaper