Discussion Locked

Can't return default desktop properties

0 helpful
9 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
This is going to be hard to describe. I have a user on my network that has done something to the appearance of their desktop. The workstation in question is a NT4 SP6A box. The user was not a power user. They are a member of a few of the less privileged user groups, domain users, and other special user groups with mostly read permissions to different resources on the network. They called me last week because they could not open an application (database client) it said in essence, that she couldnot open it because she did not have write permission to the local hard drive, the client software would abort, there has never been an issue with domain users and an inability to run the DB client. I logged onto the machine with admin privilege andwas successful at starting the DB client. Another peculiarity was the appearance of the desktop icons and the administrative shares$ on the local drives. The security permissions seemed set to be what they were supposed to be and I could connect to them remotely without any problems. The drive icons in Explorer and on the desktop all looked similar to the devices icon in the control panel over the top of the original icon. The drive shares looked as if they had been tampered with in some way because where the little hand that held the folder would typically be, there was an image of some kind of drive (not the default.) To quickly return her to work I made her a member of the Power Users group on that machine enabling her to make changes to the contents of the hard disk. The icons and shares look strange no matter who is logged onto the machine, no matter what their level of access is. I cannot figure out how to return the systems? icon and shares appearance back to normal. I have tried all of the standard stuff to return the desktop properties back to the default. I do not know what is going on. Has anyone encountered anything like this?

9 replies

by manuela

Although I have seen this on a couple of occasions on NT workstations of the same specification, where either notepad or drives icons appear superimposed on the desktop icons and other folders, I always resorted to reloading a standard image on the affected PC. However, an anti-virus expert from Sophos sent me this info: I have had a look for those viruses that
affect the desktop icons. There seem to be quite a few. the VMPCK series of
viruses often affect icons, notably WM97/Vmpck-D and WM97/Vmpck-1BW.

I also found that WM97/Git-A and WM97/Edds-B can change the icons. The most
common virus that affects the icons is WM97/Brenda which renames the My Computer
icon to "Little Miss Nick"

Hope this helps.

by rsears

We use Norton AntiVirus Corporate with all of the latest updates, which we keep current all of the time. I looked in the virus history and can't find evidence of any virus ever being on the system. Is it possible that there is something that Norton is not picking up? How can I tell if any of the viruses you mention are on the system? Wouldn't my virus software catch it?

I did not want to rate your answers yet because I am not convinced that you are wrong. But I couldn't figure out how to comment on your solutions without rejecting your answers.

by mjervis

Definately I would be looking into Virus Protection. Giving your user Power User access may be spreading the virus to other workstations. "Brenda" has been known to do this with the Power User permissions. the fact that under that user name you do not have write access suggests to me immediately either someone has changed the attributes on the system or another program such as a virus did. We use Nortons Anti Virus, this has found the "Brenda" virus but has never really cleaned it under NT workstation. When I redid the hard drive I had to use Disk Manager from Ontrack to successfully rewrite the Master Boot Record and delete the virus.

by rsears

We use Norton AntiVirus Corporate with all of the latest updates, which we keep current all of the time. I looked in the virus history and can't find evidence of any virus ever being on the system. Is it possible that there is something that Norton is not picking up? How can I tell if any of the viruses you mention are on the system? Wouldn't my virus software catch it?

I did not want to rate your answers yet because I am not convinced that you are wrong. But I couldn't figure out how to comment on your solutions without rejecting your answers.

by wyldchilde

You might try deleting the ShellConCache file in the Winnt directory. This is the file that controls the appearance of the icons on the desktop, and NT auto-recreates it if it's missing provided something else isn't messed up in the system.

by mjervis

My Nortons did not detect this particular virus in windows. I had to shut down the computer and restart in safe mode then run nortons in dos. I called symantec at the time this was happening and thier tech walked me through the process. There was a few switches he had me place in the command line but I cannot remember what they were. My suggestion contact symantec.

This discussion is closed to new replies.