Desktop icons have been replaced?

[msolheim]

A friend called me with this. She and another friend were burning
music cd yesterday and sometime during the process all the
destop icons were changed to something that looks like a cd-rom
drive icon. I haven's see it myself, this is all over the phone.
She is runing WinME. Any suggetions on why and how to get it back?

thanks
mike

[Charger]

Run a virus check.

[reboot]

Open Control Panel, select Themes, and apply a theme, or select the "Windows Default" from the menu.

[msolheim]

ok here is little more info.

I went over and looked for myself. I took a screen capture of the
desktop. Hope it turns out so you can see whats going on.

The standard icons, My Documents, My computer, Recycle Bin, IE
are not affected. If you create any new icons they are not
affected. She doesn't have windows themes so I couldn't try what
reboot had suggested. If you can tell on the image I attached,
the original icons are visible and it looks like the cd-rom icon has
been placed over them. If you select one of the icons it higlights
only the original icon image but they move together.

She has Norton installed with an updated virus list so I ran a full
scan and found three files in her internet cache affected with
JS.Seeker which it couldn't repair so I just quarntined them. The
boot sector was also modified and was repaired by Norton.

I'm out of ideas. Anybody else?

[msolheim]

forgot to attach image after preview

[GaryRouth]

It's possible that the boot sector virus is different from the JS.Seeker virus. Did you read the removal instructions over at the Symantec/Norton site?

Here's the note for JS.Seeker (there are other variants of this: .B, .H, etc.)
http://securityresponse.symantec.com/avcenter/venc/data/js.seeker.html

Once you are certain the virus is completely gone, delete and then re-create the affected icons. (Since new icons shouldn't be affected)

Best of luck
. . . Gary

[msolheim]

thanks Gary,
I reviewed the same info a little bit ago and figured I'd give it a
try. I'll let you know how it goes.

[msolheim]

Ok, did some more work with little results :confused:
I reviewed the write up on nortons site about the js.seeker virus
and did the manual removal. I was unable to do the backup
restore portion. There were no backup files on the machine,
neither backup1.reg or backup2.reg existed on the machine.

Does winME do back ups differently?

I loaded ad-ware to remove any spy ware, which there were a
few loaded. During this install I noticed that the desktop icon
that the program created was also modified.

After a little playing around I found the following. If you create
a shortcut of any kind on the desktop only the modification
happens to the icon. If you copy a file with an icon to the desktop
the icon shows up normally. I even loaded in safe mode to see
what happened and all the icons were normal. I'm starting to think
that there is a registry key that has been modified or corrupt.

While in safe mode I ran defrag which took forever to complete about 2 1/2 hours for 10 gig harddrive. It kept restarting.
Then ran scandisk.

This little problem is starting to really upset me. I'm going to
figure it out if it kills me! :mad:

thanks for any input.

[gowen]

Msolheim; I had this happen to me on my winME pc about a month ago. What I did was use system restore to go back to before my icons changed. Then I did an AVG virus check and it was o.k. Then I did the online Housecall virus check just to make sure that the AVG check didn't miss any virus and it was O.K. also. Hope this helps you out..
For the URL for Housecall, just do a google search.

[GaryRouth]

Sounds like the virus (or at least some virus) is still there. The System Restore option should get her Registry back to more-or-less normal, but an AntiVirus scanner is going to have to kill it. gowen's recommend of AVG matches many other folks recommending it. You might try the Housecall first, in fact, just in case it finds other viruses: for it might be able to clean them right away. If you restore far enough back, perhaps that restore won't be tainted with virus (system restore can preserve a virus right along with the other system files, since many do make changes to the Registry). So you'll want to do AntiVirus both before and after a restore. If all is well after a Housecall virus kill, you might not need the restore, it all depends.

And here's where you'll find Housecall (on the"free tools" or "free online virus scan" link):
http://www.trendmicro.com

Best of luck
. . . Gary