Bits from Bill
WarnHP.html Breaks Desktop Properties
Many of the new spyware variants aren’t shy and commonly change the entire desktop to display a range of dangerous easy to click on links. My daughter Amy recently had a rather nasty malware attack her system and took over her desktop. WinPatrol barked and luckily she was able to stop the Trojan from making itself at home, and installing a keylogger. Unfortunately, it didn’t repair some the damage which broke the ability to change her desktop wallpaper back to normal.
Like many programs WinPatrol monitors for changes in IE Start Pages but doesn’t monitor the source page used if the desktop displays as a web page. Apparently, other programs she tried fail at this as well. When she tried accessing the Desktop properties Windows displayed the following property sheet.
This appeared accessing Display applet from the Control Panel
and when Right-Clicking on the Desktop and clicking on Properties.
It turns out there’s a simple solution. Even though our newest WinPatrol beta allowed her to delete the hidden file warnhp.html, a single desktop registry entry prevented access to change back to her normal wallpaper.
If you experience similar problems try the following.
Run Regedit by clicking on the Start button and selecting “Run…”
Type in “RegEdit” and click OK.
Navigate to the following registry key
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0
On the right side look for the following…
Doube-Click on Source and change the warnhp.html URL to say “About:Home”.
If all the malware has been cleaned up you can reboot and you should have access to your Display Properties again. Monitoring this source key has already been added our next WinPatrol release.
posted by Unknown | 5:43 PM
4 Comments:
Hi,
Followed your instructions, but all it does is give me the "Google" homepage as a desktop background.
Nick T.
Hi Nick,
The typical "static" homepage is set in another location which is easy to change if your system isn't infected.
The normal location will be
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Start Page =
The instructions here are for a specific infection which doesn't just change the home page but it breaks the ability to access the Display Properties dialog.
The location here defines the web document to use if you have your display properties set so your desktop is an active webpage.
Bill
Thanx, Bill
Found mine under "1" instead of "0" so look for it !!
Loyal WinPatrol user - Roger G
I was having problems with my Comcast home page loading. SpyBot was blocking some registry of homepage change. It was also blocking some ads that come up on the home page.
I recently ran the SpyBot scan and it found warnhp.html.
Before taking any action, I looked it up on the ney and found out what it was. When I saw that it was a home page hijacker, I let SpyBot remove it.
Now everything loads quickly. I also just checked my registries and the warnhp is gone.
Post a Comment
<< Home