We were, almost, finished with this malware removal.  Everything was clean and repaired, except, the wallpaper and theme could not be changed.  Not totally true, we could go into the display settings and select new items, but they would not change from the default theme with a black background. 

The registry key HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesActiveDesktopNoChangingWallpaper was non-existent, as it should be on a standard install of Windows. If this key is set, deleting it will allow wallpaper to be changed again. 

The next option, was to delete %userprofile%AppdataRoamingMicrosoftWindowsThemesTranscodedWallpaper.jpg and %userprofile%AppdataRoamingMicrosoftWindowsThemesslideshow.ini.  Initially, after deleting these files, the wallpaper and theme would not change still; however, after clicking through several different themes, everything went back to normal. 

Advertisements