First let me say Thanks Metallica... Your solution worked for me just fine.
Second let me post what happened...
A family member downloaded what looked like a credible Application called XP 2008 Antivirus below are the symptoms:
1st it automatically lauched a DEMO of a antivirus running on the system... obviously it stated it found over 3000 virus'
2nd it put an icon on the task bar which continuously ran in the background popping up a message every 30 seconds stating you had over 3000 virus'
3rd it put a bitmap image somewhere on the computer which it replaced your background Stating your computer is infected and immediate actions are required
4th it set your screensaver to kickoff every minute with a fake 'Blue screen of Death' Microsoft critical error screen
And finally to really get you they change your display property functionality.
This install looks real will even drop the XP 2008 Antivirus Program in your all programs menu. Don't waste your time with the Unistall program it does not work.
Corrective Actions:
1. Open Windows Task Manager and select the bogus .exe files under the User Name 'login' they will stick out they are about 15 - 20 characters long mixed alphanumeric characters (sorry did not log the true names)
once that is done then the icon on the task bar will go away and will no longer lock down the files from deletion.
2. under C:/Programfiles/rfc.... (again sorry did not note the folder name) but again it will stick out long and no meaning - to be sure your in the right area open it it will have the fake unistall file in it. DELETE the entire folder.
2a. Remeber if you don't kill the background process in step 1 the files will be locked and therefore undeletable.
3. Follow Metallica's direction to get back your tabs on the display properties
4. you will see the .bmp file there that was pushed with the malware do a find for the file name mine was found in c:\Documents and Settings\login\recent - DELETE it
5. choose your new Background
6. Go to your screen savor again you will find the bogus file (this name I have) blphc1o2j0e10p. -all the file and folder names are similar. Again do a search and for blphc1o2j0e10p.* find and DELETE, then reset your screensaver. the file was found in C:\WINDOWS\system32\
7. Also found this file BLPHC1O2J0E10P.SCR-1048B2FE.pf in C:\WINDOWS\prefetch\ DELETE it as well
That should do it ... I only hope this helps someone in return for the help I received
Thanks Again
Edited by Schultza, 24 June 2008 - 06:30 AM.