I posted a message here a while back related to 3 of my desktop icons changing spontaneously back to their defaults but no one was able to help. I did some more troubleshooting and here's what I found... When I customize my desktop icons via the desktop customization button on the Display Settings window, it adds an override key in the registry under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\. Apparently, and I'm guessing here, as long as this key is present, my icon will be overridden with my customized choice. Here is what's happening; At LEAST once per hour, seemingly at random, something is deleting these customized override keys from the registry. I say it seems random because I can't tell when the changes are happening. Whatever deletes these keys does not also do a refresh of my desktop so I don't know it's been changed until something actuallly refreshes. The keys in question are as follows... Network Places = 208D2C60-3AEA-1069-A2D7-08002B30309D My Computer = 20D04FE0-3AEA-1069-A2D8-08002B30309D Recycle Bin = 645FF040-5081-101B-9F08-00AA002F954E Once the keys are deleted and the desktop is refreshed, the icons revert back to their defaults which are stored in the CLSID tree under HKEY_CLASSES_ROOT. Please help me figure out what is deleting these keys! Is there any way to track down what is making these changes? Please note: I'm using McAfee for virus protection and AdAware for Spybot protection. (both are current) I'm completely up to date on all Windows Update patches and I've recently applied the lastest graphics driver as well. I don't have a lot of garbage running in my background because I tend to keep it as clean as I can but I could have missed something. Just in case it's relavent, current processes running are as follows; ati2evxx.exe cidaemon.exe cisvc.exe Crypserv.exe csrss.exe CTDVDDET.exe CTHELPER.EXE CTSysVol.exe cvpnd.exe explorer.exe imonNT.exe imontry.exe lsass.exe McShield.exe MsPMSPSv.exe myAgtSvc.exe myAgtTry.exe omtsreco.exe services.exe smss.exe spoolsv.exe svchost.exe winlogon.exe Thanks in Advance! Roger Westbrook sidhe@comcast.net

Hey Roger, !!MESSING WITH THE REGISTRY IS ABOUT AS BAD AS IT GETS - CHECK THIS FORUM FOR PLENTY OF ENTRIES, INCLUDING THOSE BY TOP PEOPLE!! !!BACK UP YOUR DATA FIRST IF YOU DO ALTER IT!! That said... I'm sot sure, but maybe this will help you somehow: The CLSID means CLASS-ID These numbers you are quoting are nothing more then GUIDs - just random numbers, but UNIQUE identifiers - they're so long because they have to uniquely identify this 'class' of object. If you were to use another object with the same ID, then the OS would no longer be able to link one class to one GUID, so major troubles would follow. The fact that the world is rapidly running out of IP numbers, is similar to this problem(UNIQUE ID) except that those are not generated at random, just one after the other is assigned. I suspect that the link with the icon is really made in one of the sub-sections of class-id. It will NOT be a link to a name(like icon.bmp) but it will be a reference to a windows' .dll with another number listed as the icon index number within that file (so something like xxx.dll,32). Messing with it will always be tricky, and I suspect that the resets that you're getting are actually Windows itself doing a refresh on its components. Is an icon really worth the risk? svg

I've read your post again, and it seems I missed one of your questions about tracking the registry - sorry about that. Better late than never... here's some more: [ORIGIN: Dr.Nick] http://www.sysinternals.com/ntw2k/source/regmon.shtml I've used it(and others from Sysinternals) on Dr.Nick's suggestion, and they are excellent! Best Wishes for 2004, svg