Page 2 of 2 FirstFirst 12
Results 16 to 27 of 27

Thread: display tab missing & system restore not working

  1. #16
    Junior Member
    Join Date
    Apr 2005
    Posts
    5

    Thanks!

    Hey thanks ak_47! It worked!

  2. #17
    Junior Member
    Join Date
    May 2005
    Posts
    1
    Sounds like you have what I just got yesterday. It is the virus that comes from the newgenlook site, belongs to some web ad company I guess. I am using Windows 2000. The following procedure should help.

    1) First you need to press CTRL-ALT-DEL and bring the Task Manager. Go to Processes and look for a file running named BSE.exe or BE.exe. Kill it by selecting it and clicking on End Task. Then delete that file from your root directory along with the .gif file that is being used as your wallpaper. Delete them both.
    2) Use My Computer and go to the C: drive. Go to \winnt\Downloaded Program Files. Right click and Remove any of these ActiveX snippets that you are not able to recognize. There were some that I did not remember installing and I deleted them.
    3) Restart the computer. You have to boot up your computer in Safe mode with command prompt. In win 2000 you can press F8 will 2000 is loading to bring up the boot menu. It should be option 3. After loading up, you will then type C: to go to the hard drive and then CD C:\winnt\system32 to go to that directory. Then delete all the .ico files and the param32.dll. The param32.dll is what gives you the X in the red circle on your taskbar. It is also responsible for creating the icons on your desktop and opening the newgenlook website on a browser window every few minutes.
    4) Restart your computer and delete the icons from your desktop.
    4) Afterwards make sure that under Internet Options you place the newgenlook.com and antispy.newgenlook.com website on the restricted sites list so you are not rerouted there without your consent in the future. In fact, you should restrict any site that contains newgenlook just in case.

    I was using the Microsoft AntiSpyware Beta at the time and it did not protect me. I used it to scan the computer afterwards and it could not find it. Neither did AdAware SE.
    This newgenlook trojan I believe is called Troj/Warspy-G. Sophos antivirus does recognize it.

    My first instinct was to go to Display Properties to change the wallpaper but seems like this trojan changes the look of Display Properties and the wallpaper option is gone. The solution I have read on this thread does fix it. I have read that there are other registry keys that this trojan creates or affects but after going through the process that I just told you, the computer seemed to be back to normal. I have rebooted 3 times since then and the trojan is still not coming back.

  3. #18
    Junior Member
    Join Date
    May 2005
    Posts
    1

    No System option in Registry Key

    There is no System option available in the Policies folder, only Explorer. Any ideas - I triple checked I was in the right place.

    I need to help some friends who have this problem.

    Thanks.

  4. #19
    Junior Member
    Join Date
    May 2005
    Posts
    2

    Unhappy

    Quote Originally Posted by ak_47
    just delete the "wallpaper" key... i think you should be able to change wallpapers now..
    ak_47, i have the same problem as Deathclaw. Able to restore the display and other tabs in the display properties, deleted the 'wp.bmp' inside my wallpaper key and uses my own wallpaper but now it still disallow me to change my wallpaper settings as i wish (still greyed out). Also tried to leave the wallpaper key blank and it still have problems. Any suggestions?
    Last edited by ah_wee77; May 10th, 2005 at 16:09 PM. Reason: wrong spelling

  5. #20
    Junior Member
    Join Date
    May 2005
    Posts
    3
    ah_wee

    You must delete the wallpaper key entirely, not just delete the value. This wallpaper key is not needed in the policies registry so just get rid of it. The wallpaper is set in HKCU/Control Panel/Desktop.

    Also download FreshUI - it has many interesting tweaks including turning these display tabs on and off - although you still need to delete the wallpaper key in policies registry if you get hit by the desktop trojan to regain the wallpaper browse.
    Last edited by ianpac; May 17th, 2005 at 04:44 AM.

  6. #21
    Junior Member
    Join Date
    May 2005
    Posts
    1
    Had the same problem, but with this forum's help I corrected it in no time. Thank you very much.

  7. #22
    Junior Member
    Join Date
    May 2005
    Posts
    2
    Thanks Ianpac. Solved mine too. ;-)

  8. #23
    Junior Member
    Join Date
    May 2005
    Posts
    1
    WOOOOOOOOO thank you!!! i was having this problem and it was getting right under my nose!

  9. #24
    Triple Platinum Member Curio's Avatar
    Join Date
    Nov 2004
    Location
    London
    Posts
    686
    The dodgy wallpaper is stored in c:\wp.bmp if you want to take a peek at it - it's not dangerous. If you aren't using any restrictions you can delete the entire Policies key, if I remember this one correctly (and I may not) it also adds some sites to your trusted sites zone in ie so I would check that too.
    I'm using Windows 7 - you got a problem with that?

  10. #25
    Junior Member
    Join Date
    Jul 2005
    Posts
    1
    Quote Originally Posted by DeathClaw
    Wait! I just fixed the display properties problem!

    Go to Run --> regedit

    Then go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

    Look for the entries NoDispAppearancePage and NoDispBackgroundPage. If they have 1 as their values, set them to 0.

    Many thankssssssssssssssssss ...... truly great !

  11. #26
    Triple Platinum Member Curio's Avatar
    Join Date
    Nov 2004
    Location
    London
    Posts
    686
    For more detailed info and tools to remove and restore see this thread http://www.techzonez.com/forums/showthread.php?t=15689
    I'm using Windows 7 - you got a problem with that?

  12. #27
    Junior Member
    Join Date
    Jul 2005
    Posts
    1
    Quote Originally Posted by rherrera
    Sounds like you have what I just got yesterday. It is the virus that comes from the newgenlook site, belongs to some web ad company I guess. I am using Windows 2000. The following procedure should help.

    1) First you need to press CTRL-ALT-DEL and bring the Task Manager. Go to Processes and look for a file running named BSE.exe or BE.exe. Kill it by selecting it and clicking on End Task. Then delete that file from your root directory along with the .gif file that is being used as your wallpaper. Delete them both.
    2) Use My Computer and go to the C: drive. Go to \winnt\Downloaded Program Files. Right click and Remove any of these ActiveX snippets that you are not able to recognize. There were some that I did not remember installing and I deleted them.
    3) Restart the computer. You have to boot up your computer in Safe mode with command prompt. In win 2000 you can press F8 will 2000 is loading to bring up the boot menu. It should be option 3. After loading up, you will then type C: to go to the hard drive and then CD C:\winnt\system32 to go to that directory. Then delete all the .ico files and the param32.dll. The param32.dll is what gives you the X in the red circle on your taskbar. It is also responsible for creating the icons on your desktop and opening the newgenlook website on a browser window every few minutes.
    4) Restart your computer and delete the icons from your desktop.
    4) Afterwards make sure that under Internet Options you place the newgenlook.com and antispy.newgenlook.com website on the restricted sites list so you are not rerouted there without your consent in the future. In fact, you should restrict any site that contains newgenlook just in case.

    I was using the Microsoft AntiSpyware Beta at the time and it did not protect me. I used it to scan the computer afterwards and it could not find it. Neither did AdAware SE.
    This newgenlook trojan I believe is called Troj/Warspy-G. Sophos antivirus does recognize it.

    My first instinct was to go to Display Properties to change the wallpaper but seems like this trojan changes the look of Display Properties and the wallpaper option is gone. The solution I have read on this thread does fix it. I have read that there are other registry keys that this trojan creates or affects but after going through the process that I just told you, the computer seemed to be back to normal. I have rebooted 3 times since then and the trojan is still not coming back.
    hi rherrera

    any idea how we can do the same for wins 95?

    Thanks!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •