display tab missing & system restore not working

Printable View

April 20th, 2005, 16:36 PM
razif77

display tab missing & system restore not working

hi guys..just got this problem...well yesterday while i was using my pc...suddenly the desktop wallpaper changes to some blue coloured notice...it says something about my system is infected by virus,spyware and trojans.I also realised that my when i right click my desktop/display properties,
it shows only 2 tabs(screen saver and settings) all the other tabs is no more.
i've scanned my system with norton antivirus and found some viruses and cleaned them,but the the problem wasn't solve.I also noticed that my system restore feature is also not working.I'm using win XP professional.Somebody help me please.
April 20th, 2005, 16:49 PM
Jack in the UK

OK can you say what virus they were ie there full name ie win32/netsky.d@MM is what i am looking for teh ones You found

Did You update teh virus checker to the latest definitions so all know virus are detected? If Not do so now and re-scan, make notes of teh virus names

Are You running Spyware? If so what one, can it be updated?
If so update and re-scan noting any messages 'spys' it finds we can work from there.

Remember killing a virus is fine but in most cases damage has been done that has not been repaired and in most cases these changed are registry related.

jiuk
April 21st, 2005, 10:07 AM
razif77

Thanx for the reply Jack..well my antivirus is regularly updated and i also been using spybot search&destroy anti spyware utility..the virus name that you request is Downloader.CDT and Downloader.Trojan..some spyware cannot be remove from my systems using my current anti spyware software..the spywares are: DyFuCA.InternetOptimizer,ExactAdvertising.BargainsBuddy,ISearchTech.IST scv,ISearchTech.Powerscan,ISearchTech.Slotch
April 23rd, 2005, 04:43 AM
adeydas

as a piece of advice, always use a firewall especially if you have a static IP.
April 23rd, 2005, 08:22 AM
razif77

ok i'll do that...thanx for the advice
April 24th, 2005, 10:12 AM
Tanglefoot

Not what you will want to hear but Spyware Doctor seems to do the best job, unfortunately it isn't free. Worth the expense though. :)
April 25th, 2005, 09:49 AM
razif77

The spyware's gone..but the display tab and system restore still not function
April 28th, 2005, 00:22 AM
DeathClaw

I have the exact same problem (the blue screen with trojan message and the missing display property tabs). I ran multiple anti-virus and spyware softwares, and my system seems to be clean. However, the display properties still only has the Screensaver and Settings tabs. Anyone know how to fix it?
April 28th, 2005, 00:29 AM
DeathClaw

Wait! I just fixed the display properties problem!

Go to Run --> regedit

Then go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

Look for the entries NoDispAppearancePage and NoDispBackgroundPage. If they have 1 as their values, set them to 0.
April 28th, 2005, 00:47 AM
FastGame

DeathClaw, nice job ;)
April 28th, 2005, 00:55 AM
DeathClaw

Well, I guess partly fixed ...

I can't change the desktop's background through the display properties because it is greyed out.
April 28th, 2005, 01:23 AM
FastGame

How about XP Repair ? that is if you know for sure the system is now clean.
April 28th, 2005, 03:15 AM
DeathClaw

Thanks. I'll try it when I get the time.
May 1st, 2005, 09:23 AM
ak_47

just delete the "wallpaper" key... i think you should be able to change wallpapers now..
May 1st, 2005, 09:24 AM
ak_47

in the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
registry mentioned by deathclaw.. delete the wallpaper value..
May 1st, 2005, 23:25 PM
DeathClaw

Thanks!

Hey thanks ak_47! It worked!
May 6th, 2005, 00:08 AM
rherrera

Sounds like you have what I just got yesterday. It is the virus that comes from the newgenlook site, belongs to some web ad company I guess. I am using Windows 2000. The following procedure should help.

1) First you need to press CTRL-ALT-DEL and bring the Task Manager. Go to Processes and look for a file running named BSE.exe or BE.exe. Kill it by selecting it and clicking on End Task. Then delete that file from your root directory along with the .gif file that is being used as your wallpaper. Delete them both.
2) Use My Computer and go to the C: drive. Go to \winnt\Downloaded Program Files. Right click and Remove any of these ActiveX snippets that you are not able to recognize. There were some that I did not remember installing and I deleted them.
3) Restart the computer. You have to boot up your computer in Safe mode with command prompt. In win 2000 you can press F8 will 2000 is loading to bring up the boot menu. It should be option 3. After loading up, you will then type C: to go to the hard drive and then CD C:\winnt\system32 to go to that directory. Then delete all the .ico files and the param32.dll. The param32.dll is what gives you the X in the red circle on your taskbar. It is also responsible for creating the icons on your desktop and opening the newgenlook website on a browser window every few minutes.
4) Restart your computer and delete the icons from your desktop.
4) Afterwards make sure that under Internet Options you place the newgenlook.com and antispy.newgenlook.com website on the restricted sites list so you are not rerouted there without your consent in the future. In fact, you should restrict any site that contains newgenlook just in case.

I was using the Microsoft AntiSpyware Beta at the time and it did not protect me. I used it to scan the computer afterwards and it could not find it. Neither did AdAware SE.
This newgenlook trojan I believe is called Troj/Warspy-G. Sophos antivirus does recognize it.

My first instinct was to go to Display Properties to change the wallpaper but seems like this trojan changes the look of Display Properties and the wallpaper option is gone. The solution I have read on this thread does fix it. I have read that there are other registry keys that this trojan creates or affects but after going through the process that I just told you, the computer seemed to be back to normal. I have rebooted 3 times since then and the trojan is still not coming back.
May 10th, 2005, 08:55 AM
davidl

No System option in Registry Key

There is no System option available in the Policies folder, only Explorer. Any ideas - I triple checked I was in the right place.

I need to help some friends who have this problem.

Thanks.
May 10th, 2005, 16:07 PM
ah_wee77

Quote:

Originally Posted by ak_47

just delete the "wallpaper" key... i think you should be able to change wallpapers now..

ak_47, i have the same problem as Deathclaw. Able to restore the display and other tabs in the display properties, deleted the 'wp.bmp' inside my wallpaper key and uses my own wallpaper but now it still disallow me to change my wallpaper settings as i wish (still greyed out). Also tried to leave the wallpaper key blank and it still have problems. Any suggestions?
May 17th, 2005, 04:38 AM
ianpac

ah_wee

You must delete the wallpaper key entirely, not just delete the value. This wallpaper key is not needed in the policies registry so just get rid of it. The wallpaper is set in HKCU/Control Panel/Desktop.

Also download FreshUI - it has many interesting tweaks including turning these display tabs on and off - although you still need to delete the wallpaper key in policies registry if you get hit by the desktop trojan to regain the wallpaper browse.
May 19th, 2005, 01:44 AM
cpm21

Had the same problem, but with this forum's help I corrected it in no time. Thank you very much.
May 20th, 2005, 01:39 AM
ah_wee77

Thanks Ianpac. Solved mine too. ;-)
May 25th, 2005, 17:21 PM
sexual_shelly

WOOOOOOOOO thank you!!! i was having this problem and it was getting right under my nose!
May 25th, 2005, 18:06 PM
Curio

The dodgy wallpaper is stored in c:\wp.bmp if you want to take a peek at it - it's not dangerous. If you aren't using any restrictions you can delete the entire Policies key, if I remember this one correctly (and I may not) it also adds some sites to your trusted sites zone in ie so I would check that too.
July 12th, 2005, 05:14 AM
IrqScrfan

Quote:

Originally Posted by DeathClaw

Wait! I just fixed the display properties problem!

Go to Run --> regedit

Then go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

Look for the entries NoDispAppearancePage and NoDispBackgroundPage. If they have 1 as their values, set them to 0.

Many thankssssssssssssssssss ...... truly great ! :D
July 12th, 2005, 07:48 AM
Curio

For more detailed info and tools to remove and restore see this thread http://www.techzonez.com/forums/showthread.php?t=15689
July 31st, 2005, 09:25 AM
paperClip

Quote:

Originally Posted by rherrera

Sounds like you have what I just got yesterday. It is the virus that comes from the newgenlook site, belongs to some web ad company I guess. I am using Windows 2000. The following procedure should help.

1) First you need to press CTRL-ALT-DEL and bring the Task Manager. Go to Processes and look for a file running named BSE.exe or BE.exe. Kill it by selecting it and clicking on End Task. Then delete that file from your root directory along with the .gif file that is being used as your wallpaper. Delete them both.
2) Use My Computer and go to the C: drive. Go to \winnt\Downloaded Program Files. Right click and Remove any of these ActiveX snippets that you are not able to recognize. There were some that I did not remember installing and I deleted them.
3) Restart the computer. You have to boot up your computer in Safe mode with command prompt. In win 2000 you can press F8 will 2000 is loading to bring up the boot menu. It should be option 3. After loading up, you will then type C: to go to the hard drive and then CD C:\winnt\system32 to go to that directory. Then delete all the .ico files and the param32.dll. The param32.dll is what gives you the X in the red circle on your taskbar. It is also responsible for creating the icons on your desktop and opening the newgenlook website on a browser window every few minutes.
4) Restart your computer and delete the icons from your desktop.
4) Afterwards make sure that under Internet Options you place the newgenlook.com and antispy.newgenlook.com website on the restricted sites list so you are not rerouted there without your consent in the future. In fact, you should restrict any site that contains newgenlook just in case.

I was using the Microsoft AntiSpyware Beta at the time and it did not protect me. I used it to scan the computer afterwards and it could not find it. Neither did AdAware SE.
This newgenlook trojan I believe is called Troj/Warspy-G. Sophos antivirus does recognize it.

My first instinct was to go to Display Properties to change the wallpaper but seems like this trojan changes the look of Display Properties and the wallpaper option is gone. The solution I have read on this thread does fix it. I have read that there are other registry keys that this trojan creates or affects but after going through the process that I just told you, the computer seemed to be back to normal. I have rebooted 3 times since then and the trojan is still not coming back.

hi rherrera

any idea how we can do the same for wins 95?

Thanks!