display tab missing & system restore not working

**razif77** · April 20th, 2005, 16:36 PM

hi guys..just got this problem...well yesterday while i was using my pc...suddenly the desktop wallpaper changes to some blue coloured notice...it says something about my system is infected by virus,spyware and trojans.I also realised that my when i right click my desktop/display properties,
it shows only 2 tabs(screen saver and settings) all the other tabs is no more.
i've scanned my system with norton antivirus and found some viruses and cleaned them,but the the problem wasn't solve.I also noticed that my system restore feature is also not working.I'm using win XP professional.Somebody help me please.

**Jack in the UK** · April 20th, 2005, 16:49 PM

OK can you say what virus they were ie there full name ie win32/netsky.d@MM is what i am looking for teh ones You found

Did You update teh virus checker to the latest definitions so all know virus are detected? If Not do so now and re-scan, make notes of teh virus names

Are You running Spyware? If so what one, can it be updated?
If so update and re-scan noting any messages 'spys' it finds we can work from there.

Remember killing a virus is fine but in most cases damage has been done that has not been repaired and in most cases these changed are registry related.

jiuk

**razif77** · April 21st, 2005, 10:07 AM

Thanx for the reply Jack..well my antivirus is regularly updated and i also been using spybot search&destroy anti spyware utility..the virus name that you request is Downloader.CDT and Downloader.Trojan..some spyware cannot be remove from my systems using my current anti spyware software..the spywares are: DyFuCA.InternetOptimizer,ExactAdvertising.BargainsBuddy,ISearchTech.IST scv,ISearchTech.Powerscan,ISearchTech.Slotch

**adeydas** · April 23rd, 2005, 04:43 AM

as a piece of advice, always use a firewall especially if you have a static IP.

**razif77** · April 23rd, 2005, 08:22 AM

ok i'll do that...thanx for the advice

**Tanglefoot** · April 24th, 2005, 10:12 AM

Not what you will want to hear but Spyware Doctor seems to do the best job, unfortunately it isn't free. Worth the expense though.

**rherrera** · May 6th, 2005, 00:08 AM

Sounds like you have what I just got yesterday. It is the virus that comes from the newgenlook site, belongs to some web ad company I guess. I am using Windows 2000. The following procedure should help.

1) First you need to press CTRL-ALT-DEL and bring the Task Manager. Go to Processes and look for a file running named BSE.exe or BE.exe. Kill it by selecting it and clicking on End Task. Then delete that file from your root directory along with the .gif file that is being used as your wallpaper. Delete them both.
2) Use My Computer and go to the C: drive. Go to \winnt\Downloaded Program Files. Right click and Remove any of these ActiveX snippets that you are not able to recognize. There were some that I did not remember installing and I deleted them.
3) Restart the computer. You have to boot up your computer in Safe mode with command prompt. In win 2000 you can press F8 will 2000 is loading to bring up the boot menu. It should be option 3. After loading up, you will then type C: to go to the hard drive and then CD C:\winnt\system32 to go to that directory. Then delete all the .ico files and the param32.dll. The param32.dll is what gives you the X in the red circle on your taskbar. It is also responsible for creating the icons on your desktop and opening the newgenlook website on a browser window every few minutes.
4) Restart your computer and delete the icons from your desktop.
4) Afterwards make sure that under Internet Options you place the newgenlook.com and antispy.newgenlook.com website on the restricted sites list so you are not rerouted there without your consent in the future. In fact, you should restrict any site that contains newgenlook just in case.

I was using the Microsoft AntiSpyware Beta at the time and it did not protect me. I used it to scan the computer afterwards and it could not find it. Neither did AdAware SE.
This newgenlook trojan I believe is called Troj/Warspy-G. Sophos antivirus does recognize it.

My first instinct was to go to Display Properties to change the wallpaper but seems like this trojan changes the look of Display Properties and the wallpaper option is gone. The solution I have read on this thread does fix it. I have read that there are other registry keys that this trojan creates or affects but after going through the process that I just told you, the computer seemed to be back to normal. I have rebooted 3 times since then and the trojan is still not coming back.

**paperClip** · July 31st, 2005, 09:25 AM

Originally Posted by rherrera

Sounds like you have what I just got yesterday. It is the virus that comes from the newgenlook site, belongs to some web ad company I guess. I am using Windows 2000. The following procedure should help.

1) First you need to press CTRL-ALT-DEL and bring the Task Manager. Go to Processes and look for a file running named BSE.exe or BE.exe. Kill it by selecting it and clicking on End Task. Then delete that file from your root directory along with the .gif file that is being used as your wallpaper. Delete them both.
2) Use My Computer and go to the C: drive. Go to \winnt\Downloaded Program Files. Right click and Remove any of these ActiveX snippets that you are not able to recognize. There were some that I did not remember installing and I deleted them.
3) Restart the computer. You have to boot up your computer in Safe mode with command prompt. In win 2000 you can press F8 will 2000 is loading to bring up the boot menu. It should be option 3. After loading up, you will then type C: to go to the hard drive and then CD C:\winnt\system32 to go to that directory. Then delete all the .ico files and the param32.dll. The param32.dll is what gives you the X in the red circle on your taskbar. It is also responsible for creating the icons on your desktop and opening the newgenlook website on a browser window every few minutes.
4) Restart your computer and delete the icons from your desktop.
4) Afterwards make sure that under Internet Options you place the newgenlook.com and antispy.newgenlook.com website on the restricted sites list so you are not rerouted there without your consent in the future. In fact, you should restrict any site that contains newgenlook just in case.

I was using the Microsoft AntiSpyware Beta at the time and it did not protect me. I used it to scan the computer afterwards and it could not find it. Neither did AdAware SE.
This newgenlook trojan I believe is called Troj/Warspy-G. Sophos antivirus does recognize it.

My first instinct was to go to Display Properties to change the wallpaper but seems like this trojan changes the look of Display Properties and the wallpaper option is gone. The solution I have read on this thread does fix it. I have read that there are other registry keys that this trojan creates or affects but after going through the process that I just told you, the computer seemed to be back to normal. I have rebooted 3 times since then and the trojan is still not coming back.

hi rherrera

any idea how we can do the same for wins 95?

Thanks!

**razif77** · April 25th, 2005, 09:49 AM

The spyware's gone..but the display tab and system restore still not function

**DeathClaw** · April 28th, 2005, 00:22 AM

I have the exact same problem (the blue screen with trojan message and the missing display property tabs). I ran multiple anti-virus and spyware softwares, and my system seems to be clean. However, the display properties still only has the Screensaver and Settings tabs. Anyone know how to fix it?

**DeathClaw** · April 28th, 2005, 00:29 AM

Wait! I just fixed the display properties problem!

Go to Run --> regedit

Then go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

Look for the entries NoDispAppearancePage and NoDispBackgroundPage. If they have 1 as their values, set them to 0.

**IrqScrfan** · July 12th, 2005, 05:14 AM

Originally Posted by DeathClaw

Wait! I just fixed the display properties problem!

Go to Run --> regedit

Then go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

Look for the entries NoDispAppearancePage and NoDispBackgroundPage. If they have 1 as their values, set them to 0.

Many thankssssssssssssssssss ...... truly great !