Wolfe

Hello, I'm using Windows Xp SP1 and I got the Trojan-Spy.HTML.Smitfraud.c virus. I think that I got it removed from my computer and I no longer have the blue error screen as my desktop wallpaper, but I can't set anything as my wallpaper, it just stays black. If I go to the Display Properties window, the only two options that I have are Screen Saver and Settings. There is no Desktop (Background), Apperance, or any other tabs. Can someone please help me.

Thanks,

Tim

Lax

Did you run a TrendMicro scan to be sure you got rid of everything? www.trendmicro.com search for House Call and let it do it's thing, see if it gets anything. If there is nothing then the vorus may have messed with some settings. It most likely has the same properties as http://securityresponse.symantec.com...tfraudoid.html so if you know your way around a registry you should be able to fix all that if Norton or whatever you used didn't do it.

__________________
He who controls the present controls the past.
He who controls the past, controls the future.

mgoldb2

Ok let see if I can remember how to do this

first go to control panel
secound display
then to desktop tab
then hit customize desktop
then hit the web tab
delete anything in this web tab.

I think this will fix it. I doing this from memory so I might be slightly off.

__________________
Acer A11912B 19"montior
Aspire x-superalien case
Asus k8t800 pro motherboard
athlon 64 fx-55
2GB(2 of 1GB) of Geil DDR ram
Geforce 6800 ultra
2 Seagate 200GB 7200RPM Model ST3200822A configure as RAID 0
1 DVDRW and 1 CDRW
3.5 drive
sound blaster audigey2 zs
logitech 2300 thx certified 2.1 speakers

Wolfe

Thanks, I ran house call but it did nothing. I followed the symantec instructions for editing my registry and I think I messed up. I did the following steps and I thought that I was suppose to delete the entire thing, but now I think I was only suppose to delete the numerical value "1" in each of the situations. I now have all of the tabs in my display properties, but I cannot change my desktop still. All of the windows default wallpapes are frozen as is the browes button. I tried setting a picture as the wallpaper by right clicking on it but there is still nothing. Any more help?

Navigate to the subkey:

HKEY_CURRENT_USER\Software\Micorsoft\Windows\Curre ntVersion\Policies\Explorer


In the right page, delete the value:

"NoActiveDesktopChanges" = "1"


Navigate to the subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System


In the right pane, delete the values, if they are not required:

"NoDispBackgroundPage" = "1"
"NoDispAppearancePage" = "1"

Wolfe

There is only

My Current Homepage

in the web tab and it wont allow me to delete it

kingyoun

have you use regedit.exe
maybe the virus have write a dword value in your regedit.
you can change HKEY_CURRENT_USER\Software\Microsoft\Currentversio n\policies
find the nochangewallpaper string then delete it.

__________________
This has been a great years moving towards digital lifestyle.the world going fast than we have expected.
now,i will study hardly and catch this chance to make future better.

Rebel PC Guru

Security warning A fatal error in IE has occured at 0028:C0011E36 in VXD VMM(01) + 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c.

is this the error?

Rebel PC Guru

if so try thisHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run


In the right pane, delete the value:

"WindowsFY" = "[program name]"


Navigate to and delete the subkey:

HKEY_CLASSES_ROOT\CLSID\{145E6FB1-1256-44ed-A336-8BBA43373BE6}


Navigate to the subkey:

HKEY_CURRENT_USER\Software\Micorsoft\Windows\Curre ntVersion\Policies\Explorer


In the right page, delete the value:

"NoActiveDesktopChanges" = "1"


Navigate to the subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System


In the right pane, delete the values, if they are not required:

"NoDispBackgroundPage" = "1"
"NoDispAppearancePage" = "1"

Praetor

Change it to 0

__________________
ASUS P5K Premium WiFi-AP, Q6600@3.7 / ASUS P5ND, E6400@3.8
4GB OCz Platinum XTC 8500 / 4GB CorsairXMS2 6400
5x500GB Seagate 7200.10 / 2x500 Seagate 7200.10
OCz 8800GTX 768MB @ 630/800 / 2x Galaxy 8800GT SLI

Byteman

Some of the others have already mentioned some of these keys, however, you will want to look at them all and see which ones apply to your hijack. I've see at least a couple different desktop hijacks in the past few weeks.

Navigate to the following key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\ActiveDesktop
Look for a DWORD value called "NoChangingWallPaper"
When located right click and delete it!

In HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer
you should NOT have the following VALUES, RIGHTCLICK AND DELETE THEM...

NoActiveDesktop
ForceActiveDesktopOn

And for the following ActiveDesktop KEY:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\ActiveDesktop
There should only be the (default) string here, right click and delete all of these entries. Remove everything but the (default) string. not the following:

NoComponents
NoAddingComponents
NoDeletingComponents
NoEditingComponents
NoHTMLWallpaper


If you still have problems, after this, we will have to start you from the beginning of this hijack removal.

__________________
Don't byte off more than you can chew...