Display Properties - Missing Tabs (Trojan-Spy.HTML.Smitfraud.c)

[rdkapp]

I recently cleared my computer of spyware related to PSGuard. Among other things, it put a Windows Blue Screen Security Warning tiled on my Desktop which stated the following:

A fatal error in IE has occured at 0028:C0011E36 in VXD VMM(01) + 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c

*System cannot function in normal mode. Please check your security settings.

*Scan your PC w/any available antivirus/spyware remover program to fix the problem.

When I opened Display Properties, there were only 3 tabs (Screen Saver, Effects, and Settings). The Background tab was missing, so I could not change my Desktop.

I went ahead and cleaned my computer of the spyware using SpSeHjfix.zip, CWShredder, and HiJackThis.

My computer is now spyware free, but my Desktop continues to show the Windows Blue Screen Security Warning tiled and the Display Properties is still missing the Background tab, as well as the Appearance and Web tabs. Can anyone help me take back my Desktop and restore the Display Properties tabs?

My computer is running Windows 98SE. If anyone can please help me, I'd certainly appreciate it.

 

[Bob Cerelli]

Try:

Start Regedit
Go to HKEY_Current_User / Software / Microsoft / Windows / CurrentVersion / Policies
Delete NoDispCPL. This disables the Display Control Panel

This is a good example where even though a virus or Trojan program may have been removed, not all of the damage or changes they make are fixed.

 

[rdkapp]

Thanks Bob, but before I do that, I want to make sure I understand what you mean by "disables the Display Control Panel." Am I disabling it so it can reload in full, with all tabs in place, or what? Please explain. I don't want to go changing something in the Registry without understanding what I'm doing. Thanks again.

 

[Elvandil]

Clear as mud, eh?

The presence of that entry in the registry will disable some aspects of the Display control. Removing it may return that functionality.

You can right-click on the key and export it before deleting in case you want later to undo any changes you made. This is good practice whenever altering the registry.

 

[Bob Cerelli]

If the NoDispCPL key is there, just delete it.

But in re-reading your post, you can get to the Display page, just not the Background page. If that is the case, delete NoDispBackgroundPage

 

[rdkapp]

Thanks Bob and Elvandil.

But in re-reading your post, you can get to the Display page, just not the Background page. If that is the case, delete NoDispBackgroundPage

Yes Bob, that is correct. The Background tab, the Appearance tab, and the Web tab were missing in Display Properties. As you instructed, I deleted NoDispBackgroundPage and the Background tab reappeared without even rebooting. The key was in:

HKEY_Current_User/Software/Microsoft/Windows/CurrentVersion/Policies/System

I also found NoDispAppearancePage in that folder and deleted it also, and the Appearance tab reappeared. Now, the only thing missing is the Web tab. There was nothing else in that folder and I didn't have time to poke around for "NoDispWebPage" or whatever? Any ideas?

 

[Bob Cerelli]

Glad those specific reg edit helped solve the problems.

I'm not sure how to get the Web tab back but hopefully that is not nearly as critical (unless you want to display web pages on your background). Most folks don't care to do this.

 

[rdkapp]

Glad those specific reg edit helped solve the problems.

I'm not sure how to get the Web tab back but hopefully that is not nearly as critical (unless you want to display web pages on your background). Most folks don't care to do this.

You're right Bob. I've never used the Web tab. I'm not even sure what you can do on that tab. But it was a challenge to put my computer back the way it was before the spyware. And I found it.

The value is NoActiveDesktopChanges and I found it in the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

I deleted it and the Web tab reappeared. It's great when you can figure things out on your own. I feel like I one-upped the creator of the virus/spyware that infected my computer.

Thanks again Bob and Elvandil.
By the way, Elvandil, I like your avatar.

 

[Elvandil]

Thanks for the followup and congratulations on finding the solution.

 

[Bob Cerelli]

Glad the instructions were clearer than mud and helped you solve all your problems ;-) As you see, registry edits are not that hard to do or figure out.

 

[Elvandil]

It's too bad you didn't get help from the posters, but you at least had the initiative to find the solution without help. Good luck to you.

 

[Bob Cerelli]

Yes Bob, that is correct. The Background tab, the Appearance tab, and the Web tab were missing in Display Properties. As you instructed, I deleted NoDispBackgroundPage and the Background tab reappeared without even rebooting. The key was in:

HKEY_Current_User/Software/Microsoft/Windows/CurrentVersion/Policies/System

I also found NoDispAppearancePage in that folder and deleted it also, and the Appearance tab reappeared

 

[Elvandil]

My sincere apologies. The only one I noticed was : NoDispCPL.

You are correct and you did find the solution.

 

[rdkapp]

Bob certainly helped me with the missing Background tab, but I found the solutions for the missing Appearance tab and Web tab.

By my count, that's 2/3 me and 1/3 Bob.

But who's counting?

Truthfully though, I would not have found my 2 solutions w/out Bob's initial direction.

Thanks again guys.

 

[Elvandil]

For future reference, you can access these entries and other security-related settings in comfort with this "Security Console". It was intended to give some control over these things to Home Edition users without their having to access the registry (since they don't have the Group Policy Editor) and take those risks. But it is also a convenient quick tool for Pro users:

http://www.dougknox.com/xp/utils/xp_securityconsole.htm

You'll find that this program places or removes those entries that you have been dealing with, and many more, all from one central location. And, since it can be run from a floppy, you can make these security settings to a machine and protect it from others when you are away. Much easier than the old-fashioned way .

OK. So it's 2/3 for you.