Solved: cant change wallpaper??

[ERASERHEAD]

hello everyone, after an attack with some bad viruses or something, i noticed my option to change my wallpaper has disappeared?? and im so sick of the wallpaper i have right now... i dont know how it was disabled, just noticed it was gone, any help would be appreciated

 

[Fidelista]

Hello Eraserhead. I have no answer to your question, but can tell you, you are not alone with this problem. I believe your system is infected and it is not a question of settings.
Last week I seen a PC that was infected with the Smitfraud virus {blue screen warning} and another virus {I cant remember which one}.
Now it displays black screen and no option for desktop wallpaper--exactly like yours.
Be patient and help will come. I am very interested in this particular problem. Best of luck >f

 

[ERASERHEAD]

yeah i get a screen at startup where i have to click ok, but the message displayed looks like this %^#@#$ and i click ok, it boots up...

 

[mrdw3]

Sounds very similar to the problem I had.... and it was caused by a Trojan

I'd search for problems on "Desktop Hijacked" or "Screen saver hijacked"

I'd also suggest getting Ewido and running a full scan

 

[EvileYe]

Try the reg fix from here http://www.kellys-korner-xp.com/xp_tweaks.htm

Scroll down to Line 187 and download and run the Restore Themes Functionality reg fix.

To use the Regedits: Save the REG File to your hard disk. Double click it and answer yes to the import prompt. REG files can be viewed in Notepad by right clicking on the file and selecting Edit

 

[cybertech]

ERASERHEAD,
You should post a log for us to review.
Click on this link: http://www.thespykiller.co.uk/files/HJTsetup.exe Double click on the file and it will install to C:\program files\hijackthis and create an entry in the start menu and an optional shortcut on desktop.

Close out any open browsers and launch the program.
Click on "Do a system scan and save a logfile.
The log will open in Notepad
Go to Edit,Select All, Edit, Copy
Come back to this thread
And press Ctrl+V to paste the log into the thread.

 

[ERASERHEAD]

well, the kellys-corner fix brought back the option but its not functioning

see what i mean?


well anyways thanks for the link to that fix!!



heres the log for ya'll:

Logfile of HijackThis v1.99.1
Scan saved at 9:50:28 PM, on 6/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\AIM\AIM95_c0\aim.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\AIM95_c0\aim.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: F-Secure Anti-Virus 2005 (BackWeb Plug-in - 4476822) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Qecsot - Sonic Solutions - (no file)
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

 

[EvileYe]

I don't see anything in your log that would cause this problem.

Have "Hijack This" fix this line
O23 - Service: Qecsot - Sonic Solutions - (no file)


You can also scroll down to Line 282 and apply the fix to get your appearance tab back. The fix on Line 285 will restore all of the tabs.

http://www.kellys-korner-xp.com/xp_tweaks.htm

Apply the fix above and let us know how it goes.

 

[EvileYe]

It may also be worth running an Online virus Scan Here http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

This will take a while to run.

If you have your XP Install Disk, you could try running the sfc /scannow command from the run box.

Click Start/Run and type sfc /scannow and hit enter, this will launch the System File Checking utility, which will scan for corrupted or missing system files.

Note the space after sfc !!!

 

[ERASERHEAD]

well, the 2 kellys corner fixes worked, but now my interface is old style, win98, know what i mean? the start bar and similar are all grey and ugly, i want my XP style back haha what do i do now? because im locked out of changing it to XP style for some reason

 

[EvileYe]

Ok one more to try, Go to line 187 on the link I posted above and apply the Restore Luna Theme fix.

 

[bradly]

Eraserhead, see this thread:

http://forums.techguy.org/showthread.php?p=2732794

 

[cybertech]

Click here save this file to your desktop.

Double-click the smitfraud.reg file on your desktop. When asks if you want to merge with the registry, click YES button. Wait for the "merged successfully" prompt.

 

[ERASERHEAD]

hey everyone, problem solved, thank you so much




i'll try to recap it for another person who may have the SAME problem i had, in steps :

==================================
to get the tab back i did this:
==================================

http://www.kellys-korner-xp.com/xp_tweaks.htm

Scroll down to Line 187 and download and run the Restore Themes Functionality reg fix.

scroll down to Line 282 and apply the fix to get your appearance tab back. The fix on Line 285 will restore all of the tabs.



To use the Regedits: Save the REG File to your hard disk.
Double click it and answer yes to the import prompt.
REG files can be viewed in Notepad by right clicking
on the file and selecting Edit


========
REBOOTED
========


=================================================================
the windows interface was Win98 style so i needed to fix that:
=================================================================

Go to line 187 on the link http://www.kellys-korner-xp.com/xp_tweaks.htm and apply the Restore Luna Theme fix.


the zip goes here: C:/WINDOWS/Resources

-replace the folder with the new one
-go to display in control panel and change it from classic to XP

GOOD GOOD!!

 

[cybertech]

OK!!! Great!

Create a new System Restore point.

Good free tools and advice on how to tighten your security settings.

Security Help Tools