spywad

[Dustin Cook]

CindyLouWhooo <faux@none_gone.com> wrote in
news:mn.b17d7d781d846784.70004@nonegone.com:

>> CindyLouWhooo <faux@notreal_gone.com> wrote in
>> news:mn.94e27d78c0eb66e7.70218@notrealgone.com:
>>
>>> thanks for being here. I am beaten down and near brainless.
>>>
>>> About four months ago, my desktop tab disappeared.
>>> I have been going from forum to forum trying to find the answer in
>>> registry settings.
>>>
>>> Weekly in safe mode I run:
>>> my antivirus Avira
>>> have added AVG
>>>
>>> Spybot
>>> Bughunter
>>> Smitfraud fix
>>> Arovax
>>> Lavasoft Adaware
>>>
>>> and two online trojan-antivir-keylogger,etc.scans.
>>>
>>> Arovax tells me spywad each week and points to user and machine:
>>> Software-Microsoft-Windows-Curr.Version-Policies........I have done
>>> a complete restore of said machine, without change. I have been to
>>> KellysKorner, and a multitude of honorable forums trying to find the
>>> answer.
>>>
>>> My house burned down and my church gave me this machine. I feel the
>>> hurdles I have jumped in fine tuning have been great, except for
>>> this.
>>>
>>> Can you point me in the direction of what settings I need to change
>>> in user and machine policies to make my desktop tab come back? This
>>> has been my life's quest the past few months, and boy am I really
>>> tired.....
>>>
>>>
>>>
>>
>> Hi There. I'm late in this. You said your desktop tab was missing
>> right? Lets see what could be doing that... It's likely a policy key
>>
>> http://www.kellys-korner-xp.com/regs...isplaytabs.reg
>>
>> If you have trouble with the url, please copy/paste the lines between
>> **** below
>>
>> *****
>> Windows Registry Editor Version 5.00
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\
>> Exp lorer] "NoActiveDesktopChanges"=hex:00,00,00,00
>> "NoActiveDesktop"=dword:00000000
>> "NoSaveSettings"=dword:00000000
>> "ClassicShell"=dword:00000000
>> "NoThemesTab"=dword:00000000
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\
>> Sys tem] "NoDispAppearancePage"=dword:00000000
>> "NoColorChoice"=dword:00000000
>> "NoSizeChoice"=dword:00000000
>> "NoDispBackgroundPage"=dword:00000000
>> "NoDispScrSavPage"=dword:00000000
>> "NoDispCPL"=dword:00000000
>> "NoVisualStyleChoice"=dword:00000000
>> "NoDispSettingsPage"=dword:00000000
>> "NoDispScrSavPage"=dword:00000000
>> "NoVisualStyleChoice"=dword:00000000
>> "NoSizeChoice"=dword:00000000
>> "SetVisualStyle"=-
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\
>> Act iveDesktop] "NoChangingWallPaper"=dword:00000000
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\ThemeMana
>> ger
>> ] "ThemeActive"="1"
>> "DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65, 00,6d,00,52,00,6f,00
>> ,6f ,00,\
>> 74,00,25,00,5c,00,72,00,65,00,73,00,6f,00,75,00,72 ,00,63,00,65,00,73
>> ,00 ,5c,\
>> 00,54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,6c,00 ,75,00,6e,00,61,00
>> ,5c ,00,\
>> 6c,00,75,00,6e,00,61,00,2e,00,6d,00,73,00,73,00,74 ,00,79,00,6c,00,65
>> ,00 ,73,\ 00,00,00
>>
>> ****
>>
>>
>> This *should* fix your issue for you. copy/paste the contents to
>> notepad and save it as "fixme.reg" then double click, regedit will
>> ask if its okay to import, say yes. and post back your results.
>
>
> nothing changed, thank you for trying.
>
>
>

Ouch. Okay, so is it the desktop tab missing when you right click and hit
properties, or are we going in the wrong direction?


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[Dustin Cook]

CindyLouWhooo <faux@none_gone.com> wrote in
news:mn.b17d7d781d846784.70004@nonegone.com:

>> CindyLouWhooo <faux@notreal_gone.com> wrote in
>> news:mn.94e27d78c0eb66e7.70218@notrealgone.com:
>>
>>> thanks for being here. I am beaten down and near brainless.
>>>
>>> About four months ago, my desktop tab disappeared.
>>> I have been going from forum to forum trying to find the answer in
>>> registry settings.
>>>
>>> Weekly in safe mode I run:
>>> my antivirus Avira
>>> have added AVG
>>>
>>> Spybot
>>> Bughunter
>>> Smitfraud fix
>>> Arovax
>>> Lavasoft Adaware
>>>
>>> and two online trojan-antivir-keylogger,etc.scans.
>>>
>>> Arovax tells me spywad each week and points to user and machine:
>>> Software-Microsoft-Windows-Curr.Version-Policies........I have done
>>> a complete restore of said machine, without change. I have been to
>>> KellysKorner, and a multitude of honorable forums trying to find the
>>> answer.
>>>
>>> My house burned down and my church gave me this machine. I feel the
>>> hurdles I have jumped in fine tuning have been great, except for
>>> this.
>>>
>>> Can you point me in the direction of what settings I need to change
>>> in user and machine policies to make my desktop tab come back? This
>>> has been my life's quest the past few months, and boy am I really
>>> tired.....
>>>
>>>
>>>
>>
>> Hi There. I'm late in this. You said your desktop tab was missing
>> right? Lets see what could be doing that... It's likely a policy key
>>
>> http://www.kellys-korner-xp.com/regs...isplaytabs.reg
>>
>> If you have trouble with the url, please copy/paste the lines between
>> **** below
>>
>> *****
>> Windows Registry Editor Version 5.00
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\
>> Exp lorer] "NoActiveDesktopChanges"=hex:00,00,00,00
>> "NoActiveDesktop"=dword:00000000
>> "NoSaveSettings"=dword:00000000
>> "ClassicShell"=dword:00000000
>> "NoThemesTab"=dword:00000000
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\
>> Sys tem] "NoDispAppearancePage"=dword:00000000
>> "NoColorChoice"=dword:00000000
>> "NoSizeChoice"=dword:00000000
>> "NoDispBackgroundPage"=dword:00000000
>> "NoDispScrSavPage"=dword:00000000
>> "NoDispCPL"=dword:00000000
>> "NoVisualStyleChoice"=dword:00000000
>> "NoDispSettingsPage"=dword:00000000
>> "NoDispScrSavPage"=dword:00000000
>> "NoVisualStyleChoice"=dword:00000000
>> "NoSizeChoice"=dword:00000000
>> "SetVisualStyle"=-
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\
>> Act iveDesktop] "NoChangingWallPaper"=dword:00000000
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\ThemeMana
>> ger
>> ] "ThemeActive"="1"
>> "DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65, 00,6d,00,52,00,6f,00
>> ,6f ,00,\
>> 74,00,25,00,5c,00,72,00,65,00,73,00,6f,00,75,00,72 ,00,63,00,65,00,73
>> ,00 ,5c,\
>> 00,54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,6c,00 ,75,00,6e,00,61,00
>> ,5c ,00,\
>> 6c,00,75,00,6e,00,61,00,2e,00,6d,00,73,00,73,00,74 ,00,79,00,6c,00,65
>> ,00 ,73,\ 00,00,00
>>
>> ****
>>
>>
>> This *should* fix your issue for you. copy/paste the contents to
>> notepad and save it as "fixme.reg" then double click, regedit will
>> ask if its okay to import, say yes. and post back your results.
>
>
> nothing changed, thank you for trying.
>
>
>

I do have one suggestion:
http://wiki.djlizard.net/Dial-a-fix

Give this util a shot.
Ask it to scan for policies and show you any found.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[jen]

"CindyLouWhooo" <faux@none_gone.com> wrote in message
news:mn.b1b57d781b5dbf29.70004@nonegone.com...
>> "CindyLouWhooo" <faux@notreal_gone.com> wrote in message
>> news:mn.ab447d7861a6be2f.70218@notrealgone.com...
>>>> "Default User" <default@user1.invalid> wrote in message
>>>> news:7g6mc3dl2h6hc4so8gbq6v0pgbspfmmjud@4ax.com...
>>>>> On Tue, 21 Aug 2007 16:02:45 GMT, CindyLouWhooo
>>>>> <faux@none_gone.com> wrote:
>>>>>>Can you point me in the direction of what settings I need to
>>>>>>change in
>>>>>>user and machine policies to make my desktop tab come back? This
>>>>>>has
>>>>>>been my life's quest the past few months, and boy am I really
>>>>>>tired.....
>>>>> See if this helps: http://www.jsifaq.com/SF/Tips/Tip.aspx?id=10716
>>>> OP has XP Home. *No* Group Policy settings are available in XP
>>>> Home...
>>> yes they are.....
>>> just hop on over to
>>> http://www.j79zlr.com/gphome.php
>>> works great on everything, except this one persistent problem.
>> Assuming you have cleaned your "Spywad"(if you ever had it)
>> infestation thoroughly(which I doubt), see here:
>> Desktop Fixes, For iGuard & Spywad pests, After the infection is
>> cleaned:
>> http://forums.maddoktor2.com/index.php?showtopic=3924
>> You *need* to submit a "HijackThis" log to a competent forum(NOT
>> here - Usenet is NOT the place for it). You have probably tried so
>> much off-the-wall crap, your system is *thoroughly* screwed... If
>> you don't want to do this, then you need to flatten your system. Did
>> you receive this box in this condition, or was "Spywad" supposedly
>> contracted by you?
> thanks jen
[snip continual repeats of prior insufficient info ad nauseum]
> they had looked at the HJL and said to restore it, which (above) I had
> followed thru with.

Who did? Where? Post a link to the log... What do you mean by
restore? An oem "restore cd"? Please tell us exactly how you
"restored". Trying to help you is like pulling eye teeth, SHEESH! No
wonder you were sent here from elsewhere...

> I don't know where you think I had tried "so much off the wall krap",
> we'll just leave that to the previous owner, which I (above) had done
> an exc job cleaning all that out, with the exception of this.

re: "so much off the wall krap(sic)". From your previous posts its
evident you have tried various and sundry reg hacks with insufficient
knowledge of the registry, most likely disastrous to your(XPHome)
system's health...

> Maybe you try all the off the wall krap but I sure don't....
> thanks

Sure looks as if you do

-jen

[CindyLouWhooo]

> CindyLouWhooo <faux@none_gone.com> wrote in
> news:mn.b17d7d781d846784.70004@nonegone.com:
>
>>> CindyLouWhooo <faux@notreal_gone.com> wrote in
>>> news:mn.94e27d78c0eb66e7.70218@notrealgone.com:
>>>
>>>> thanks for being here. I am beaten down and near brainless.
>>>>
>>>> About four months ago, my desktop tab disappeared.
>>>> I have been going from forum to forum trying to find the answer in
>>>> registry settings.
>>>>
>>>> Weekly in safe mode I run:
>>>> my antivirus Avira
>>>> have added AVG
>>>>
>>>> Spybot
>>>> Bughunter
>>>> Smitfraud fix
>>>> Arovax
>>>> Lavasoft Adaware
>>>>
>>>> and two online trojan-antivir-keylogger,etc.scans.
>>>>
>>>> Arovax tells me spywad each week and points to user and machine:
>>>> Software-Microsoft-Windows-Curr.Version-Policies........I have done
>>>> a complete restore of said machine, without change. I have been to
>>>> KellysKorner, and a multitude of honorable forums trying to find the
>>>> answer.
>>>>
>>>> My house burned down and my church gave me this machine. I feel the
>>>> hurdles I have jumped in fine tuning have been great, except for
>>>> this.
>>>>
>>>> Can you point me in the direction of what settings I need to change
>>>> in user and machine policies to make my desktop tab come back? This
>>>> has been my life's quest the past few months, and boy am I really
>>>> tired.....
>>>>
>>>>
>>>>
>>>
>>> Hi There. I'm late in this. You said your desktop tab was missing
>>> right? Lets see what could be doing that... It's likely a policy key
>>>
>>> http://www.kellys-korner-xp.com/regs...isplaytabs.reg
>>>
>>> If you have trouble with the url, please copy/paste the lines between
>>> **** below
>>>
>>> *****
>>> Windows Registry Editor Version 5.00
>>>
>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\
>>> Exp lorer] "NoActiveDesktopChanges"=hex:00,00,00,00
>>> "NoActiveDesktop"=dword:00000000
>>> "NoSaveSettings"=dword:00000000
>>> "ClassicShell"=dword:00000000
>>> "NoThemesTab"=dword:00000000
>>>
>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\
>>> Sys tem] "NoDispAppearancePage"=dword:00000000
>>> "NoColorChoice"=dword:00000000
>>> "NoSizeChoice"=dword:00000000
>>> "NoDispBackgroundPage"=dword:00000000
>>> "NoDispScrSavPage"=dword:00000000
>>> "NoDispCPL"=dword:00000000
>>> "NoVisualStyleChoice"=dword:00000000
>>> "NoDispSettingsPage"=dword:00000000
>>> "NoDispScrSavPage"=dword:00000000
>>> "NoVisualStyleChoice"=dword:00000000
>>> "NoSizeChoice"=dword:00000000
>>> "SetVisualStyle"=-
>>>
>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\
>>> Act iveDesktop] "NoChangingWallPaper"=dword:00000000
>>>
>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\ThemeMana
>>> ger
>>> ] "ThemeActive"="1"
>>> "DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65, 00,6d,00,52,00,6f,00
>>> ,6f ,00,\
>>> 74,00,25,00,5c,00,72,00,65,00,73,00,6f,00,75,00,72 ,00,63,00,65,00,73
>>> ,00 ,5c,\
>>> 00,54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,6c,00 ,75,00,6e,00,61,00
>>> ,5c ,00,\
>>> 6c,00,75,00,6e,00,61,00,2e,00,6d,00,73,00,73,00,74 ,00,79,00,6c,00,65
>>> ,00 ,73,\ 00,00,00
>>>
>>> ****
>>>
>>>
>>> This *should* fix your issue for you. copy/paste the contents to
>>> notepad and save it as "fixme.reg" then double click, regedit will
>>> ask if its okay to import, say yes. and post back your results.
>>
>>
>> nothing changed, thank you for trying.
>>
>>
>>
>
> Ouch. Okay, so is it the desktop tab missing when you right click and hit
> properties, or are we going in the wrong direction?

yes that is the tab and much thanks

[David H. Lipman]

From: "CindyLouWhooo" <faux@none_gone.com>


|
| ================================================== ====================
| thanks again for plugging thru this with me!
|
| user:
| http://img3.freeimagehosting.net/uploads/1ffadd0f85.png
|
| machine for the heck of it)....notice it is a little p......couldn't
| find anything on it, if it is unusual or not.
|
| http://img3.freeimagehosting.net/ima...7dcbcb3fe0.png
|

Setting a Reg. policy to 0 (zero) has the same effect as if that key does not exist.
Therefore it means those policies are NOT enabled.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Dustin Cook]

Leythos <void@nowhere.lan> wrote in news:MPG.2136116b31514121989854
@adfree.Usenet.com:

> In article <mn.b1b57d781b5dbf29.70004@nonegone.com>, faux@none_gone.com
> says...
>> Arovax tells me spywad each week and points to user and machine:
>> Software-Microsoft-Windows-Curr.Version-Policies........I have done a
>> complete restore of said machine, without change. I have been to
>> KellysKorner, and a multitude of honorable forums trying to find the
>> answer.
>
> That can't be correct - if you had done a complete restore from clean
> media you would not have these problems you describe.
>
> It's time to actually do a wipe/reinstall, where you actually format

I still, respectfully, disagree with this. I would prefer to explore the
policy key settings more thoroughly before deciding the machine needs to
be reloaded to restore a tab. It still seems, at this point in time, alot
of work when it could be fixed easier. It would be alot easier if the
person had vnc, or if the machine was here... lol. As it is, we have to
wait for the poster to reply and *hope* they did as we asked, properly.

It may not be worth the time over usenet to try and resolve this, but I'd
like to give it a few more tries before we hose the box, personal data,
personal settings, documents, mp3s and everything else the owner might
have present.




--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[Dustin Cook]

Default User <default@user1.invalid> wrote in
news:g7moc317jp1uddu9uk817f3qmlnjrn8a5e@4ax.com:

> On Wed, 22 Aug 2007 10:58:53 -0400, Leythos <void@nowhere.lan> wrote:
>
>>In article <mn.b1b57d781b5dbf29.70004@nonegone.com>,
>>faux@none_gone.com says...
>>> Arovax tells me spywad each week and points to user and machine:
>>> Software-Microsoft-Windows-Curr.Version-Policies........I have done
>>> a complete restore of said machine, without change. I have been to
>>> KellysKorner, and a multitude of honorable forums trying to find the
>>> answer.
>>
>>That can't be correct - if you had done a complete restore from clean
>>media you would not have these problems you describe.
>>
>>It's time to actually do a wipe/reinstall, where you actually format
>>the drive and erase all data/files - this, provided you get a clean
>>set of install CD's, will give you a working machine that doesn't
>>contain malware.
>>
>>After that, before you connect to the internet, you need a working
>>firewall to allow you to connect without being compromised while
>>getting updates and patches....
>>
>>If you have the XP cd you could also try a repair/reinstall of XP, but
>>you could easily re-compromise your system.
>>
>>http://www.michaelstevenstech.com/XPrepairinstall.htm
>
> I agree with Leythos - time to cut your losses by completely wiping
> and reloading your system. I always recommend that when reinstalling
> your system due to a malware installation, that you go take extra step
> of nuking the entire disk. The reason being that malware can remain
> on a disk after a "format" if the format does not actually write to
> the sectors where the malware resides. Use "Boot 'n Nuke" and run

Back in the days of DOS, I'd agree. These days, your wasting time and
putting unnecesary wear/tear on the hard disk to do a sector wipe, when
it's not required. If the code has no execution point, it's useless; and
harmless. Partial malware left over on some sectors with nothing pointing
to them is dead in the water, ready and waiting to be overwritten.

And I still don't think the user should go for wiping the machine just
yet. XP Home and XP pro can both have group policy keys set, you just
don't get direct access via the controls in home, but it also does have
group keys.



--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[Dustin Cook]

CindyLouWhooo <faux@none_gone.com> wrote in
news:mn.b2d97d781a705479.70004@nonegone.com:

>> CindyLouWhooo <faux@none_gone.com> wrote in
>> news:mn.b17d7d781d846784.70004@nonegone.com:
>>
>>>> CindyLouWhooo <faux@notreal_gone.com> wrote in
>>>> news:mn.94e27d78c0eb66e7.70218@notrealgone.com:
>>>>
>>>>> thanks for being here. I am beaten down and near brainless.
>>>>>
>>>>> About four months ago, my desktop tab disappeared.
>>>>> I have been going from forum to forum trying to find the answer in
>>>>> registry settings.
>>>>>
>>>>> Weekly in safe mode I run:
>>>>> my antivirus Avira
>>>>> have added AVG
>>>>>
>>>>> Spybot
>>>>> Bughunter
>>>>> Smitfraud fix
>>>>> Arovax
>>>>> Lavasoft Adaware
>>>>>
>>>>> and two online trojan-antivir-keylogger,etc.scans.
>>>>>
>>>>> Arovax tells me spywad each week and points to user and machine:
>>>>> Software-Microsoft-Windows-Curr.Version-Policies........I have
>>>>> done a complete restore of said machine, without change. I have
>>>>> been to KellysKorner, and a multitude of honorable forums trying
>>>>> to find the answer.
>>>>>
>>>>> My house burned down and my church gave me this machine. I feel
>>>>> the hurdles I have jumped in fine tuning have been great, except
>>>>> for this.
>>>>>
>>>>> Can you point me in the direction of what settings I need to
>>>>> change in user and machine policies to make my desktop tab come
>>>>> back? This has been my life's quest the past few months, and boy
>>>>> am I really tired.....
>>>>>
>>>>>
>>>>>
>>>>
>>>> Hi There. I'm late in this. You said your desktop tab was missing
>>>> right? Lets see what could be doing that... It's likely a policy
>>>> key
>>>>
>>>> http://www.kellys-korner-xp.com/regs...isplaytabs.reg
>>>>
>>>> If you have trouble with the url, please copy/paste the lines
>>>> between **** below
>>>>
>>>> *****
>>>> Windows Registry Editor Version 5.00
>>>>
>>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policie
>>>> s\ Exp lorer] "NoActiveDesktopChanges"=hex:00,00,00,00
>>>> "NoActiveDesktop"=dword:00000000
>>>> "NoSaveSettings"=dword:00000000
>>>> "ClassicShell"=dword:00000000
>>>> "NoThemesTab"=dword:00000000
>>>>
>>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policie
>>>> s\ Sys tem] "NoDispAppearancePage"=dword:00000000
>>>> "NoColorChoice"=dword:00000000
>>>> "NoSizeChoice"=dword:00000000
>>>> "NoDispBackgroundPage"=dword:00000000
>>>> "NoDispScrSavPage"=dword:00000000
>>>> "NoDispCPL"=dword:00000000
>>>> "NoVisualStyleChoice"=dword:00000000
>>>> "NoDispSettingsPage"=dword:00000000
>>>> "NoDispScrSavPage"=dword:00000000
>>>> "NoVisualStyleChoice"=dword:00000000
>>>> "NoSizeChoice"=dword:00000000
>>>> "SetVisualStyle"=-
>>>>
>>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policie
>>>> s\ Act iveDesktop] "NoChangingWallPaper"=dword:00000000
>>>>
>>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\ThemeMa
>>>> na ger
>>>> ] "ThemeActive"="1"
>>>> "DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65, 00,6d,00,52,00,6f,
>>>> 00 ,6f ,00,\
>>>> 74,00,25,00,5c,00,72,00,65,00,73,00,6f,00,75,00,72 ,00,63,00,65,00,
>>>> 73 ,00 ,5c,\
>>>> 00,54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,6c,00 ,75,00,6e,00,61,
>>>> 00 ,5c ,00,\
>>>> 6c,00,75,00,6e,00,61,00,2e,00,6d,00,73,00,73,00,74 ,00,79,00,6c,00,
>>>> 65 ,00 ,73,\ 00,00,00
>>>>
>>>> ****
>>>>
>>>>
>>>> This *should* fix your issue for you. copy/paste the contents to
>>>> notepad and save it as "fixme.reg" then double click, regedit will
>>>> ask if its okay to import, say yes. and post back your results.
>>>
>>>
>>> nothing changed, thank you for trying.
>>>
>>>
>>>
>>
>> Ouch. Okay, so is it the desktop tab missing when you right click and
>> hit properties, or are we going in the wrong direction?
>
> yes that is the tab and much thanks
>
>
>

Alright. That helps. Here's what I would like to do next, to be sure
it's a policy issue and not something else. I'd like for you to goto
control panel, users, and add another account, set it up as an
administrator. Logoff the account your using, and login to this newly
created one. Right click, hit properties, and tell me if a display tab is
available.


If its a per user policy key it may not be inherited on the new account.
If it's a group policy key, it will be.

I'd also like for you to run Dial a fix, I provided the url previously,
and allow it do do it's thing. Scan for policies, and remove any/all
found ones.

Please report back your results.


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[Dustin Cook]

CindyLouWhooo <faux@none_gone.com> wrote in
news:mn.b1b57d781b5dbf29.70004@nonegone.com:

>> "CindyLouWhooo" <faux@notreal_gone.com> wrote in message
>> news:mn.ab447d7861a6be2f.70218@notrealgone.com...
>>>> "Default User" <default@user1.invalid> wrote in message
>>>> news:7g6mc3dl2h6hc4so8gbq6v0pgbspfmmjud@4ax.com...
>>>>> On Tue, 21 Aug 2007 16:02:45 GMT, CindyLouWhooo
>>>>> <faux@none_gone.com> wrote:
>>>>>>Can you point me in the direction of what settings I need to
>>>>>>change in user and machine policies to make my desktop tab come
>>>>>>back? This has been my life's quest the past few months, and boy
>>>>>>am I really tired.....
>>>>> See if this helps: http://www.jsifaq.com/SF/Tips/Tip.aspx?id=10716
>>>> OP has XP Home. *No* Group Policy settings are available in XP
>>>> Home...
>>> yes they are.....
>>> just hop on over to
>>> http://www.j79zlr.com/gphome.php
>>> works great on everything, except this one persistent problem.
>>
>> Assuming you have cleaned your "Spywad"(if you ever had it)
>> infestation thoroughly(which I doubt), see here:
>> Desktop Fixes, For iGuard & Spywad pests, After the infection is
>> cleaned: http://forums.maddoktor2.com/index.php?showtopic=3924
>> You *need* to submit a "HijackThis" log to a competent forum(NOT here
>> - Usenet is NOT the place for it). You have probably tried so much
>> off-the-wall crap, your system is *thoroughly* screwed... If you
>> don't want to do this, then you need to flatten your system. Did you
>> receive this box in this condition, or was "Spywad" supposedly
>> contracted by you?
>>
>> -jen
>
> thanks jen
>
> original post clip:
> </clip>
> Arovax tells me spywad each week and points to user and machine:
> Software-Microsoft-Windows-Curr.Version-Policies........I have done a
> complete restore of said machine, without change. I have been to
> KellysKorner, and a multitude of honorable forums trying to find the
> answer.
>
> My house burned down and my church gave me this machine. I feel the
> hurdles I have jumped in fine tuning have been great, except for this.
> </clip>
>
> they had looked at the HJL and said to restore it, which (above) I had
> followed thru with.

f you want to prevent color background or color scheme changes via the
Control Panel, you can hide Control Panel / Display / Appearance Tab with
the following Windows NT Registry hack:

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies \System
Name: NoDispAppearancePage
Type: REG_DWORD
Value: 1

f you want to prevent background pattern or wallpaper changes via the
Control Panel, hide the Control Panel / Display / Background tab:

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies \System
Name: NoDispBackgroundPage
Type: REG_DWORD
Value: 1

If you want to prevent screen saver changes via the Control Panel, hide
the Control Panel / Display / Screen Saver tab:

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies \System
Name: NoDispScrSavPage
Type: REG_DWORD
Value: 1

If you want to prevent color palette, desktop area (resolution), font
size, or screen fresh frequency changes via the Control Panel, hide the
Control Panel / Display / Settings tab:

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies \System
Name: NoDispSettingsPage
Type: REG_DWORD
Value: 1


To hide the Control Panel / Display Icon:

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies \System
Name: NoDispCPL
Type: REG_DWORD
Value: 1

I know from looking at your png files that you've done this one. That's
great. However, it looks like you have alot of policy keys setup. Check
thru the list and make sure if you have any of those, they are ALL set to
0 - which is the same as the key not being present.


Finally, make sure you have a file called DESK.CPL present in your
C:\WINDOWS\SYSTEM32 folder. If you do not, no display tab.

So check these things and post back! We'll go from there.

--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - v2.2c
email: bughunter.dustin@gmail.com.removethis
web..: http://bughunter.it-mate.co.uk
Pad..: http://bughunter.it-mate.co.uk/pad.xml

[CindyLouWhooo]

> CindyLouWhooo <faux@none_gone.com> wrote in
> news:mn.b2d97d781a705479.70004@nonegone.com:
>
>>> CindyLouWhooo <faux@none_gone.com> wrote in
>>> news:mn.b17d7d781d846784.70004@nonegone.com:
>>>
>>>>> CindyLouWhooo <faux@notreal_gone.com> wrote in
>>>>> news:mn.94e27d78c0eb66e7.70218@notrealgone.com:
>>>>>
>>>>>> thanks for being here. I am beaten down and near brainless.
>>>>>>
>>>>>> About four months ago, my desktop tab disappeared.
>>>>>> I have been going from forum to forum trying to find the answer in
>>>>>> registry settings.
>>>>>>
>>>>>> Weekly in safe mode I run:
>>>>>> my antivirus Avira
>>>>>> have added AVG
>>>>>>
>>>>>> Spybot
>>>>>> Bughunter
>>>>>> Smitfraud fix
>>>>>> Arovax
>>>>>> Lavasoft Adaware
>>>>>>
>>>>>> and two online trojan-antivir-keylogger,etc.scans.
>>>>>>
>>>>>> Arovax tells me spywad each week and points to user and machine:
>>>>>> Software-Microsoft-Windows-Curr.Version-Policies........I have
>>>>>> done a complete restore of said machine, without change. I have
>>>>>> been to KellysKorner, and a multitude of honorable forums trying
>>>>>> to find the answer.
>>>>>>
>>>>>> My house burned down and my church gave me this machine. I feel
>>>>>> the hurdles I have jumped in fine tuning have been great, except
>>>>>> for this.
>>>>>>
>>>>>> Can you point me in the direction of what settings I need to
>>>>>> change in user and machine policies to make my desktop tab come
>>>>>> back? This has been my life's quest the past few months, and boy
>>>>>> am I really tired.....
>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>>> Hi There. I'm late in this. You said your desktop tab was missing
>>>>> right? Lets see what could be doing that... It's likely a policy
>>>>> key
>>>>>
>>>>> http://www.kellys-korner-xp.com/regs...isplaytabs.reg
>>>>>
>>>>> If you have trouble with the url, please copy/paste the lines
>>>>> between **** below
>>>>>
>>>>> *****
>>>>> Windows Registry Editor Version 5.00
>>>>>
>>>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policie
>>>>> s\ Exp lorer] "NoActiveDesktopChanges"=hex:00,00,00,00
>>>>> "NoActiveDesktop"=dword:00000000
>>>>> "NoSaveSettings"=dword:00000000
>>>>> "ClassicShell"=dword:00000000
>>>>> "NoThemesTab"=dword:00000000
>>>>>
>>>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policie
>>>>> s\ Sys tem] "NoDispAppearancePage"=dword:00000000
>>>>> "NoColorChoice"=dword:00000000
>>>>> "NoSizeChoice"=dword:00000000
>>>>> "NoDispBackgroundPage"=dword:00000000
>>>>> "NoDispScrSavPage"=dword:00000000
>>>>> "NoDispCPL"=dword:00000000
>>>>> "NoVisualStyleChoice"=dword:00000000
>>>>> "NoDispSettingsPage"=dword:00000000
>>>>> "NoDispScrSavPage"=dword:00000000
>>>>> "NoVisualStyleChoice"=dword:00000000
>>>>> "NoSizeChoice"=dword:00000000
>>>>> "SetVisualStyle"=-
>>>>>
>>>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policie
>>>>> s\ Act iveDesktop] "NoChangingWallPaper"=dword:00000000
>>>>>
>>>>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\ThemeMa
>>>>> na ger
>>>>> ] "ThemeActive"="1"
>>>>> "DllName"=hex(2):25,00,53,00,79,00,73,00,74,00,65, 00,6d,00,52,00,6f,
>>>>> 00 ,6f ,00,\
>>>>> 74,00,25,00,5c,00,72,00,65,00,73,00,6f,00,75,00,72 ,00,63,00,65,00,
>>>>> 73 ,00 ,5c,\
>>>>> 00,54,00,68,00,65,00,6d,00,65,00,73,00,5c,00,6c,00 ,75,00,6e,00,61,
>>>>> 00 ,5c ,00,\
>>>>> 6c,00,75,00,6e,00,61,00,2e,00,6d,00,73,00,73,00,74 ,00,79,00,6c,00,
>>>>> 65 ,00 ,73,\ 00,00,00
>>>>>
>>>>> ****
>>>>>
>>>>>
>>>>> This *should* fix your issue for you. copy/paste the contents to
>>>>> notepad and save it as "fixme.reg" then double click, regedit will
>>>>> ask if its okay to import, say yes. and post back your results.
>>>>
>>>>
>>>> nothing changed, thank you for trying.
>>>>
>>>>
>>>>
>>>
>>> Ouch. Okay, so is it the desktop tab missing when you right click and
>>> hit properties, or are we going in the wrong direction?
>>
>> yes that is the tab and much thanks
>>
>>
>>
>
> Alright. That helps. Here's what I would like to do next, to be sure
> it's a policy issue and not something else. I'd like for you to goto
> control panel, users, and add another account, set it up as an
> administrator. Logoff the account your using, and login to this newly
> created one. Right click, hit properties, and tell me if a display tab is
> available.
>
>
> If its a per user policy key it may not be inherited on the new account.
> If it's a group policy key, it will be.
>
> I'd also like for you to run Dial a fix, I provided the url previously,
> and allow it do do it's thing. Scan for policies, and remove any/all
> found ones.
>
> Please report back your results.

thanks again Dustin, I appreciate have someone working with me towrds a
resolve.



Notes about this log:
1) "->" denotes an external command being executed, and "-> (number)"
indicates
the return code from the previous command
2) Not all external command return codes are accurate, or useful
3) Sometimes commands return 0 (no error) even when they fail or crash
4) If an error occurs while registering an object, please send an email
to:
dial-a-fix@DjLizard.net and include a copy of this log

DAF version: v0.60.0.24

--- System info ---
OS: Microsoft Windows XP Service Pack 2
IE version: 6.0.2900.2180
MPC: 76477-OEM
CPU: Intel(R) Celeron(R) CPU 2.93GHz (~2933MHz)
BIOS: 10/5/2004
Memory (approx): 1526MB
Uptime: 3 hour(s)
Current directory:
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.500\Dial-a-fix-v0.60.0.24
---

8/22/2007 2:58:28 PM -- Dial-a-fix : [v0.60.0.24] -- started
2:58:28 PM | Policy scan started
2:58:28 PM | The following restrictive policies were found:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntversion\Policies\Explorer\NoSetActiveDesktop

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entversion\Policies\Explorer\NoRecentDocsMenu
--- Emptying temp folders ---
2:59:34 PM | Deleting C:\Documents and Settings\Owner\Local
Settings\Temp...
2:59:35 PM | C:\Documents and Settings\Owner\Local Settings\Temp could
not be completely emptied, please reboot and try again
2:59:35 PM | Deleting C:\WINDOWS\temp...
2:59:35 PM | C:\WINDOWS\temp could not be completely emptied, please
reboot and try again
2:59:35 PM | Deleting C:\DOCUME~1\Owner\LOCALS~1\Temp...
2:59:36 PM | C:\DOCUME~1\Owner\LOCALS~1\Temp could not be completely
emptied, please reboot and try again
--- MSI ---
2:59:44 PM | Registered: C:\WINDOWS\system32\msi.dll





***no desktop tab on new admin user either.