[t0ckS1ck]

I've recovered from an entire slew of infections that started with Antivirus Gold. It, and several others have all been removed, but I'm afraid one or more of these trojans screwed with my registry. The symtoms include a background overlay referencing a non-existent HTML page in my Windows Directory.

I was able to get my Destop Tab back in my Control Panel/Display Applet as part of the recovery process, and I am able to select JPG backgrounds, but no matter what I pick, it is still overlayed by the non-existent flashing HTML. I can see a thin strip of the actual JPG background image at the very bottom of my screen, just above the taskbar, and I can right-click this thin area and invoke the Display Applet.

My question - what registry setting gets rid of the HTML background overlay.

Edited by t0ckS1ck, 03 July 2005 - 10:14 AM.

[Advertisements]

Download and doubleclick:
http://metallica.gee...m/smitfraud.reg
Confirm you want to merge it with the registry.

Let me know if that does the trick.
I wouldn't mind having a look at your HijackThis log to see if you got it all.

Regards,

[Metallica]

Download and doubleclick:
http://metallica.gee...m/smitfraud.reg
Confirm you want to merge it with the registry.

Let me know if that does the trick.
I wouldn't mind having a look at your HijackThis log to see if you got it all.

Regards,

[t0ckS1ck]

Yes! That fixed the problem. My HJT scans proved very helpful in overcoming this infection. That, along with KillBox, helped me tremendously. The one thing I found in common with the various trojans is that they all involved exe and dll that installed themselves in the windows/windows32 directory. My legitimate HJT entries were all in the directory they were supposed to be in. In fact, one can easily spot them by simply doing a date sort in Windows Explorer, and sure as [bleep], there they all were, all neatly lined up. AdAware proved to be essentially useless, other than telling you you're infected. So was Avast!. HJT and KillBox did it for me, along with this excellent site.

[Metallica]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

Please do have a look at my site about removing and preventing spyware.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.