Custom Level and Default Level buttons are grayed

[John Corliss]

I'm trying to work on a friend's XP Pro computer and the Custom Level
and Default Level buttons for the Internet Zone on the Security tab in
Internet Options are grayed out.

I've looked and looked and looked all through the registry, but can't
find any way to re-enable them.

His computer was pretty badly infected with the Bloodhound virus,
three Trojans and the VERY nasty Elitebar BHO spyware/adware. It's
probably a safe guess that one of them made it impossible to change
these settings. Can anybody help me?

TIA
John Corliss

 

[Jan Il]

Hi John

You probably have more than one scumware to deal with. Start here

McAfee Stinger

http://vil.nai.com/vil/stinger/



CWShredder

http://www.majorgeeks.com/download3019.html



If that does not resolve the problem:



You may have a hijacker, malware, spyware or other scumware on your system
causing this problem. Thus, in addition to running your updated anti-virus
program, you should do the following to be sure none of these are present on
your system. Although you may have already run one or more of the programs,
please do so again according to the instructions below. Be aware that, some
very aggressive and damaging variants of malware can replicate themselves
repeatedly, or mutate, if not removed properly. Please follow all
instructions carefully to be sure your system is thoroughly cleaned


Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
Be sure to run CWShredder here

http://www.majorgeeks.com/download3019.html

and AdAware and Spybot.
Download the newest version of HiJackThis here:
http://www.bleepingcomputer.com/files/hijackthis.php
(or Spybot - Search and Destroy DSO Exploit Fix 1.3.1 TX)
http://www.majorgeeks.com/download4392.html



Also visit these two sites to test for parasites and help basic cleaning:

On-Line Check

http://aumha.org/a/noads.htm

and

Quick-Fix Protocol.
http://aumha.org/a/quickfix.php

Basically, throw everything here at your "infection".

And be sure to use the HijackThis. Please DO NOT post your log to this
newsgroup, but to the HiJackThis Support Forums below:
http://www.hijackthis.de/forum/forumdisplay.php?f=10&guestlanguageid=4
the Aumha HiJackThis Forum
http://forum.aumha.org/viewforum.php?f=30

or Bleeping Computer Forum

http://www.bleepingcomputer.com/forums/forum22.html

to allow the experts there to evaluate your log and advise you of the
necessary steps to clean your system.



(Note: To avoid having your log deleted or ignored, you *must* do the two
things listed here:

(1) Don't post a HijackThis log until you have already done preliminary
scanning of your system for parasites. I recommend you go to QuickFix page
on this site - http://aumha.org/a/quickfix.htm - and run all steps
indicated, exactly as specified. Make the HJT log your last step, then post
to one of the sites above if you are still having problems.
(2) In your post, please specify what precleaning you have done, and specify
the problem that is prompting you to run this log in the first place.)


Also this program searches for hidden .dlls that recreate the malware.
About Buster:
http://www.majorgeeks.com/download4289.html

CAUTION!!!!! Before you try to remove spyware using any of the programs
below, download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

You should also get a copy of WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
Also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)

or ........

Winsock Fix Utility
http://www.dfwonline.net/files/WinsockFix.zip

Also.........

Courtesy of Jim Byrd -

Download Sysclean.com, from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp along with the latest pattern
file, here:
http://www.trendmicro.com/download/pattern.asp
Be sure to read the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt
You might also want to get Art's updater, SYS-UP.Zip, here for future
updating of these: http://home.epix.net/~artnpeg/.
(If you download and use the updater from the beginning, it will
automatically handle downloading the other files. Place them in a dedicated
folder after appropriate unzipping, and then run. This scan may take a long
time, as Sysclean is VERY extensive and thorough

NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them. After you have IE access again, update all programs where
possible to get the latest definitions and run them again in Safe Mode to be
sure there are no lingering items on the system.



If these steps do not resolve your problem, or you need help with the above,
please post back to this thread with the details and any error messages.

Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[Ramesh [MVP]]

John,

In addition to spyware removal, see:

Custom Level and Default Level buttons in Internet Options Security tab are grayed out:
http://windowsxp.mvps.org/ie/secchangesettings.htm

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org


I'm trying to work on a friend's XP Pro computer and the Custom Level
and Default Level buttons for the Internet Zone on the Security tab in
Internet Options are grayed out.

I've looked and looked and looked all through the registry, but can't
find any way to re-enable them.

His computer was pretty badly infected with the Bloodhound virus,
three Trojans and the VERY nasty Elitebar BHO spyware/adware. It's
probably a safe guess that one of them made it impossible to change
these settings. Can anybody help me?

TIA
John Corliss

 

[John Corliss]

John,
In addition to spyware removal, see:

Custom Level and Default Level buttons in Internet Options Security tab are grayed out:
http://windowsxp.mvps.org/ie/secchangesettings.htm

In the process of trying to correct this problem, I've seen this site
several times. It says the following (note that I'm NOT attibuting the
following quote to Ramesh, but rather to the site at the link he
provided):

When you open Internet Options Security tab, you may be unable to
alter the security setting for any Zone, because the Custom Level
and Default Level buttons may be greyed out. This is due to
SecChangeSettings restriction set in the registry.

Resolution

Click Start, Run and type REGEDIT. This opens the Registry Editor.

Navigate to the following location:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet
Explorer\Control Panel]

On my friend's sytem, it only goes this far:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\]

Unfortunately, there is no "Internet Explorer" key. The only key at
that location is and at that level is:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates]

I've also looked at that key's subkeys, but there's nothing under it
about Internet Explorer.

Backup the key by exporting it to a REG file. See here for
more information.

In the right-pane, select the SecChangeSettings value and delete it.

Close Registry Editor.

Thanks, but as I mentioned above, I've already tried looking for this
setting. In fact, a search through the whole registry for
"SecChangeSettings" comes up with nothing, (although IME, the registry
search engine leaves a lot to be desired.) It must lie somewhere else
in the registry.

Regards,
John Corliss

 

[John Corliss]

Hi John
You probably have more than one scumware to deal with. Start here

McAfee Stinger
http://vil.nai.com/vil/stinger/

CWShredder
http://www.majorgeeks.com/download3019.html

Thanks, but at this point, the computer is pretty much free of
malware. It's just the damage that I'm dealing with now.

If that does not resolve the problem:
You may have a hijacker, malware, spyware or other scumware on your system
causing this problem. Thus, in addition to running your updated anti-virus
program, you should do the following to be sure none of these are present on
your system. Although you may have already run one or more of the programs,
please do so again according to the instructions below. Be aware that, some
very aggressive and damaging variants of malware can replicate themselves
repeatedly, or mutate, if not removed properly. Please follow all
instructions carefully to be sure your system is thoroughly cleaned

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm

Read it previously. An excellent read and lots of good information.

Be sure to run CWShredder here
http://www.majorgeeks.com/download3019.html

and AdAware and Spybot.

Both done previously.

Download the newest version of HiJackThis here:
http://www.bleepingcomputer.com/files/hijackthis.php

Done it already.

(or Spybot - Search and Destroy DSO Exploit Fix 1.3.1 TX)
http://www.majorgeeks.com/download4392.html

Believe it or not, I managed to fix this one manually. But I will do
this download anyway.

Also visit these two sites to test for parasites and help basic cleaning:

On-Line Check
http://aumha.org/a/noads.htm

and

Quick-Fix Protocol.
http://aumha.org/a/quickfix.php

Basically, throw everything here at your "infection".

Rest assured, that's my policy. However, one must be careful to ensure
that anti-malware programs are reputable. There are a lot of
"antimalware" programs out there that in fact are *themselves*
malware. Likewise online scan sites. The site you mention above
though, is a good one and I've not seen it in my travels. Added to
Favorites. Many thanks!

And be sure to use the HijackThis.

Thanks, but I've been doing that all along and it comes up very clean
at this point.

Please DO NOT post your log to this
newsgroup, but to the HiJackThis Support Forums below:
http://www.hijackthis.de/forum/forumdisplay.php?f=10&guestlanguageid=4

the Aumha HiJackThis Forum
http://forum.aumha.org/viewforum.php?f=30

or Bleeping Computer Forum
http://www.bleepingcomputer.com/forums/forum22.html

to allow the experts there to evaluate your log and advise you of the
necessary steps to clean your system.

As per the last remark, posting a Hijack This log to any site wouldn't
help me much I'm afraid.

(Note: To avoid having your log deleted or ignored, you *must* do the two
things listed here:

(1) Don't post a HijackThis log until you have already done preliminary
scanning of your system for parasites. I recommend you go to QuickFix page
on this site - http://aumha.org/a/quickfix.htm - and run all steps
indicated, exactly as specified. Make the HJT log your last step, then post
to one of the sites above if you are still having problems.

(2) In your post, please specify what precleaning you have done, and specify
the problem that is prompting you to run this log in the first place.)

Also this program searches for hidden .dlls that recreate the malware.

But from what I can tell, it's only for a specific malware.

About Buster:
http://www.majorgeeks.com/download4289.html

Checked it out. Not needed. I really want to focus more on correcting
the Custom Levels button being disabled at this point. If I find out
what the setting change was, correct it and then it comes back, I'll
know that my friend's system is still infected. However, I doubt very
much at this point that this is the case.

CAUTION!!!!! Before you try to remove spyware using any of the programs
below, download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

Thanks, I'll check that one out for future reference.

You should also get a copy of WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html

and WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm

Also, from LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip

(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)

or ........

Winsock Fix Utility
http://www.dfwonline.net/files/WinsockFix.zip

Also, Courtesy of Jim Byrd -

Download Sysclean.com, from Trend Micro, here:
http://www.trendmicro.com/download/dcs.asp

along with the latest pattern file, here:
http://www.trendmicro.com/download/pattern.asp

Be sure to read the "How-to" info here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt

You might also want to get Art's updater, SYS-UP.Zip, here for future
updating of these: http://home.epix.net/~artnpeg/.
(If you download and use the updater from the beginning, it will
automatically handle downloading the other files. Place them in a dedicated
folder after appropriate unzipping, and then run. This scan may take a long
time, as Sysclean is VERY extensive and thorough

NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them. After you have IE access again, update all programs where
possible to get the latest definitions and run them again in Safe Mode to be
sure there are no lingering items on the system.

If these steps do not resolve your problem, or you need help with the above,
please post back to this thread with the details and any error messages.

Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Unfortunately, in the process of dealing with my friend's computer the
last few days, I seem to have lost the ability to smile. I hope it
comes back in time for Christmas.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

Thanks a lot for all the links, but all I really want to know is where
the setting in the XP Pro registry is that controls the Custom Level
button for the Internet level in Internet Options under the Security tab.

Regards,
John Corliss

 

[Ramesh [MVP]]

John,

Have you checked the equivalent path under HKLM?

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Control Panel

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org

John,
In addition to spyware removal, see:

Custom Level and Default Level buttons in Internet Options Security tab are grayed out:
http://windowsxp.mvps.org/ie/secchangesettings.htm

In the process of trying to correct this problem, I've seen this site
several times. It says the following (note that I'm NOT attibuting the
following quote to Ramesh, but rather to the site at the link he
provided):


On my friend's sytem, it only goes this far:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\]

Unfortunately, there is no "Internet Explorer" key. The only key at
that location is and at that level is:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates]

I've also looked at that key's subkeys, but there's nothing under it
about Internet Explorer.

Backup the key by exporting it to a REG file. See here for
more information.

In the right-pane, select the SecChangeSettings value and delete it.

Close Registry Editor.

Thanks, but as I mentioned above, I've already tried looking for this
setting. In fact, a search through the whole registry for
"SecChangeSettings" comes up with nothing, (although IME, the registry
search engine leaves a lot to be desired.) It must lie somewhere else
in the registry.

Regards,
John Corliss

 

[Frank Saunders, MS-MVP IE/OE]

I'm trying to work on a friend's XP Pro computer and the Custom Level
and Default Level buttons for the Internet Zone on the Security tab in
Internet Options are grayed out.

I've looked and looked and looked all through the registry, but can't
find any way to re-enable them.

His computer was pretty badly infected with the Bloodhound virus,
three Trojans and the VERY nasty Elitebar BHO spyware/adware. It's
probably a safe guess that one of them made it impossible to change
these settings. Can anybody help me?

TIA
John Corliss

Try
Restore All Tabs under Internet Options
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx

 

[John Corliss]

John,

Have you checked the equivalent path under HKLM?

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Control Panel

Heh. Too late now. I did a format and total reinstall. Talked my
friend into going back to W98. XP Pro caused nothing but problems on
his old PII 450. Runs real smooth now and the problems in IE are all
gone too. Since my friend had two hard drives in his computer, it was
easy to restore various personal files. I know, I know, you'd think
that there is a danger of reinfection, but hey..... life is dangerous.
Anyhow, I'm convinced that none of the files I copied back were
infected. Did a low level format too.

Thanks anyway,
John Corliss