"windows cannot find 'gpedit.msc' - & my Web tab is missing...

[Bondpwk]

When I try to run group editor the above error message is displayed by
windows. I have experienced some trouble with a recently removed trojan that
disabled the task manager (which I have enabled) & the display properities
option to correct the background of the display. The "Web Tab" is missing
now, and there is a "ahtn web page" set as the background...I am unable to
change the background because the display tab is accessable, but cannot
choose a new background or color etc because it has been disabled.

I was going to try to go into the group editor to correct the problem with
the display tab....also, how do I repair or reinstall the display properites
box so I can make changes to the desktop again???

 

[The Real Truth MVP]

Use my Remove-it software, it will remove that malware from your system. To
fix your desktop issues choose yes for all options when prompted. Download
it here http://pcbutts1.com/downloads/tools/tools.htm

 

[Bondpwk]

so when i went to download the malware removal tool my mcafee says that it
has a .pup and it should not be downloaded...I ran the repair tool and it did
not repair the display properties box and it's folders ??

not sure why ?

Pls advise.

 

[The Real Truth MVP]

When it asked to reset your desktop did you select yes or no? If no then run
it again and select yes. If yes then run my diagnostic tool called
whatslivern. That file after a few seconds, when complete, will generate a
log file. That log file will be saved in the same directory you ran the
program from, using the email link at the bottom of my web page send me a
copy of that log file. http://pcbutts1.com/downloads/tools/tools.htm

 

[The Real Truth MVP]

BTW McAfee is flagging the process.exe file that is included in Remove-it.
The program is safe.

 

[Bondpwk]

Well I did as you requested and still some issues, I have emailed you the log
file as requested. Any help resolving this issue would be appreciated.

Thanks

 

[Peter Foldes]

Bondpwk

Good Luck

 

[The Real Truth MVP]

Check your email and posts back the results.

 

[Bondpwk]

Thanks for the reply, I did ask you instructed...when i ran the remove it
again, alot happened. Again, remove it referenced the following message

c:\windows\system32\a.exe
"The process cannot access the file because it is being used by another
process"
"The filename, directory name, or volume label syntax is incorrect"

One thing that was good, upon normal boot up the background corrected itself
for about 45 seconds then the invading background re-appears. I am still
unable to make any adjustments thru the display properties box, the web tab
is still missing..do you wish me to run another snapshot and email it to you ?

 

[Bondpwk]

Removal of the worm W32.Ahlem.A@mm -- files in windows/system32 can be made
manually to get rid of the background problem
the files to remove were:

a.exe
frmwrk32.exe
ahtn.htm

The problem still persists with not being able to use the display properties
dialog box to change the background ??

 

[The Real Truth MVP]

Check your email again.