Interesting malware.

Recently, I’ve found some infected systems that will also install the BSOD screensaver.

At first, I thought the customer (or someone related) had installed the BSOD screensaver as a joke, and it was unrelated to the infection.

But the first time this happened, the customer called me a few days later to say that something was still wrong with the system… I was told: The system would show a “blue screen with white writing”, and then the PC would restart.

I know I wouldn’t leave a system in such a state (and I had forgotten about the BSOD screensaver…), so I re-visited the customer as soon as possible.

I was not happy to see that the system was working fine and the BSOD (blue screen of death) would go away by just moving the mouse.

However, changing the screensaver wasn’t as easy as I thought… the malware had also hidden some tabs from the display properties (desktop tab and screen saver tab).

So after some fishing around I found that a minor change in the registry made the tabs re-appear (go to HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System , and delete the NoDispScrSavPage and NoDispBackgroundPage keys.

Related posts:

1. STOP 0X0000008E BSOD: not always a hardware problem This PC would start, briefly display the windows startup splash screen, and then restart. Once it restarted a few times,...
2. brief XP blue screen, then reset A customer said his computer would barely start windows, before a blue screen would flash-up briefly, and then the computer...
3. Task Manager greyed-out, no Desktop and no screen saver tabs Some of the latest malware seem to often alter XP settings like greying out access to the task manager (or...
4. Worst malware infection yet! Customer calls saying that his computer stops working once windows starts & he thinks its because of spyware. I think:...
5. stop 0X00000024 While starting, this XP PC would give a blue screen of death (BSOD), the error: stop 0×00000024 and then something about...

Posted by Computer Help in Technical

2 Comments »