Last night my son downloaded from a chat program what turned out to be an infected file. My son says the file was named "pictures.pif" . Since then I’ve had problems with Internet Explorer ActiveX security settings. I get the following Internet Explorer dialog box message: "your current security settings prohibit running ActiveX controls on this page...”

Here’s when it happens: 1.when my Windows desktop is loading, I get the message. Once I click OK in the message box, Desktop appears to finish loading correctly. 2.When I’m working in Windows Explorer, and click on a folder in the left pane, the right pane remains blank and the message box pops up, 3.When I open Control Panel, the message pops up and I’m unable to open any selections such as Add/Remove Programs, 4.When I try to run Norton Antivirus, nothing happens. Other aspects of Norton Systemworks are not affected.

Here’s what I’ve tried to correct the problem. 1.I downloaded Spyware Doctor (S.D.) and on the first run it found lots of problems, one of which was that my browser had been hijacked and security settings had been manipulated. The location of the infection was noted as “multiple”. I allowed S.D. to clean this up, but the problem persists. 2.I manually checked security settings in IE6. IE6 security is set as “medium” and settings look fine. 3.Since I couldn’t operate Norton Antivirus, I ran an online scan from TrendMicro.com It found nothing. 4.I ran Spybot and Adware with the latest definitions. They each found some problems and cleaned them up.

None of the solutions has resolved the problem. Interestingly, the problem hasn’t prevented me from downloading and installing the latest Windows critical update, which I did earlier today. One other point, and this may not make any difference: I’m running Firefox as my default browser and not IE6.

Obviously something is very wrong. Can you help?

I'd try a System Restore to a point before the infection if you haven't turned it off yet. That should at least put your registry back to normal and put back any system system files which may have been deleted. At a minimum, you won't be any worse off than when you started.

If it works and things get back to normal, scan again and then purge the restore by turning it off and then rebooting and turning it back on again. Windows will have made backups of the nasty and its reg entries in there, so you'll want to get rid of them.

You should do all the things you've done over again in the Safe Mode.

And disable System Restore as that will just keep reloading the problems for you.

Of course you will lose any system restore points, so if you restore your system to an earlier time as suggested above, that would be the preferable way to go.

If that doesn't fix it, do everything aqgain from within the Safe Mode.

Larry

I had the same problem as Lee and it seems to be fixed after i system restored to the day previous to contracting the virus. Thanks for the help

Am having the exact same problem, downloaded picture.pif file from AIM and now internet security settings don't allow ActiveX or cookies. Internet security settings now can't be changed.

How do I perform a system restore?

Shucks, I don't have a system restore point that precedes the virus download. Now what?

I got the same thing today, only it was my girlfriend that clicked on a link under a AIM profile. I've back tracked it and was able to fully delete it, but when I log back on to our regular profile (win xp pro) from admin it displays the same message. Basically its only on one profile, so system restore is just abit drastic. Im google'n' the heck out of this but nothing yet?!

so system restore is just abit drastic

If you just got it today, system restore can put you back to yesterday. That's not very drastic unless you've installed a heap of things between then and now.

Lee, Mike and pstar:

My son also put the whammy on our computer. He got a link from AIM to delete the virus and apparently it was successfully removed, at least in part. We could no longer log in through SBC Yahoo, but we could go through the back door with Internet Explorer. I tried changing settings and a few other fixes that we came across while searching for answers, but nothing was working. Then we tried the following WinXP fix (even though we have Win2000). Apparently this fix came about when users couldn't get to the Windows Update for the latest XP service pack. I then uninstalled and reinstalled SBC Yahoo, re-ran spybot and adaware, and so far everything is fine. Don't really know if it was just this fix or a combination of all the previous attempts, but we are able to log in, access everything again, and no more activeX messages.

www.winxptutor.com/helpsecerror.htm

This is a particularly annoying virus thanks to nortons reliance on activex settings. I dont have it myself because i use Firefox browsing and Trillian for messaging. Both programs can be found on www.majorgeeks.com and i would highly recommend you use them (much safer than IE and AIM and better features).

My roommate and his girlfriend both got the virus. Apparently it changes your profile to the picture.pif link. If you are using AIM still, disable your profile or you will spread it to your friends by them clicking on it.

If you have winXP and you havent installed service pack 2, you are in luck. I figured out how to re-enable the activex settings so that you can run Norton and get rid of the virus.
Simply load up IE , click TOOLS>INTERNET OPTIONS (or alternatly go to the control panel and open up INTERNET OPTIONS). On the SECURITY TAB you should see a MY COMPUTER ICON. This will bring up the security options for your computer domain. In the box for "security level for this zone" change it to MEDIUM or MEDIUM-LOW. Then click apply. This should allow you to open up norton and run a virus scan.

If you have service pack 2 there is no icon for MY COMPUTER in the domains portion of the security tab. Why did they take it out?Thnx microsoft.

I dont like messing with system restore. I have a friend who has this virus and SP2. I know how to get rid of the virus under SP2, but not fix the settings that it changed. To get rid of it under sp2 just update norton restart into safe mode and norton should be able to run.

Does anyone know how to change the security activex settings for the "my computer" domain under WinXP sp2?

Greg, nice find. That is exactly what i was lookin for. Now i look like an idiot for posting that huge thing. Oh well, next time i will read all of the posts(doh!). If you are afraid of editing the registry with windows regedit, there are some nifty programs on www.majorgeeks.com that make it a lil easier and less lethal. And everybody stop using IE and AIM. im tellin ya they will be the death of your computer

I had the same AIM virus and the same problem with Norton. I followed the instructions on www.winxptutor.com/helpsecerror.htm and I no longer get the activex error message. The problem is that Norton is still not working. When I load up Norton it says "System Status: Refreshing" and nothing happens. When I choose scan for viruses I get another blank screen. The buttons do nothing. I tried right clicking on my C drive and choosing "scan with norton" and the scan screen loads, but nothing happens. I am having the same problems but no longer getting the Activex error message.

I tried all of the above and nothing! Spyware Doctor found 48 infected files but won't fix them unless I pay $29.95. Is this the only way? Adaware, Spybot, and SpyBlaster all found nothing. Norton under Safe Mode found nothing. Please help! I've wasted so much time on this! Thanks!

I don't know if this is the same issue but one of my users was running into a problem being able to access
"My Computer", "My Documents", "Control Panel" etc.
came up with the same error message
about security settings prohibit active X

changing
HKEY_CURRENT_USER
\Software
\Microsoft
\Windows
\CurrentVersion
\Internet Settings
\Zones
\0
1200 to 0
and the same in HKEY_LOCAL_MACHINE

Then restarting the machine worked great on a windows 2000 sp4

(link in post 8)

Also I saw someone ask about enabling the My Computer Security Zone in Internet Options
its another registry thing
HKEY_CURRENT_USER
\SOFTWARE
\Microsoft
\Windows
\CurrentVersion
\Internet Settings
\Zones
\0
change the "Flags" dword from 21 to 47 in "Hex" (33 to 71 decimal)
This looks like it works for HKLM also.
This worked with windows XP sp1.

http://support.microsoft.com/?kbid=315933

Same problem, My computer would not come up, I did the registry fix (www.winxptutor.com/helpsecerror.htm), solved that problem, but now I cant log in to my.yahoo.com to check my e-mail while in Internet Explorer. (works fine in Mozilla though). It says my browser does not allow cookies. When I go to privacy, it shows that My.Yahoo.Com is blocked, although the browser is set to allow all cookies. Any suggestions???

Rob

I don't use yahoo much, I don't like the advertisements etc.
I ran into a situtation with hotmail a while ago, even with allowing cookies from hotmail.com it wouldn't auth properly. When the password auth stuff was being processed it shot me to a few different sites under different domains, so I had to trace down the domains the auth was going through and put those into my allow section. Do you have cookies blocked or allow only from "" with Mozilla?

A couple things you can try.
Allow your cookies to come from yahoo.com this should allow any sub domain of yahoo.com ie my.yahoo.com etc.

If that doesn't work you'll have to do a little hunting and find out what other sites the auth for yahoo goes to and allow those sites to send you cookies.

Other than that allow cookies from everywhere and that should fix your problem. So long as your not running any other programs to do popup/blocking, internet security jazz.

Did anyone ever find a solution to response number 11? I have the same problem and nothing seems to help with Norton AntiVirus. I also no longer get the activeX messages, and have uninstalled and reinstalled AntiVirus 2002 and now 2003, but still is stuck at "refreshing".

hi i have a program that automatically fixed the aim away bug for me, but task manager and windows registry editor both flash and disappear. also, in my computer, i cannot open files because of a security error even when my internet settings for my computer are on low.

any help please?