Desktop and Screensaver tabs missing in Display Properties window

Discussion in 'Windows Desktop Systems' started by gonaads, Aug 12, 2008.

  1. gonaads

    gonaads Beware the G-Man Political User Folding Team

    O.K. on the computer at work something went bad on it. The desktop no longer has a wallpaper and if you right click to open the Display Properties window the Desktop and the Screensaver tabs are now gone/missing/no where to be found.

    I think the computer has got and infection of either spyware malware or something nasty. I tried a Restore but for some reason I can only go back to last week Thursday (which is the day this all started). Now I created a new user account on the computer and the problem is not present with that account. Very strange and this new account has Admin privileges and all that but no problem.

    Machine is running XP Home Edition with SP3 installed. Has Norton System Works and Zone Alarm and a couple of other "Snake Oil" type things that the Boss thinks will help this old machine. I keep telling him to upgrade it 'cause it is so slow and accessing the DVD drive is annoying (almost like it's going to sleep every time after it sits for 2-3 min. or more, just the drive).

    Image attached as to what it looks like. Any help would be great. Points in the direction of a fix also great.

    Attached Files:

  2. gonaads

    gonaads Beware the G-Man Political User Folding Team

    I am posting this from the other user account and the one thing that I had narrowed it to was some bogus Screen saver proggy. Seems that if I go into the display properties and click on the screen saver tab under this test account i come up with an entry for some sort of thing labeled blphc5wpj0erfc. I have no idea what this is. Google had nothing on it. The machine also had some executable file trying to load at start up and the same one trying to access the secure zone under Zone Alarm and the internet. It was some 633968421.exe thing. Norton and Zone Alarm both flagged it and I denied it access. It was under C drive - (root drive) Documents and Settings - LocalService - Application Data. There were 2 other files there other than a Microsoft Folder and a Symantec Folder. One was 721529861.exe and the other one started with a 5, 5xxxxxx.exe.

    The 721529861.exe and 633968421.exe files have come back. I deleted both and now they are back in the same folder. Odd thing is that under the test account the LocalService folder does not exist.

    According to a Google search I did 721529861.exe is a "possible" Spyware thing. I only got one hit for it. I got nothing for the 6xxxx file.
  3. madmatt

    madmatt Bow Down to the King Political User

    New York

    Delete the two keys associated with the tabs.

    Make sure you delete the files associated with the wallpaper and screen saver.

    Run the Online Safety Scanner from Microsoft and Windows OneCare; it works extremely well, especially for the Trojan in question.
  4. gonaads

    gonaads Beware the G-Man Political User Folding Team

    God damn thing won't install. I had to use IE and then allow the Active x thing and it still will NOT fvcking install. Bahhhhh!!!

    O.K. Relaaaaax... Uuuuu saaaaaa, uuuuuuuu saaaaa... Don't ask. :p

    Downloading and installing 90 day trial of OneCare. Hope this is basically what you linked to.
  5. gonaads

    gonaads Beware the G-Man Political User Folding Team

    God Damn OneCare! CRAP! Locking up machine (6 times) and a pain in the ass. Arrrrg!!! Maybe 'cause this piece of crap is slow.

    I hate fixing other people's computers. :mad:

    Anyone else have a way, without the onecare? Sorry Matt, but thanks for trying. If ya got any other ideas.

    And the damn files are trying to run at startup. I want to wipe it clean and reinstall XP with SP3 and then it will probably even be fast-ish again.
  6. Vishal Gupta

    Vishal Gupta Microsoft MVP

    Download HijackThis from here and scan your system with it. It'll generate a log file. Copy its content and post here. Its most probably a virus infection.

    The desktop properties tabs can be enabled again using registry using this tutorial but first we'll have to make sure that there is no infection left.
  7. Henyman

    Henyman Secret Goat Fetish Political User

    try manuly restoring the registry to before last thurs by hand?

    same processes as

    hopefully the System Volume Information folder has a copy of all files before last thurs.

    easyist way i have found to restore the regisrty is rip out the hard drive + put it in a usb caddy, then you can just copy + paste the registry from
    C:\System Volume Information\_restore{Random ****........}\RP**\Snapshot\

    hopefully that will then kill what ever it is so you can delte it + stay deleted.
  8. gonaads

    gonaads Beware the G-Man Political User Folding Team

    Thanks to all for the ummm, advice. :rolleyes: Seriously though, thanks.

    Turns out that after some serious tweaking of the msconfig I got everything to not load cept for ZA and Norton. I did a Spybot Search and Destroy with all the updates for it and it found the little shiit, and the reg thingies that it had done and some other nastiness. I also deleted some Uniblue SpeedUp My PC crap and some SpySweeper thing my Boss had installed. The Uniblue Reg thingy I left alone as it does work well and it only gets used when I want it to. But the real twisted thing is that he had installed a program called ErrorSmart. I have no clue as to who makes this thing but it would always load at Windows Start-up and there was no option for it not to load at start-up. also I went and did a "Google" about it and I get conflicting remarks, "Oh it's malware, oh it's a great program, no don't use it it's bogus and says that your PC has a ton of problems then asks for you to purchase it and then it will repair everything (Yes my Boss bought it, for a whole 50 dollars :eek: ). I haven't a clue as to what is what but one thing I do know is that one of these programs was phoning home every time that Windows would load. It was automatically doing the "Dial Up" thing and the DSL would then connect. I couldn't figure out why the DSL was connecting automatically. I thought it was something that the Boss had done so as not have to connect manually as we had been doing. But as soon as I uninstalled these 3 programs the auto dial was no more. And the Desktop and Screen Saver tabs are back. Yea! :D

    I will look at the log from Spybot Search and Destroy as to the vicious little crapper that fudged up the PC. From what I remember it had some entry as to "scr" (Me thinks Screen Saver) Then there was 2 more entries as to "No desktop image" "No Scren Saver" blah blah or something to that effect. Also Spybot-SD had the ErrorSmart proggy listed as a malware thing. So I am confused and if anyone knows anything about this proggy please let me know. Again I will post the culprit tomorrow at work when I get a look at the log file.

    Oh and never ever load MS Live OneCare on an old machine it just kills the CPU whenever it tries to do it's tune-up and you click ANYTHING. Grrrrrrrrr :mad:
  9. gonaads

    gonaads Beware the G-Man Political User Folding Team

    Well if anyone is interested and for general knowledge these are the 3 entries that were killing the Desktop and Screen Saver tabs in XP. Hupigon13 seems to be at the root of it all.

  10. Henyman

    Henyman Secret Goat Fetish Political User

    my fix would have worked :p
  11. gonaads

    gonaads Beware the G-Man Political User Folding Team

    Actually... No. It might have done in the virus/trojan/whatever but the System Restore was F U B A R. it doesn't exist any more. You can't start the service because the specified file(s) aren't there. The tab isn't even there in the System Properties window.

    You have to go to WINDOWS\inf\ and right click on sr.inf and click install. Then point the install to another file needed for System Restore off of the SP3 CD or from the directory where the SP3 update files are stored on you HDD and then it asks for some file off of you Windows XP CD. Then it's all same as it ever was. System Restore Service is running and happy PC is all happy... until the next time my Boss does something he shouldn't.
  12. madmatt

    madmatt Bow Down to the King Political User

    New York
    The software version of OneCare is different from the online version. The online version does an awesome job of detecting viruses/malware that software does not.
    gonaads likes this.
  13. gonaads

    gonaads Beware the G-Man Political User Folding Team

    Well if only it would have installed/run from IE. Curse you Active X crap. :p Thanks anyway Matt. :D
  14. farazghorry

    farazghorry OSNN One Post Wonder

    Yar really great thanks gonaads actually your tricks saved my 5 hours that may consume in formating and reinstalling the softwares.

    Thanks again

    Faraz Ghorry