Desktop and Screensaver tabs missing in Display Properties window

gonaads

Beware the G-Man
Political Access
Joined
31 Mar 2002
Messages
18,474
O.K. on the computer at work something went bad on it. The desktop no longer has a wallpaper and if you right click to open the Display Properties window the Desktop and the Screensaver tabs are now gone/missing/no where to be found.

I think the computer has got and infection of either spyware malware or something nasty. I tried a Restore but for some reason I can only go back to last week Thursday (which is the day this all started). Now I created a new user account on the computer and the problem is not present with that account. Very strange and this new account has Admin privileges and all that but no problem.

Machine is running XP Home Edition with SP3 installed. Has Norton System Works and Zone Alarm and a couple of other "Snake Oil" type things that the Boss thinks will help this old machine. I keep telling him to upgrade it 'cause it is so slow and accessing the DVD drive is annoying (almost like it's going to sleep every time after it sits for 2-3 min. or more, just the drive).

Image attached as to what it looks like. Any help would be great. Points in the direction of a fix also great.
 

Attachments

  • DisplayProperties.jpg
    DisplayProperties.jpg
    49.3 KB · Views: 652
I am posting this from the other user account and the one thing that I had narrowed it to was some bogus Screen saver proggy. Seems that if I go into the display properties and click on the screen saver tab under this test account i come up with an entry for some sort of thing labeled blphc5wpj0erfc. I have no idea what this is. Google had nothing on it. The machine also had some executable file trying to load at start up and the same one trying to access the secure zone under Zone Alarm and the internet. It was some 633968421.exe thing. Norton and Zone Alarm both flagged it and I denied it access. It was under C drive - (root drive) Documents and Settings - LocalService - Application Data. There were 2 other files there other than a Microsoft Folder and a Symantec Folder. One was 721529861.exe and the other one started with a 5, 5xxxxxx.exe.

The 721529861.exe and 633968421.exe files have come back. I deleted both and now they are back in the same folder. Odd thing is that under the test account the LocalService folder does not exist.

According to a Google search I did 721529861.exe is a "possible" Spyware thing. I only got one hit for it. I got nothing for the 6xxxx file.

http://spywarefiles.prevx.com/RRFAJD044937780/721529861.EXE.html
 
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Delete the two keys associated with the tabs.

Make sure you delete the files associated with the wallpaper and screen saver.

Run the Online Safety Scanner from Microsoft and Windows OneCare; it works extremely well, especially for the Trojan in question.

http://onecare.live.com/site/en-us/default.htm
 
God damn thing won't install. I had to use IE and then allow the Active x thing and it still will NOT fvcking install. Bahhhhh!!!



O.K. Relaaaaax... Uuuuu saaaaaa, uuuuuuuu saaaaa... Don't ask. :p


Downloading and installing 90 day trial of OneCare. Hope this is basically what you linked to.
 
God Damn OneCare! CRAP! Locking up machine (6 times) and a pain in the ass. Arrrrg!!! Maybe 'cause this piece of crap is slow.

I hate fixing other people's computers. :mad:

Anyone else have a way, without the onecare? Sorry Matt, but thanks for trying. If ya got any other ideas.

And the damn files are trying to run at startup. I want to wipe it clean and reinstall XP with SP3 and then it will probably even be fast-ish again.
 
Download HijackThis from here and scan your system with it. It'll generate a log file. Copy its content and post here. Its most probably a virus infection.

The desktop properties tabs can be enabled again using registry using this tutorial but first we'll have to make sure that there is no infection left.
 
try manuly restoring the registry to before last thurs by hand?

same processes as http://support.microsoft.com/kb/307545

hopefully the System Volume Information folder has a copy of all files before last thurs.

easyist way i have found to restore the regisrty is rip out the hard drive + put it in a usb caddy, then you can just copy + paste the registry from
C:\System Volume Information\_restore{Random ****........}\RP**\Snapshot\
to
c:\windows\system32\config\


hopefully that will then kill what ever it is so you can delte it + stay deleted.
 
Thanks to all for the ummm, advice. :rolleyes: Seriously though, thanks.

Turns out that after some serious tweaking of the msconfig I got everything to not load cept for ZA and Norton. I did a Spybot Search and Destroy with all the updates for it and it found the little shiit, and the reg thingies that it had done and some other nastiness. I also deleted some Uniblue SpeedUp My PC crap and some SpySweeper thing my Boss had installed. The Uniblue Reg thingy I left alone as it does work well and it only gets used when I want it to. But the real twisted thing is that he had installed a program called ErrorSmart. I have no clue as to who makes this thing but it would always load at Windows Start-up and there was no option for it not to load at start-up. also I went and did a "Google" about it and I get conflicting remarks, "Oh it's malware, oh it's a great program, no don't use it it's bogus and says that your PC has a ton of problems then asks for you to purchase it and then it will repair everything (Yes my Boss bought it, for a whole 50 dollars :eek: ). I haven't a clue as to what is what but one thing I do know is that one of these programs was phoning home every time that Windows would load. It was automatically doing the "Dial Up" thing and the DSL would then connect. I couldn't figure out why the DSL was connecting automatically. I thought it was something that the Boss had done so as not have to connect manually as we had been doing. But as soon as I uninstalled these 3 programs the auto dial was no more. And the Desktop and Screen Saver tabs are back. Yea! :D

I will look at the log from Spybot Search and Destroy as to the vicious little crapper that fudged up the PC. From what I remember it had some entry as to "scr" (Me thinks Screen Saver) Then there was 2 more entries as to "No desktop image" "No Scren Saver" blah blah or something to that effect. Also Spybot-SD had the ErrorSmart proggy listed as a malware thing. So I am confused and if anyone knows anything about this proggy please let me know. Again I will post the culprit tomorrow at work when I get a look at the log file.

Oh and never ever load MS Live OneCare on an old machine it just kills the CPU whenever it tries to do it's tune-up and you click ANYTHING. Grrrrrrrrr :mad:
 
Well if anyone is interested and for general knowledge these are the 3 entries that were killing the Desktop and Screen Saver tabs in XP. Hupigon13 seems to be at the root of it all.

Microsoft.Windows.System: Settings (Registry change, fixed)
HKEY_USERS\S-1-5-21-1343024091-1060284298-1011862931-1004\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage!=W=0

Microsoft.Windows.System: User settings (Registry change, fixed)
HKEY_USERS\S-1-5-21-1343024091-1060284298-1011862931-1004\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage!=W=0

Hupigon13: Settings (Registry value, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sr\ImagePath=...\SystemRoot\...
 
Actually... No. It might have done in the virus/trojan/whatever but the System Restore was F U B A R. it doesn't exist any more. You can't start the service because the specified file(s) aren't there. The tab isn't even there in the System Properties window.

You have to go to WINDOWS\inf\ and right click on sr.inf and click install. Then point the install to another file needed for System Restore off of the SP3 CD or from the directory where the SP3 update files are stored on you HDD and then it asks for some file off of you Windows XP CD. Then it's all same as it ever was. System Restore Service is running and happy PC is all happy... until the next time my Boss does something he shouldn't.
 
The software version of OneCare is different from the online version. The online version does an awesome job of detecting viruses/malware that software does not.
 
Well if only it would have installed/run from IE. Curse you Active X crap. :p Thanks anyway Matt. :D
 
Yar really great thanks gonaads actually your tricks saved my 5 hours that may consume in formating and reinstalling the softwares.

Thanks again

Faraz Ghorry
 

Members online

No members online now.

Latest profile posts

Also Hi EP and people. I found this place again while looking through a oooollllllldddd backup. I have filled over 10TB and was looking at my collection of antiques. Any bids on the 500Mhz Win 95 fix?
Any of the SP crew still out there?
Xie wrote on Electronic Punk's profile.
Impressed you have kept this alive this long EP! So many sites have come and gone. :(

Just did some crude math and I apparently joined almost 18yrs ago, how is that possible???
hello peeps... is been some time since i last came here.
Electronic Punk wrote on Sazar's profile.
Rest in peace my friend, been trying to find you and finally did in the worst way imaginable.

Forum statistics

Threads
62,015
Messages
673,494
Members
5,621
Latest member
naeemsafi
Back