Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't change display settings


  • Please log in to reply
81 replies to this topic

#1 Danibee

Danibee

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:03:31 AM

Posted 15 July 2009 - 12:02 PM

When I open my display properties, I can't change my background. I can interact with other items on the display properties except Background and Themes.

I've been working over on the Malware/Virus boards for a few days with Propaganda Panda. We have ruled out Malware or Viruses. Here's a link to that thread to see what we've done. http://www.bleepingcomputer.com/forums/t/238312/not-sure-if-infection/

Any help would be greatly appreciated!

-Bee

BC AdBot (Login to Remove)

 


#2 aommaster

aommaster

    I !<3 malware


  • Malware Response Team
  • 5,294 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Dubai
  • Local time:11:31 AM

Posted 15 July 2009 - 12:47 PM

Hi!

I've read through your help with PropagandaPanda, looking for any clues as to what you may have tried.

Let's jump to a reg fix. Make sure you backup your registry first, as follows:
We need to backup the registry with ERUNT
  • Please use the following link and scroll down to ERUNT and download it.
    http://aumha.org/freeware/freeware.php
  • Install ERUNT
    • For version with the Installer:
      Use the setup program to install ERUNT on your computer
    • For the zipped version:
      Unzip all the files into a folder of your choice.
  • Click Erunt.exe to backup your registry to the folder of your choice.
Once done, go to the following registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

Look for a DWORD such "NoDispBackgroundPage" with a data value of 1. Change the value to 0 or delete it to see the tab again.

Edited by aommaster, 15 July 2009 - 12:50 PM.

My website: http://aommaster.com
unite_blue.png
Please do not send me PM's requesting for help. The forums are there for a reason : )
If I am helping you and do not respond to your thread for 48 hours, please send me a PM


#3 joseibarra

joseibarra

  • Members
  • 1,185 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:03:31 AM

Posted 15 July 2009 - 12:56 PM

My theory:

Malware may have afflicted your system and now be removed, but the removal process can't decide if some registry changes were made on purpose (through GPE) or from malware, so the scanner won't know about them or try to fix those things. They remain manipulated but can be changed through GPE or regedit.

I think you said you have GPE (not available in XP Home), so you should be all set. If you have XP Home, then registry manipulation is the next idea but forbidden here. GPE just adds and or changes stuff in the registry anyway.

I think your problems can be resolved in GPE and suggest you look around in:

User Configuration, Administrative Templates and check everything under:

Desktop, Active Desktop
Desktop, Active Directory

Then look under User Configuration, Administrative Templates and check everything under:

Control Panel, Display

I hope I got all that pathing straight, so be sure to poke around in those areas with this in mind:

For the most part, unless you changed things in GPE, all this stuff should be: Not configured. There could be stuff in there that is configured and you don't even know about it yet, so Not configured is the way to be.

If you find things in some other condition like enabled or configured and you don't know why, set it/them back to Not configured/disabled and OK or Apply your way out a few notches (you don't have to quit GPE completely until you test).

This will change the registry immediately so a login cycle or reboot should not be required (at least for me).

Edited by joseibarra, 15 July 2009 - 01:45 PM.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#4 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:31 AM

Posted 15 July 2009 - 01:26 PM

Hello.

I don't think the policies are the issue here.

Originally, these policies were in force:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktopChanges"=-
"NoActiveDesktop"=-
"NoThemesTab"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"RunLogonScriptSync"=-
"NoColorChoice"=-
"NoSizeChoice"=-
"NoVisualStyleChoice"=-
"NoDispSettingsPage"=-
"NoDispAppearancePage"=-



After those were removed, only the ones below were left. None of them are related.

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ClassicShell = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ClassicShell = 0



I'm looking to see if anyone has other ideas.

With Regards,
The Panda

#5 joseibarra

joseibarra

  • Members
  • 1,185 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:03:31 AM

Posted 15 July 2009 - 02:02 PM

Your regedit idea is sound if the Desktop Tab is completely missing (which it might be) but I could have missed that part.

That tab functionality can be removed through GPE.

Although it does not appear to be a perfectly two way street between GPE and regedit! That one is a little weird.

Anywho, I was trying to stay clear of regedit for moment.

Who knows what else is set up in GPE that has not been discovered yet!

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#6 Danibee

Danibee
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:03:31 AM

Posted 15 July 2009 - 02:38 PM

Um..... so.... what should I do?


I backed up the registry and checked it again. IN that key I have the following:
ClassicShell
HideLegacyLogonScripts
HideLogoffScripts
HideStartupScripts
RunStartupScriptSync

All have the value of "0"

At the beginning of this wild ride, I did not have the tabs "Themes" or "Desktop". SInce working with Panda, I do have them back, but I can't change anything on either of them without the Display Properties screen disappearing.

Edited by Danibee, 15 July 2009 - 02:39 PM.


#7 Danibee

Danibee
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:03:31 AM

Posted 15 July 2009 - 02:40 PM

Jose - what is GPE?

Who's direction should I be following? I don't want to do two things that contradict each other.

#8 joseibarra

joseibarra

  • Members
  • 1,185 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:03:31 AM

Posted 15 July 2009 - 03:47 PM

Using GPE, I can keep my Desktop tab visible, but can't change anything which sounds like your problem. I could do it in the registry, but I don't need to.

GPE = Group Policy Editor and is only in XP Pro and your old logs say XP Pro.

To run it, click Start, Run and enter:

gpedit.msc

click OK.

You said in one post "I checked my GP" so I interpreted that as Group Policy (Editor).

If you have GPE, it would not be a foul to navigate through it as I mentioned and be sure things are Not configured.

I can't think of anything that should be otherwise unless you did it on purpose. So if something in configured, unconfigure it and if your problem is fixed, share what you did.

Please check carefully and if nothing good happens, we can approach it another way.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#9 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:31 AM

Posted 15 July 2009 - 04:21 PM

Hello.

Sorry for the confusion.

My post was simply to provide information and are not directions.

With Regards,
The Panda

#10 joseibarra

joseibarra

  • Members
  • 1,185 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:03:31 AM

Posted 15 July 2009 - 08:02 PM

I don't mind the help/advice one bit!

We'll get it going here soon I think.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#11 Danibee

Danibee
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:03:31 AM

Posted 16 July 2009 - 07:34 AM

Aah... gottcha. Sorry, I did know what that was.

Checked every item in my Group Policies again and the Display settings are "not configured" - in fact NOTHING is configured.

Edited by Danibee, 16 July 2009 - 08:07 AM.


#12 joseibarra

joseibarra

  • Members
  • 1,185 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:03:31 AM

Posted 16 July 2009 - 08:53 AM

Good.

The malware can also make changes in the registry that effect things that are not evident in GPE.

Let me be sure I understand at least one problem:

In your Display Properties is the Desktop tab available or missing?
If the Desktop tab is available, is the problem that the Background section is grayed out?

If the Desktop tab is available, but things in the Background section are grayed out (and we know it is not a GPE thing) then you need to follow PropagandaPandas advice about backing up the registry, etc.

The you need to search your registry for:

NoChangingWallPaper

Be sure your search starts at the top by highlighting My Computer. F3 means to search again.

If you find NoChangingWallPaper (set to 1), remove that entry(s). Actually, if you find it anywhere, delete it.

I have found it in up to to four places and it only takes one to disable the feature in the Desktop tab, but depending on where it is, it will still look right with GPE, so you have to find them all and remove them all by hand.

Search again to be sure, then test. Be sure to start the search from the top.

If this is not the exact problem try to state it as best you can remembering that we cannot see what you see, or screen shots are always good.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#13 Danibee

Danibee
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:03:31 AM

Posted 16 July 2009 - 10:47 AM

Let me see if I can describe the problem active now. I'll leave out the history (as properties changed throughout the course of fixing)

When I open display properties eigher through Control Panel or right click on desktop, the Display property box DOES come up. All tabs are shown (Theme, Desktop, Screen Saver, Appearance, Settings). All tabs are active and I can open all of them.



The FIRST time I try to click on Desktop tab the dialog box disappears. When I open display properties dialog box again and click on desktop, it allows me to view the desktop tab contents.

Within the Desktop tab, I can click on "Color" and "Customize Desktop" as normal. If I try to click on "Background" or "Browse" the dialog box disappears.



When I click on Themes, the contents of the themes tab display properly. I can click on the drop down box to let me select a new theme, but as soon as I try to select one, the dialog box disappears. Same happens if I click on "Save As".

Screen Saver, Settings and Appearance tabs all work as they should.


I did follow Panda's advice and back up the registry and have searched the registry. Did not find anything called NoChangingWallPaper.

#14 joseibarra

joseibarra

  • Members
  • 1,185 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:03:31 AM

Posted 16 July 2009 - 12:02 PM

It's hard for me to visualize what "disappears" means... and there was a post I read a long time ago that I can't find :thumbsup:

Here are a couple more things (obvious but not to be overlooked).

Make sure the Themes service is running and set to automatic.

Start, Run, services.msc - find Themes and check the status and properties. Stop and restart it anyway.

In your Display Properties, click the Desktop tab, and choose "Customize Desktop".
Select the "Web" tab
Delete all the items except "My current Home page"
Uncheck "My current Home page"
Click OK, and now select (None) as your Desktop background
Click OK and close the dialog

If you click Browse what does "the dialog box disappears" mean? It should open a folder. What happens.

Do you know ow to check your Display Driver version? Sometimes an old driver will make desktop things misbehave, but that would seem to be always, not sometimes.

How to you get things working again?

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#15 Danibee

Danibee
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:03:31 AM

Posted 17 July 2009 - 07:25 AM

It's hard for me to visualize what "disappears" means...

Disappears meaning no dialog box opens up, and it all goes away... like I closed it or somethign.

Make sure the Themes service is running and set to automatic. Start, Run, services.msc - find Themes and check the status and properties. Stop and restart it anyway.

I did this and there is no change.

In your Display Properties, click the Desktop tab, and choose "Customize Desktop".
Select the "Web" tab
Delete all the items except "My current Home page"
Uncheck "My current Home page"
Click OK, and now select (None) as your Desktop background
Click OK and close the dialog.

I did this and this is what I get:
Attached File  Desktop_Settings.jpg   101.08KB   23 downloads
Under the "Web" tab there is nothing listed. When I click on "New" the dialog box "New Desktop Item" opens up *the one with the blue on the side bar. If I click on either "Visit Gallery" or "Browse" all 3 dialog boxes (New Desktop Item, Desktop Items and Display Properties) disappear like I closed them all out.


If you click Browse what does "the dialog box disappears" mean? It should open a folder. What happens.

No folder opens, nothing opens, everything CLOSES.

Do you know ow to check your Display Driver version? Sometimes an old driver will make desktop things misbehave, but that would seem to be always, not sometimes.

My driver is "ATI Radeon HD 3650 AGP version 8.501.0.0 (06/02/08)

I'm thinking maybe it is the driver... Here are a few other things I've seen as issues....

Attached File  Black_Bar.jpg   76.69KB   17 downloads
Attached File  White_Box.jpg   50.91KB   19 downloads

I'll go check ATI's site and see if there's a new driver available. I did try to install a new driver for this after Panda had me do something on the other forum and it deleted my display driver. I was finally able to "Roll Back Driver" to the old ATI with my disk that came with the device.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users