Control panel doesn't respond in safe mode

[AmyA]

Hi guys - so glad this forum exists.

Trying to create the admin password - if there are other users on the computer you have to do this in safe mode. I go to safe mode, go to control panel and all looks fine. I click on anything in there (like user accounts) and nothing will open. It's unresponsive to clicks but the mouse is working. I've heard this isn't too uncommon but haven't found a fix on the internet yet.

I had a horrific battle with some malware that got cleaned (thanks Kahdah) but he doesn't think it's related.

Any help is greatly appreciated.

[Firefox]

What version of windows are you using? I am not aware that you have to do this in safe mode? You should be able to do this in normal mode. How long ago were you infected? What version of MBAM are you using to scan and what database version?

[AmyA]

Sorry, should have included that. I'm on XP. But even if I can do it in normal mode, I'd like control panel in safe mode to work in case I need it in the future.

I'm typing this from another computer (scared to search on the other one until I get a password on admin) so not sure of Malwarebytes version - but it never found anything. The behavior said I stil had something so ComboFix found it. We used a ton of different scans to clean it up. I was infected somewhere around the 12th. The rootkit I had was TDL3 or a Tdssrv variant (full thread here: http://forums.malwarebytes.org/index.php?showtopic=46901)

Even tho I'm clean according to the logs/scans the fact that safe mode is uppity is still making me debate a reformat which will be a colossal pain in the ass.

[noknojon]

Do you have Control panel set for Classic View or Category View

[AmyA]

Classic mode.

[AdvancedSetup]

Well it shows that you're on Service Pack 2 as well. Since your system is now clean I would highly recommend performing the following SP3 update and see if it corrects it or not. You should NOT need to go into safe mode to create any account on XP Pro.

I would download the following FULL updater and do not use the Online Windows update for this.

Windows XP Service Pack 3 Network Installation Package for IT Professionals and Developers

After downloading it temporarily disable your Anti-Virus and any other script blocking tools such as TeaTimer or Ad-Aware pro etc and then run the Service Pack update file and let us know if you run into any issues.

As with any major change like this though make sure you have backed up your data as a precaution.

[AmyA]

Okay. Backed up all data and installed SP3. Control panel still not responding in Safe Mode. Any other suggestions?

[marktreg]

Hi AmyA,

First, let's see if we can find something peculiar in the registry.

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

• Please download ERUNT from here
  
• ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
  
• Double click on erunt-setup.exe to Install ERUNT by following the prompts.
  
• Use the default install settings but say NO to the portion that asks you to add ERUNT to the Start-Up folder. You can enable this option later if you wish.
  
• Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
  
• Choose a location for the backup.
  
  • Note: the default location is C:\Windows\ERDNT which is acceptable.
    

  [*]Make sure that at least the first two check boxes are selected.

  [*]Click on OK

  [*]Then click on YES to create the folder.

Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe

After the Registry has been backed up, click on start > Run. Then type regedit in the box and click OK.

Then navigate to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Then click File then click Export. Name the file HKU and save it to your Desktop.

Then navigate to:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Then click File then click Export. Name the file HKLM and save it to your Desktop.

Then close the Registry Editor.

You should now have two files on your Desktop named HKU.reg and HLKM.reg

Please either zip or rar these two files and attach them to your next post.

If I spot any problems in those .reg files I will make another .reg file that you can run to fix them.

[AmyA]

Here you go.

HKLM.zip

HKU.zip

[marktreg]

Please download the attached zip file to your Desktop. Unzip it and double click on controlpanelrestrictionrestore.reg. Then click Yes to add the information to the Registry. Reboot the computer. Then reboot into Safe mode and see if you can access the Control Panel icons.

controlpanelrestrictionrestore.zip

[AmyA]

Still doesn't work but I'm not sure how important it really is to be able to access control panel in safe mode. For what I'm trying to accomplish now (adding admin password & creating a new user) I don't think I need it. But it seems like something I may want to use some day. Any ideas? Thoughts?

[marktreg]

I've attached another Registry fix that you can try. But who knows whether it will work or not. The trouble is with this kind of problem is that it can be extremely difficult and time consuming to track down. You could have some kind of unusual Registry corruption or one of the system files could be corrupted - or many other things.

I'm pretty sure you don't need to use the Control Panel in Safe Mode to create an Admin pasword and add a new user. And it would be extremely unusual if you DID ever need to use the Control Panel in Safe Mode. I don't think I've ever actually HAD to use it in Safe Mode, as far as I can remember. At least not for creating Admin passwords or adding users.

Probably the quickest way to solve the problem is to backup your data, format the partition/hard drive, and do a clean install of Windows XP.

It's a pain, I know. But it should definitely solve the problem.

Sorry I couldn't be more helpful.

xp_cpl_file_assoc.zip

[AmyA]

That didn't do it either. And as it turns out, I can't access any control panel punctions at all - safe mode or otherwise. It's weird - I'm logged on with admin priveledges and get click thru the icons. If I switch to a non admin user account, they click thru just fine. It's almost like I have some weird preference set somewhere. Seemingly related problem, for example, on the desktop - I can't even right click past PROPERTIES (because I simply want to change my desktop image). Any ideas?

[AmyA]

Oops, "punctions" = "functions.

[AmyA]

And I meant to write "...can't CLICK thru the icons..." It's Friday!

[AmyA]

Actually, it looks like I can't access ANY executable files (e.g., malwarebytes, etc) when looged on with admin priveleges. And most exe icons (or shortcuts) are missing their graphic images.

[marktreg]

OK, that helps to explain a lot. What you have is a leftover exe file 'hijack' from the malware that was on your computer. This can sometimes happen when there are accounts with different privileges on the computer. But, as the problem is malware related, we are not allowed to advise users to run the necessary tools to fix the problem in the PC Help forum. I would suggest that you PM Kahdah, explain that when logged in as Admin all your exe files not working, and ask him to get your previous thread re-opened.

EDIT: Actually, I've just checked and your previous thread has not been closed yet. But I would still PM Kahdah and tell him before you post in that thread again, just to let him know.