Thursday, May 1, 2008

How to disable Windows Media Player from displaying full screen video on the second monitor screen ?

Problem Description: From last few days I have realised that when I run any videos in windows media player especially live video feed though internet, on the second screen the same video will be coming in full screen mode and there is no way to stop it, unless you stop Media player from playing the video.

Cause: Its something to do with video drivers, cards and windows combination.

Resolution:
To find this resolution it took me quite some time and I personally found full screen video very annoying.

My machine has Nvidia Quadro FX 540 display adapter, when I was going to the display properties I was not get as many option from NVIDIA as I was expecting . I thought of checking drivers update and to my surprise there was update available on the manufecturer's website.

I have updated drivers and restarted windows. Now I have small NVIDIA icon in the right botto of the screen along the local time display.

Method one: Right click on NVIDIA icon, click Nvidia control panel, near to the bottom there is a section called Video & Television, this has a subsection called Modify Full -Screen video options, click on it and in the right side pane there are two options available, click on "Only Show it in my viewing application" and apply settings. That is all what was needed.

Method two: in case you cannot find Nvidia icon there is another way to get to it, go to Start > Control Panel > Diaplay > Settings > Advanced > NVidia > now you will have the same options what are discussed in the method one above.

Registry editor is disabled on windows machine (Regedit.exe)

Problem Description: User cannot run regedit.exe as command to open registry editor.

Cause: There are different reasons for it please look below for more info

Resolution:
There are different reasons why you could be seeing this issue:

1. Because someone changes the group policy.
To fix this issue run the following command from the RUN box:

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

OR

use group policy editor: gpedit.msc from run box and then look for policy called "Disable registry editing tools " set it to not configured state and restart computer

2. This could also be caused due to different viruses/malware

to fix this there is a nice script from Symantec just use that
http://securityresponse.symantec.com/avcenter/venc/data/tool.to.reset.shellopencommand.registry.keys.html

even I could export my shell commands configuration in registry and send you as a TXT file but I think Symactec tool already does the trick for you.

Visual studio just -in -time debugger pop-up comes time to time

Problem description: Someone installed SQL Server 2005 and Visual Studio 2005, since these are installed they have started to get errors similar to the following:

...............................................................................................

Visual studio just -in -time debugger
...............................................................................................
An unhandled win32 exception occured in ieexplre.exe[528].

posiible debuggers:
New instance of visual studio 2005

.(combo button)set the currently selected debugger as the default.
.(combo button)manually choose the debugging engines

Do u want to debug using the selected debugger?

Yes No
...................................................................................................


Cause: Due to SQL 2005 seems like windows has decided to use Visual Studio debugger for the exceptions instead of sticking to Dr.Watson.

Resolution:
Just_in_time_debugger try to catch exceptions which are not being caught by the program or I could say missing some code. Some times these exceptions does not need to be caught (even though its not good practice for programmers) but because you have Just-In-Time debugger installed/configured it will not only catch it for internet explorer but for other applications as well. In short any application which will have exception which is not being caught you will get this error message. Click on when you see it. You do not need to debug IE.

There are few keys which controls Just-In-Time-Debugger try one of the following:

Please try one at a time only:

1. Go to command prompt using CMD command in run box.
on command prompt run the following Dr.Watson command command and restart computer

drwtsn32 -i

2. Use Regedit and navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger

Export Debugger hive and then delete it.

WARNING: this key might resolve this issue of debugger but It might not help you if you are trying to code something and looking for traping mishandled exceptions.

SSCVIHOST.exe - W32.Imaut.AY (Symantec/Norton) W32/Sohana-AO (Sophos) - How to remove it ?

Problem description:
As per few anti virus web sites this virus has symptom where Task manager will get disabled, there will be folders within folder with name "New Folder.exe" and there is unwanted disk movements on the machine.

Cause: This problem seems to be caused by a virus which uses SSCVIHOST.exe to spread itself.

Resolution: Try the following and let us know if this helps:

1. First of go to Safe mode of windows (f8 on the time of start of windows will show you options to choose safe mode), even though many things do not work in safe mode AV software are designed to work in safe mode. In safe mode AV software should be able to remove the viruses. This virus seems like using "SSCVIHOST.exe" binary.

2. Now once viruses are removed we need to find out what is disabled and what is not and also what is going on. If it would be me I will search for "SSCVIHOST.exe" in the registry all together and make sure where ever it is set to run we take that out and restore the original values.

(a) Check the properties of SHELL variable under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and make sure its set to "Explorer.exe"

(b) Make sure that there is nothing within Shared key located at
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares

if you like you can copy the following lines, paste into a TXT file, rename TXT extension to .reg and then merge it to your PC.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares]

(c) I have also heard that this binary adds itself to the yahoo messenger hives of registry:
Go to reg hive HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
On your tight hand side you will see "Yahoo! Pager" reg key its original value is [ "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet ] without braces.


(d) In case if you have Task manager disabled or reg tools disabled use the following:
You might can use the following to restore policies configured on your machine.

Copy the below lined to notepad, save it as policies.reg, and then double click on the file created to merge it

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoWindowsUpdate"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=dword:00000000


NOTE: Usually when SSCVIHOST.exe will be deleted virus will not spread any more, BUT since reg entries had reference to this binary they will show errors. That is why we want to clean the registry keys.