Tech Support Guy banner
Status
Not open for further replies.
1 - 20 of 28 Posts

·
Registered
Joined
·
62 Posts
Discussion Starter · #1 ·
I am not positive what all is related & what is a separate problem. Sometimes (for no apparent reason) my desktop will go blank (just wallpaper- no icons, taskbar, etc.), then everything will reappear (task manager won't respond while it's blank either). The only thing different is on my taskbar, after it has done this, some of my icons(random ones) will be missing or the arrow to show the hidden ones will be gone. I also often will start running worse until I log off & back on. This started happening every once in awhile(maybe 1-2 times a week) approx. 1&ahalf months ago. Suddenly, here in the last week or two, it started happening alot more. Then in the last 3 days, it has been doing it ALOT (at times, more than once an hour). I had thought it may of had something to do with my home network card (<--3months old) maybe being bad because I knew lately if I did anything w/my local network (enable it, disable, repair), it seemed to do it approx. 4 out of 5 times at least, but it does it now nomatter what I'm doing(it has done it 1time so far since I started this post). I don't even have to be connected to the internet! I can be on a webpage, on "my computer", or I don't have to be doing anything!!! Just in case it did have anything to do with my local network, I unplugged my network card & deleted the local network & it still did it. System Restore didn't work, my video card(ATI RAGE mobility) is up-to-date, I haven't installed anything lately. I've ran trojanscan, Panda & housecall (plus my resident antivirus), but everythings clean. Now when it does it, I normally have to log off & on real soon after because it won't run good after in blanks out. HELP...It's driving me crazy!

The second problem is for no reason at all, about 3 wks ago, my log on/log off changed. Instead of the blue screen, now a blue Window Log On popup comes up(the background is still black) & asks for password. My password (nor any other password that I know) won't get anything. Instead I leave "password" blank & hit OK to log on. I have already went to control panel where you change how users log on, etc... but still the same thing. It log on the normal way 1 day, then the Windows popup the next. System Restore didn't work either. Any Ideas???
Thank you for any suggestions
 

·
Registered
Joined
·
5,520 Posts
Howdy angelgabbby...

Yes...post a hijack log, it may help...

Also the video is a ATI RAGE mobility, this I think is in a Laptop, correct ?

ATI's RAGE MOBILITY family provides exceptional performance notebook graphics
http://www.ati.com/products/mobility/features.html

If so please post the make and model of the laptop...
 

·
Registered
Joined
·
62 Posts
Discussion Starter · #4 ·
It is a laptop, it's a Gateway Solo 9300 Pro
I think I ran "Hijack This" correct. Here is it's log:

Logfile of HijackThis v1.97.7
Scan saved at 4:56:05 AM, on 3/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\Winamp3\winampa.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Excite\PrvtMsgr\bin\x8SkPlay.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Excite\PrvtMsgr\bin\x8IMPipe.exe
C:\Program Files\gamingclubMPP\MPPoker.exe
C:\downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://registration.excite.com/excitereg/login.jsp?ref=email&return_url=http://e9.email.excite.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: Dogpile Toolbar - {5E92F538-B50B-46c5-9C5F-C6EECED3F6C6} - C:\Program Files\DogpileToolbar\ultrabar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Excite Community Tools Notifier] "C:\Program Files\Excite\PrvtMsgr\bin\x8SkPlay.exe" Notifier
O4 - Startup: DLHelperEXE.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: Dogpile Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\DogpileToolbar\contextsearch.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {11111111-2222-3333-4444-555555555555} - https://www.taxsimple.com/citrix/federal.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version7/dlhelper.cab
O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} (InstallShield Setup Player 2K2) - http://www.kscasino.com/CasinoCentral/webinstall/kscasino/setup.exe
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/mpp_204/webolr/OCX/FlashAX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{735A258C-0153-43E5-B395-40CBB8870AD6}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{8EB5809E-7AA0-470E-BCCD-111606B098A9}: NameServer = 65.38.1.2 65.38.1.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{735A258C-0153-43E5-B395-40CBB8870AD6}: NameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{735A258C-0153-43E5-B395-40CBB8870AD6}: NameServer = 192.168.0.1

Thank you very much for any suggestions
 

·
Registered
Joined
·
5,520 Posts
Hmmm...

Don't see anything in the log that would cause this...

Can you right click on My Computer - Manage - Event Viewer - and check in "Application" for any errors, also check in "System" for any errors...

It sounds like for some reason, Explorer is shutting down and restarting after an error...
 

·
Registered
Joined
·
62 Posts
Discussion Starter · #6 ·
On my event viewer under application, it does show an "Information" icon. When I click it, I get a "properties" screen to come up. It says...
Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1002
Date: 3/27/2004
Time: 7:20:46 AM
User: N/A
Computer: GABBY
Description:
The shell stopped unexpectedly and Explorer.exe was restarted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-----------------------------------------------------------------------------------
I go to help & support & all it says is...
Details
Product: Windows Operating System
ID: 1002
Source: Winlogon
Version: 5.0
Component: Application Event Log
Symbolic Name: EVENT_SHELL_RESTARTED
Message: The shell stopped unexpectedly and %1 was restarted.

Explanation
The shell was stopped and then restarted. By default, the shell is explorer.exe; however, you might have a customized shell.

User Action
No user action is required.

Version: 5.2
Symbolic Name: EVENT_SHELL_RESTARTED
Message: The shell stopped unexpectedly and %1 was restarted.

Explanation
The shell was stopped and then restarted. By default, the shell is explorer.exe; however, you might have a customized shell.

User Action
No user action is required.
-----------------------------------------------------------------------------------
It, of course, doesn't bother to say WHY my explorer is shutting down or WHAT to do to fix it.
Any ideas???
Thank you very much for your help!
 

·
Registered
Joined
·
62 Posts
Discussion Starter · #8 ·
I came up clean by Housecall and under "system" it doesnt leave any red errors or yellow warnings. I haven't tried in safe mode yet (I will this evening). I guess if all else fails, couldn't I use my XP CD, I do the repair install option? Or would that work???
 

·
Registered
Joined
·
62 Posts
Discussion Starter · #9 ·
In safe mode, it didnt happen to do it. So, either it wouldn't in safe mode OR it just didn't at the time today.
???????????????????????????????????????????????????????????
 

·
Registered
Joined
·
5,520 Posts
Hmmm...

Well, you could try it for a little while longer, but if it doesn't happen in Safe Mode, then it is more than likely a driver or application issue somewhere...

As far as doing a repair install, it should work ( although without actually knowing what is going on, it's hard to tell )...

Forgot to ask, are there any red errors in Application, in the Event Viewer ?

This information event does intrigue me...

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1002
Date: 3/27/2004
Time: 7:20:46 AM
User: N/A
Computer: GABBY
Description:
The shell stopped unexpectedly and Explorer.exe was restarted
It does show that Explorer did restart...

Hmmm...all three are from Winlogon...

Just as a test can you create a new user account, and log on with that account, and see if it will happen under that new account...

Also I'm not familiar with Excite's Instant Messenger, might try uninstalling that, just for a test...
 

·
Registered
Joined
·
5,520 Posts
Hey...no problem on the help :D ( hopefully some one will jump in with more/better advise )...

But this is a strange problem to me, and I would like to see the resolution to it...
 

·
Super Moderator
Joined
·
43,959 Posts
It does sound a lot like a graphics card problem. It's possible that the card is dying, though it sounds like a driver problem. You might want to uninstall the drivers and reinstall them.
 

·
Registered
Joined
·
62 Posts
Discussion Starter · #14 ·
I made another user account and have been using it since with no problems yet. I however also haven't been on the computer near as much today as usual. I figure I'll keep on the new user as much as I can the rest of tonight (until I go to bed) & tomarrow and see if it does it.
If it was a driver, wouldn't it do it on the new user acct. too?
I haven't tried uninstalling the driver yet, I had already tried updating it & tried rolling it back, but neither helped.
 

·
Registered
Joined
·
5,520 Posts
Yes...if it was a driver issue it should happen with the new user as well...

Let's see what with the new user account, I've a lot of strange things happen with corrupt user profiles...
 

·
Registered
Joined
·
2,187 Posts
I go with graphics problem too... I remember in 'fun days' :p when I had WinME I thought I was doing a good thing updating my ATI card driver, but thats when all hell broke loose.... an alert techie informed me it wasn't specifically compatible with some other driver[?] or something. So I went back to the former driver and all was hunky d. again.... My guess is try your old ATI driver again and see what happens... then do a bit off tracking down on internet to see what other items u have on laptop maybe not co-habiting with the updated grafix card....if this is the case.
 

·
Registered
Joined
·
62 Posts
Discussion Starter · #17 ·
Well, so far it still hasn't messed up w/me on the new user (& earlier when I switched back to my original for a few, it did still flip out again). I really didn't get to be on the computer much in the last day or two, but tonight I will be for quite a while. I'm going to stay tonight on the new user & to give it more time to see if it does it. If not would my best bet be just to leave well enough alone & just use the new user permenantly (& leave it as "1 of those unanswered weird things computers do @ times for no earthly reason") or should I continue to try to figure out what is the malfunction???
 

·
Registered
Joined
·
5,520 Posts
Well...

should I continue to try to figure out what is the malfunction???
It's up to you, it's been my experence on corrupt profiles, is that either something gets corrupt in the registry ( I'm kind of betting on this one ), or in the NTuser.dat in the user profile...

Let's leave it on the new user for now, and see if it comes back...

If it doesn't we can try ( sometimes it works sometimes it don't ) to repair it in the registry on the old user profile, because I don't think the Ntuser.dat file can be repaired...
 

·
Registered
Joined
·
62 Posts
Discussion Starter · #19 ·
Well I deleted my old profile & repaired windows so my display is fine (including I have my blue screen back for my logon logoff) but as soon as I connected, a window popped up saying my computer would be restarting due to RPC(remote Protocol). When it was shutting down, my antivirus came up with worm nachi.b.1. I deleted both files (C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KLYO0P6P\wkspatch[1].exe & C:\WINDOWS\system32\drivers\svchost.exe). Not long after that, they came up again. After I deleted them again, I went to PandaScan & got their removal tool for it. It supposedly removed it, however it hasn't. I also got a removal tool off of an article on www.pcmag.com, but I still get the worm to popup SEVERAL times. Trendmicro's scan couldn't find it. How do I permeanantly remove it?
 

·
Registered
Joined
·
2,326 Posts
Before you run the removal tool,you must shut off system restore,as a copy of the worm will be in there also.Re-start restore after running the tool.
 
1 - 20 of 28 Posts
Status
Not open for further replies.
Top