[MrKowz]

Hey all, having an odd problem.

When I boot up my computer, my desktop keeps disappearing, when I ctrl+alt+del, it doesnt reappear, but the Windows Task Manager does. I can choose file and run, try to open something and the desktop appears for about 10 seconds, then disappears again. I cannot use my taskbar, and when I try to open a program, it will load about half of the time. Recently, I installed Windows Blinds (which I have now uninstalled because the problem started shortly after I installed that.

Another problem, which I don't know if it is related... I recently started playing a game called Gunbound. Millions of people play the game, so I am sure it is not a virus in disquise, but I was getting a lot of rundll32.exe errors. Could this error be related to the problem I am having with the desktop?

I am on the messed up computer now, so I should be able to get any reports from HiJack This!, any scans done, etc. to help diagnose the problem further. So far, I have completed a virus scan with Norton Antivirus, and did a registry and program integrity scan with Norton Utilities (One Button Cleanup) and am scanning with Ad-Aware. So far, nothing has been found.

Thank you in advance,
~Keith

[MrKowz]

Quick update:

I have gone into the msconfig and disabled all non-microsoft startup items. Now, my desktop will disappear for ~2 second, and reappear for 10 seconds or so, then disappear again, recycling the process.

[devil_himself]

Click Start, click Run, type eventvwr.msc in the Open box, and then press Enter.
Click the Application category.

Look For Recent Errors > Double Click on them > Another Windows Will open > On the Right Side use the Double Notepad icon to copy the error paste them here

[MrKowz]

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 5/11/2008
Time: 6:06:52 PM
User: N/A
Computer: ICHIGO
Description:
Faulting application ctfmon.exe, version 5.1.2600.2180, faulting module unknown, version 0.0.0.0, fault address 0x5c70b549.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 63 74 66 ure ctf
0018: 6d 6f 6e 2e 65 78 65 20 mon.exe
0020: 35 2e 31 2e 32 36 30 30 5.1.2600
0028: 2e 32 31 38 30 20 69 6e .2180 in
0030: 20 75 6e 6b 6e 6f 77 6e unknown
0038: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0040: 20 61 74 20 6f 66 66 73 at offs
0048: 65 74 20 35 63 37 30 62 et 5c70b
0050: 35 34 39 549
--------------------------------------------------------------------------------
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 5/11/2008
Time: 6:42:40 PM
User: NT AUTHORITY\SYSTEM
Computer: ICHIGO
Description:
Windows saved user ICHIGO\Keith registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------------------------------------------------------------

Also under the System Tab:


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 5/11/2008
Time: 6:58:22 PM
User: N/A
Computer: ICHIGO
Description:
The LogMeIn Kernel Information Provider service failed to start due to the following error:
The system cannot find the path specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
----------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 5/11/2008
Time: 6:50:06 PM
User: N/A
Computer: ICHIGO
Description:
The Ulead Burning Helper service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-----------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 5/11/2008
Time: 6:49:54 PM
User: N/A
Computer: ICHIGO
Description:
The Viewpoint Manager Service service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
---------------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 5/11/2008
Time: 6:49:46 PM
User: N/A
Computer: ICHIGO
Description:
The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
----------------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 5/11/2008
Time: 6:49:44 PM
User: N/A
Computer: ICHIGO
Description:
The Automatic LiveUpdate Scheduler service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
------------------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 5/11/2008
Time: 6:49:34 PM
User: N/A
Computer: ICHIGO
Description:
The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 5/11/2008
Time: 6:49:28 PM
User: N/A
Computer: ICHIGO
Description:
The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
---------------------------------------------------------------------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 5/11/2008
Time: 6:49:06 PM
User: N/A
Computer: ICHIGO
Description:
The LogMeIn Kernel Information Provider service failed to start due to the following error:
The system cannot find the path specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

[devil_himself]

Download And Install "User Profile Hive Cleanup Service"
http://www.microsoft.com/downloads/d...displaylang=en

[MrKowz]

Hmm... rundll32.exe is no longer in my process list... could all this have stemmed from a corruption with that file?

[devil_himself]

Run System File Checker To Look For Corrupted Or Missing Files

Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)
http://support.microsoft.com/kb/310747

[MrKowz]

Hmm... need to find my Windows XP disc... this might take a while.

Update: WOOHOO! Found it! *fixing files*

[MrKowz]

Hmm... still not working. I was browing in the forums earlier and saw a link to a program that would export all your current processes into a .txt file for posting here. I will do that... cause I see a few odd ones I have never seen... (Also downloading AVG)

[MrKowz]

Here is the startup list:

Name: Symantec PIF AlertEng
Path: "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: Zboard
Path: C:\Program Files\Ideazon\ZEngine\Zboard.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: UVS11 Preload
Path: C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: SsAAD.exe
Path: C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: SoundMan
Path: SOUNDMAN.EXE
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: Share-to-Web Namespace Daemon
Path: c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: QuickTime Task
Path: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: osCheck
Path: "C:\Program Files\Norton AntiVirus\osCheck.exe"
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: nwiz
Path: nwiz.exe /install
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: NvMediaCenter
Path: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: NvCplDaemon
Path: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: LVCOMSX
Path: C:\WINDOWS\system32\LVCOMSX.EXE
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: LogitechVideo[inspector]
Path: C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: LogitechCameraService(E)
Path: C:\WINDOWS\system32\ElkCtrl.exe /automation
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: LogitechCameraAssistant
Path: C:\Program Files\Logitech\Video\CameraAssistant.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: Logitech Hardware Abstraction Layer
Path: KHALMNPR.EXE
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: iTunesHelper
Path: "C:\Program Files\iTunes\iTunesHelper.exe"
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: IPHSend
Path: C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: HostManager
Path: C:\Program Files\Common Files\AOL\1139896625\ee\AOLSoftware.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: ccApp
Path: "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: BluetoothAuthenticationAgent
Path: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: KernelFaultCheck
Path: %systemroot%\system32\dumprep 0 -k
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: Yahoo! Pager
Path: "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: WMPNSCFG
Path: C:\Program Files\Windows Media Player\WMPNSCFG.exe
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: updateMgr
Path: "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: Steam
Path: "c:\program files\valve\steam\steam.exe" -silent
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: LDM
Path: C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: ctfmon.exe
Path: C:\WINDOWS\system32\ctfmon.exe
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: Adobe Reader Speed Launch
Path: C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE
Location: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp
Status: Enabled
------------------------------------------------------------------------------------------

Name: BTTray
Path: C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe
Location: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp
Status: Enabled
------------------------------------------------------------------------------------------

Name: Logitech Desktop Messenger
Path: C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LOGITE~1.EXE -startup
Location: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp
Status: Enabled
------------------------------------------------------------------------------------------

Name: Logitech SetPoint
Path: C:\PROGRA~1\Logitech\SetPoint\KEM.exe
Location: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp
Status: Enabled
------------------------------------------------------------------------------------------
Total 32 Items

[MrKowz]

Ok, got AVG on there, it found the Trojan.Vundo virus... i'm doing a full system scan with AVG now. But yea... still no desktop. Now the desktop shows once when I start up, it goes away, and it stays away. No taskbar, no icons... just wallpaper.

[MrKowz]

Looks like the Vundo trojan was causing it. I removed that, restarted, and desktop is staying up! I'm gonna go ahead and mark the thread as solved. Thanks for the help!