[Nebulousity]

This is one of those problems that is difficult to search for, though I tried pretty hard.


Facts:

• When multiple programs are running, if I click an icon on the taskbar to switch to that program, the icon just blinks. Sometimes when I have the problem, if I quickly click it 4 or 5 times it will switch. Other times, that doesn't help. I have to use ALT+TAB to switch programs.
• Restarting the computer or logging off/on corrects the problem. Shutting down all running programs and opening them again doesn't help.
• Has been happening for a long time, but I'm fed up with it today
• Happens only sometimes, but I can't find a common variable between the occurrences and I can't reproduce it on demand
• WinXP Home (multiple accounts, but only one person needs logged in when problem occurs)

Any ideas?

Thanks

[Arctik]

May seem simple, but have you ran virus/spyware scans lately?
I had a problem similar to this before, which meant that the taskbar didnt function correctly. Turned out to be a virus causing the problems.
Make sure you run the virus/spyware scan in safemode.

[Nebulousity]

Arctik:

Thanks for the reply. I run Spybot and AVG every day, and use Zonealarm as a firewall.

I don't as often run Spybot or AVG in Safe Mode -- I do sometimes, but it's been about a month.

I'll run them again this evening in Safe Mode and report back whether that helps. I'm skeptical (only because the problem has existed since before the last time I did that), but it's worth a try.

It must be some TSR (malware or not) that is interfering.

Thanks again. Other suggestions welcome.

[Jeruvy]

TSR is a old pre-NT term for Terminate and Stay Resident. Today we use 'services' (or at least call them that).

I would highly consider a keylogger or other spyware is the problem, this is not natural.

You claim that rebooting the PC fixes the problem. I take it that it returns? Is there anything in the event viewer from boot time to this event that may shed some light? Unnatural errors that sort of thing?

[Nebulousity]

Jeruvy:

It could potentially be a spyware program that Spybot can't find. As I mentioned, this has been going on for some time now -- most of a year. It's one of those things that doesn't happen often enough for me to have made it the highest priority. I would expect that if it were malware, Spybot would have learned of it by now. Again, I'm not ruling it out -- just sharing my thought process with you. I'll be running Spybot and AVG in Safe Mode this evening.

As for rebooting and it returning -- it only happens once in a while. I may have days where I don't have to deal with it, then I see the problem occur again. So it does return, but not necessarily that day.

Another symptom I might mention here that may or may not have any relationship -- again, this is XP Home and we have multiple accounts. My wife may have used the computer last in her account. Then some time later I go to log into my account. What I'll sometimes see (again, not predictably) is Windows try to log me in -- it will show the picture of my son I use as my wallpaper, icons, and the prigrams that are running -- and then it reverts back to the login screen where I have to log in again. This ONLY happens when I have already been logged in -- not when I log in fresh. And it only happens when someone else has been using their account and are still logged in.

Strange stuff. That's been going on intermittently for most of a year, too.

I appreciate everyone's continued help.

[Jeruvy]

This latter problem I've seen a lot of recently, but haven't been able to isolate the problem. It's likely a broken login process due to malware but I cant' say for sure.

In each case either a backup or system restore to a previous point managed to restore normal operation.

We found signs of Beagle, but no correlation. Since explorer.exe is becoming a great target I'd go with taking the system offline, and scanning from a livecd environment or moving the disk to a clean system and scanning it there.

Good luck,

[Nebulousity]

I did run AVG and Spybot in Safe Mode. I ended up with a much bigger, more critical problem. I have put that in this thread. If you have any help to offer, I'd be very grateful.

-N

[Jeruvy]

Well I think you have a bigger problem. I'll go peek at the thread you outlined, but we'll put this one to bed here.

[Nebulousity]

Believe it or not, after all that I still have the same problem.

In the other post, I detailed what happened when I ran AVG and Spybot from SafeMode. AVG gave a clean report, but SpyBot found some sort of malware called W32/GGDoor and removed it. In the process, my registry got messed up such that Windows logged me off as soon as I logged on. I had to use Bart's PE to get into the registry and correct the change made to my userinit.exe entry (which had evidently been modified by W32/GGDoor).

After many hours, I got my PC back up and running. But would you believe I still have the same symptom I originally had?

My guess is that it's some legitimate TSR...ahem...service that is running and messing with me. But darned if I can figure out which one.

Thanks again for everyone's responses so far, but this post is still open.

[vicks]

you might try the following:
http://www.trendsecure.com/portal/en...ools/housecall and have it do a scan on line....
vicks

[Jeruvy]

I agree, nothing was done in the other thread. Run an online scan, then go ahead and install Hijack This and post a HijackThis log to this thread.

http://www.download.com/Trend-Micro-...-10227353.html

Install it to a permanent location, then run it.

Select 'Main Menu' and then select ' Do a system scan and save a log file'.

Post the content of that log file in a reply. Additionally any output from a online virus scan (or if you can save it to a log).

[Nebulousity]

Unfortunately, House Call was unable to complete, even though I told ZoneAlarm and AVG to allow it. I tried both the Java applet and the BHO versions of the tool. I may need to try again later -- I'm suspecting it was just a connectivity/traffic issue.

Here's my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:19:50 PM, on 7/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Fast.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {69A87B7D-DE56-4136-9655-716BA50C19C7} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: &Google Notebook - {CCCCCCD3-666F-4F81-8B69-745DE9F6D897} - C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-1979235055.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: Bloglines BHO - {F128ED4D-364F-46D3-9E4C-1F3922A43A05} - C:\Program Files\BloglinesBHO\BloglinesBHO.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Google Notebook - {CCCCCCDB-4DDB-4703-95D4-DD2C526397BF} - C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-1979235055.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9FA.EXE /P30 "EPSON Stylus Photo R320 Series" /O6 "USB001" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Note this (Google Notebook) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-1979235055.dll/gn_menu1.html
O8 - Extra context menu item: Note this item (Google Notebook) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19-1979235055.dll/gn_menu2.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: *.dreamhost.com
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedIn...derControl.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-36.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1097203362983
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1129165305712
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CLQPZKJKBL - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\CLQPZKJKBL.exe (file missing)
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: PLQARF - Unknown owner - C:\DOCUME~1\JB0176~1\LOCALS~1\Temp\PLQARF.exe (file missing)
O23 - Service: RYYZWWIN - Unknown owner - C:\DOCUME~1\JB0176~1\LOCALS~1\Temp\RYYZWWIN.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 9515 bytes

[vicks]

Now you will need to wait for one of the 'experts' with the gold shield beside their name to analyze the HJT log and reply to what to do. This may take a bit, everyone here is a volunteer so sometimes it can be a while before you get the help you anxiously await.
good luck
vicks