Can't Access Any Documents On The Desktop

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

10CFR

Thread Starter
Joined
Mar 11, 1999
Messages
35
My home phone rings and I'm in computer hell again. Somehow I inherited this. Looks like I've become the office 'guru'. People seem to imbue me with more intelligence and knowledge than I have. I'm just up against the wall of my stupidity on this one, maybe one of you kind souls can help...

My boss just called me at home and the work computer is screwed up (again) - pretty bad this time. (It was working o.k. Sunday morning when I left.) My boss said he can't access any of the Word or Excel documents on the desktop. He was able to get into them (very slowly) via 'my computer' when I walked him through it on the phone, but not by clicking on the icons on the desktop. He says the system is running real slow, but the programs seem to work (our proprietary scheduling programs and record keeping programs are o.k.) . I didn't have my hands on it to look at anything else. He said he got a couple of 'desktop recovery' errors, and also, it said something about internet explorer encountering a problem and the active desktop being disabled. When he tried control-alt-delete, it told him explorer was 'not responding'. He found a new shortcut to internet explorer on the desktop (???) I sometimes find a lot of those, usually for Word, and those are down in the my documents directory. (I usually find those after the boss has been using it). It won't let him run AVG virus scanner. I'm going in early tonight, or tomorrow morning to look at it and look at the programs that are starting up when it starts. Defrag has been really hard to run - have to run it from safe mode and it still keeps restarting. Same with scandisk. I had him reactiveate the active desktop andit didn' t help or seem to change anything.

**** The town's people are lighting torches, picking up pitchforks, and starting to mutter & point in my direction . . . it aint lookin' good fer me here. . . ****

Any ideas (other than re-install windows) would be appreciated.

:confused: :confused:
 

10CFR

Thread Starter
Joined
Mar 11, 1999
Messages
35
Okay. I'm back, after having gotten my hands on the beast for a while.

I ran AVG and it found no virus. I also turned off AVG and ran Trend's Housecall, which also found no virus. I ran AdAware and it found one instance of "Alexis" which it removed with its usual precision.

The shortcuts to the excel and word documents are working but very slowly. If you open Excel or Word and then open the documents from within the programs they work normally, and the documents do not appear corrupted.

I have diffuculty getting into the Control Panel, or virtually anything that affects the system, such as task bar attributes - again, very <i>very</i> slow. Applications, however, are running o.k. Internet Explorer and Outlook express work fine on-line. (????)

Here are some of the <i>many</i> errors I received. The following are BSOD's:

"A fatal exception 0E has occurred at 0028:00000009"

"...0E 0028:C002F731 in VXD NTKERN(01)+0000E351"

"0E at 0028:C001545a IN VxD - - -, This was called from 0028:C14FD08A in VXD - - -, It may be possible to continue normally . . ."

Then, when I try to shut down the machine, I also got a lot of these: "Notification WND for RNAdmin - not responding"

Also rndll32.dll not responding (not sure on the filename of that one - didn't write it down), Explorer hangs then shows in the task manager as 'not responding,' and several other system programs hanging - I'll have to make a more precise list - it was overwhelming.

I turned active desktop off and restored as many defaults in Folder Options as I could think of, including resetting all folders. This neither helped nor hurt.

The system locked up several times when I tried to enter changes to the display properties in Control Panel.

I tried the System Configuration Utility to disable anything I thought looked suspicious in the startup files - no good - no difference. One of my co-workers recently installed synchronization and connection software for his new palm-sized computer. I disabled that temporarily, but it made no difference. He also has a few games on the system (I consider games to be <i>highly</i> suspect in goofing-up system files and settings, but I couldn't pinpoint anything. Most recently, his temp intnernet files show he has been a website called 'cyber-cop' and downloaded some demo software - which I could not find on the system anywhere - it may be some sort of covert software, I didn't have time to go into the site and examine it - it's on my list for next session on the machine.)

I tried the System File checker and found setupx.dll corrupted, so I backed it up and restored it from the Windows 98 disk. No difference.

I examined the system using the System icon in Control Panel, and in the System Information program and found no problem devices.

I ran Compaq diagnostics and found nothing wrong.

I could not get the system to come up in Safe Mode. It will be interesting to see if the icons work in Safe Mode.

I examined the system history in the CPQ diagnostics and also using the System Information program, and I saw a couple of possibly suspicious changes, but I don't understand too much of what I'm looking at.

I can't find all the resource disks I would need to reinstall the system. i'm sure they have them (or did have them) as everything is properly licensed, but the $64 question is "what did they do with them??" I am going to give my boss a list of the missing resource disks which I would need. Hopefully, they are floating around the corporate office and not lost. My boss is going to contact the VP's office and request the disks.

What a headache.:mad:
 
Joined
Oct 3, 2002
Messages
2,281
I know this may sound too naive, but its just a possibility so I thought I may just point it out to you.

Did you realise that it may be a prank played upon you? Someone might have just taken a screen shot and then put that image as a desktop picture. Then, the icons must have been hidden which can be so easily done through Control Panel > Display > Effects OR Right Click on Desktop > Properties > Effects. Change the backgound picture and see if the icons still remain there.

Of course this is just a remote possibility and I know it sounds way too naive. :rolleyes:
 
Joined
Sep 27, 2002
Messages
867
If you have Real Player installed.

The error you're receiving is most likely caused by Real Player.

The background programs it runs are not necessary and cause system slow downs and errors.

Goto http://www.lurkhere.com/~nicefiles/

Download StartupList 1.51 and run it.

Copy & paste back in this post the list so someone can look at what you have running in the back ground.
 

10CFR

Thread Starter
Joined
Mar 11, 1999
Messages
35
Thanks for your response.
No, it's not a prank - I'm not <i><b>that</i></b> dumb. (actually, that's the first thing I checked) The shortcuts work, just real slow.
I'll run get & run startup list and get back to you, but it might be Friday until I get back on the system.
Yes, he's installed a bunch of RealPlayer junk and some other 'players' also.
Thanks again.
 
Joined
Oct 4, 2002
Messages
2,773
Adaware found 1 item ?

I hope you were running the new adaware 6 and not the old version

steam
 

10CFR

Thread Starter
Joined
Mar 11, 1999
Messages
35
startup log follows:

StartupList report, 2/14/03, 7:29:15 AM
StartupList version: 1.51
Started from : C:\WINDOWS\TEMP\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v5.51 SP2 (5.51.4807.2300)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\CPQDIAG\CPQDFWAG.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\PROMON.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\WT\UPDATER\WCMDMGR.EXE
C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\TEMP\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = c:\windows\scanregw.exe /autorun
TaskMonitor = c:\windows\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SBPCISetup = C:\SBPCI\sbsetup.exe
EnsoniqMixer = starter.exe
Promon.exe = Promon.exe
StillImageMonitor = C:\WINDOWS\SYSTEM\stimon.exe
msdos423 = c:\windows\msdos423.exe
AVG_CC = C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
TkBellExe = C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
QuickTime Task = C:\WINDOWS\SYSTEM\QTTASK.EXE
wcmdmgr = C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
CPQDFWAG = C:\WINDOWS\cpqdiag\CpqDfwAg.exe
HC Reminder = hc.exe
winmodem = WINMODEM.101\wmexe.exe
Avgserv9.exe = C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
MiniLog = C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE -service

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ModemInstallAssistant = D:\SUPPORT\MODEMINSTALL.EXE
H/PC Connection Agent = "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 10/2/2003, 14:12:38)

[rename]
c:\windows\SYSTEM\crypt32.dll=c:\windows\SYSTEM\crypt32.001
c:\windows\SYSTEM\schannel.dll=c:\windows\SYSTEM\schannel.001
c:\windows\SYSTEM\softpub.dll=c:\windows\SYSTEM\softpub.001
c:\windows\SYSTEM\vbscript.dll=c:\windows\SYSTEM\vbscript.001
c:\windows\SYSTEM\shell32.dll=c:\windows\SYSTEM\shell32.001
c:\windows\SYSTEM\USER.EXE=c:\windows\SYSTEM\USER.001
c:\windows\SYSTEM\user32.dll=c:\windows\SYSTEM\user32.001

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

C:\PROGRA~1\GRISOFT\AVG6\bootup.exe
SET BLASTER=A220 I7 D1 H7 P330 T6
SET SBPCI=C:\SBPCI

--------------------------------------------------


Enumerating Task Scheduler jobs:

Tune-up Application Start.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job

--------------------------------------------------

Enumerating Download Program Files:

[QuickTime Object]
InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[CamImage Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\AXISCAMCONTROL.OCX
CODEBASE = http://66.181.170.109/axiscam/Codebase/AxisCamControl.ocx

[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CWDL_DOWNLOAD.DLL
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37634.6350115741

[CMV5 Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CPNMGR.DLL
CODEBASE = http://www117.coolsavings.com/download/cscmv5X.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab

--------------------------------------------------
End of report, 6,259 bytes
Report generated in 0.193 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
 

10CFR

Thread Starter
Joined
Mar 11, 1999
Messages
35
'Hijack this' log follows:
Logfile of HijackThis v1.91.2
Scan saved at 7:15:07 AM, on 2/14/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.dogpile.com/index.gsp
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SBPCISetup] C:\SBPCI\sbsetup.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\stimon.exe
O4 - HKLM\..\Run: [msdos423] c:\windows\msdos423.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINDOWS\cpqdiag\CpqDfwAg.exe
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [MiniLog] C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE -service
O4 - HKCU\..\Run: [ModemInstallAssistant] D:\SUPPORT\MODEMINSTALL.EXE
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://66.181.170.109/axiscam/Codebase/AxisCamControl.ocx
O16 - DPF: {4226E9B7-D637-40E8-893A-13298AB41477} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37634.6350115741
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://www117.coolsavings.com/download/cscmv5X.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab
O18 - Protocol: lbxfile - {56831180-F115-11D2-B6AA-00104B2B9943} - c:\PROGRAM FILES\LIBRONIX DLS\System\FileProt.dll
O18 - Protocol: lbxres - {24508F1B-9E94-40EE-9759-9AF5795ADF52} - c:\PROGRAM FILES\LIBRONIX DLS\System\ResProt.dll
 
Joined
Sep 27, 2002
Messages
867
10CFR,

Personally I'd stop these from starting,

Read HERE about TkBellExe and the effect evntsvc.exe can have on a pc, also they have recommendation about it.

wcmdmgrl.exe also fonud HERE
 

10CFR

Thread Starter
Joined
Mar 11, 1999
Messages
35
Done. Followed all your recommendations - system is running good again! I think the main culprit was RealOne Player - removing that did the most good.

The virus indication was from a virus I cleaned last August. I ran Trend Micro Housecall again with negative results, and AVG again also with negative results. There was a remaining file which I deleted, and the value remained in the registry, which I (very carefully) edited to remove it. No sign of the virus now. I'll check again in a couple of days. If it was still there, you'd think one of these good virus scanners would find it.

I'd like to thank you all for the help. You really got me through a week of nerve-wracking problems with this system.

-s:)
 
Joined
Sep 27, 2002
Messages
867
Your Welcome! 10CFR,

Real Player can be a real pain, at least that has been my experiance. Real Player and I have never been on good terms. :D

Glad system is running good again, and glad you didn't have a virus. :D :D :D
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top