1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Window appears on Desktop at Bootup

Discussion in 'Windows XP' started by Pancakes, Jan 22, 2005.

Thread Status:
Not open for further replies.
Advertisement
  1. Pancakes

    Pancakes Thread Starter

    Joined:
    Jan 22, 2005
    Messages:
    8
    Am running Windows XP Home Edition. For the past week when booting up PC a small window with red X appears on desktop. I have scanned with my NAV as well as several free online sites and all come back problem free. I have also ran Adaware and Spybot which both come back clean.

    Have looked in System Event Viewer and see nothing unusual listed. Checking task manager I do not see any new programs running and have not added any new programs since the time this error first appeared. Have done a system restore back to date before this problem occured, but it did not alleviate the problem.

    I am wondering if this could be a desktop issue. My son had changed the desktop them (used a picture he saved) although has since changed back to a standard theme. Have done a screen capture of this window on my desktop and saved the file in Paint, but I am not familiar with posting images and the instructions in your FAQ are not clear to me. Any suggestions would be most appreciated.
     
  2. bobol

    bobol

    Joined:
    Jan 28, 2004
    Messages:
    2,187
    hmmm, odd one... nicely attached pic though. See if anything out of place in Desktop Properties under Desktop/Customise... maybe something added there or an active desktop that's no longer appropriate-disabled.
     
  3. Pancakes

    Pancakes Thread Starter

    Joined:
    Jan 22, 2005
    Messages:
    8
    I'm really not sure if this has to do with the desktop or not, it was just a thought when searching for cause of this error? window. I have looked in desktop properties and don't see anything unusal there.

    Any other ideas what the cause of this might be :confused:
     
  4. EAFiedler

    EAFiedler Retired Moderator

    Joined:
    Apr 25, 2000
    Messages:
    14,172
    Hi Pancakes

    Start > Run
    key in:
    msconfig

    Do you see anything new, set to run at Start Up?

    Also, check your inside your Startup folder.
    Start > Programs > Startup

    Let us know what you find.
     
  5. Pancakes

    Pancakes Thread Starter

    Joined:
    Jan 22, 2005
    Messages:
    8
    Hi, yes I have checked MSconfig and Startup folder and don't see anything irregular there. As mentioned in my first post have done numerous anti-virus scans as well as spyware scans which all come back clean and normal.
     
  6. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Create a new, permanent folder for HijackThis and save the file to that. Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

    Direct HijackThis download link: http://www.spywareinfo.com/~merijn/files/HijackThis.exe


    Are you using "selective" or "normal" startup in msconfig? If Selective, look under the startup tab and make a note of anything unchecked.

    Then clear the check for "load startup items" entirely and "clean boot" the system. Does the box still appear? If not, it's related to something in that startup tab.

    You will have to selectively troubleshoot. If anything was previously disabled, you will have to use "selective" startup and remove the checks for them once more.

    Be sure to run HijackThis under the current startup configuration and post the log.
     
  7. EAFiedler

    EAFiedler Retired Moderator

    Joined:
    Apr 25, 2000
    Messages:
    14,172
    Do you have HijackThis?

    If so, click Do a System Scan and save log file and post the entire log here.

    If this is running at boot up HijackThis might have it listed.

    Get HijackThis (ver 1.99) here if you do not already have it.

    Save HijackThis in its own folder and not in a temporary folder.
     
  8. JayT

    JayT

    Joined:
    Apr 15, 2003
    Messages:
    688
  9. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Same poster, different name. I can't imagine why System Restore wouldn't fix this
     
  10. Pancakes

    Pancakes Thread Starter

    Joined:
    Jan 22, 2005
    Messages:
    8
    Am using selective startup with only a few items unchecked. Will make note of those and clean boot as you suggest. In the meantime here is my Hijackthis log under the current configuration.

    Logfile of HijackThis v1.99.0
    Scan saved at 10:15:39 PM, on 1/22/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\HP\KBD\KBD.EXE
    C:\WINDOWS\ALCXMNTR.EXE
    c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Hijack This\hijackthis\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\Pavilion\XPHNABS3EN\plugin\bin\PCHButton.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
     
  11. Pancakes

    Pancakes Thread Starter

    Joined:
    Jan 22, 2005
    Messages:
    8

    Not sure I see your point. If I am trying to find a solution to a problem why not look in more than one forum? I wasn't able to register the same name at that forum, thus the other moniker.
     
  12. Pancakes

    Pancakes Thread Starter

    Joined:
    Jan 22, 2005
    Messages:
    8

    Not sure why System Restore did not help, but I tried rolling back to two separate dates both more than 2 weeks before this problem occurred and it didn't stop the error.
     
  13. EAFiedler

    EAFiedler Retired Moderator

    Joined:
    Apr 25, 2000
    Messages:
    14,172
    I am sure nothing offensive was meant by that remark, more of investigative information.

    If someone different has it, then it could be the start of new malware.

    Please do not take offense.
     
  14. EAFiedler

    EAFiedler Retired Moderator

    Joined:
    Apr 25, 2000
    Messages:
    14,172
    Have you tried disabling everything in msconfig and your Startup folder, and rebooting to see if the window still persists?

    I'll let Rollin' Rog cover your HijackThis log.
     
  15. Pancakes

    Pancakes Thread Starter

    Joined:
    Jan 22, 2005
    Messages:
    8

    Yes, wanted to post my HJT log first under original configuration. Just tried disabling all startup items (clean boot) and the window does not appear. I will try enabling items one at a time and re-booting to see which is the source of the problem. Will post back when I determine which item is the cause.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/322286

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice