Solved: Window appears on Desktop at Bootup

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Pancakes

Thread Starter
Joined
Jan 22, 2005
Messages
8
Am running Windows XP Home Edition. For the past week when booting up PC a small window with red X appears on desktop. I have scanned with my NAV as well as several free online sites and all come back problem free. I have also ran Adaware and Spybot which both come back clean.

Have looked in System Event Viewer and see nothing unusual listed. Checking task manager I do not see any new programs running and have not added any new programs since the time this error first appeared. Have done a system restore back to date before this problem occured, but it did not alleviate the problem.

I am wondering if this could be a desktop issue. My son had changed the desktop them (used a picture he saved) although has since changed back to a standard theme. Have done a screen capture of this window on my desktop and saved the file in Paint, but I am not familiar with posting images and the instructions in your FAQ are not clear to me. Any suggestions would be most appreciated.
 

Attachments

Joined
Jan 28, 2004
Messages
2,187
hmmm, odd one... nicely attached pic though. See if anything out of place in Desktop Properties under Desktop/Customise... maybe something added there or an active desktop that's no longer appropriate-disabled.
 

Pancakes

Thread Starter
Joined
Jan 22, 2005
Messages
8
bobol said:
hmmm, odd one... nicely attached pic though. See if anything out of place in Desktop Properties under Desktop/Customise... maybe something added there or an active desktop that's no longer appropriate-disabled.
I'm really not sure if this has to do with the desktop or not, it was just a thought when searching for cause of this error? window. I have looked in desktop properties and don't see anything unusal there.

Any other ideas what the cause of this might be :confused:
 

EAFiedler

Retired Moderator
Joined
Apr 25, 2000
Messages
14,172
Hi Pancakes

Start > Run
key in:
msconfig

Do you see anything new, set to run at Start Up?

Also, check your inside your Startup folder.
Start > Programs > Startup

Let us know what you find.
 

Pancakes

Thread Starter
Joined
Jan 22, 2005
Messages
8
EAFiedler said:
Hi Pancakes

Start > Run
key in:
msconfig

Do you see anything new, set to run at Start Up?

Also, check your inside your Startup folder.
Start > Programs > Startup

Let us know what you find.
Hi, yes I have checked MSconfig and Startup folder and don't see anything irregular there. As mentioned in my first post have done numerous anti-virus scans as well as spyware scans which all come back clean and normal.
 
Joined
Dec 9, 2000
Messages
45,855
Create a new, permanent folder for HijackThis and save the file to that. Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

Direct HijackThis download link: http://www.spywareinfo.com/~merijn/files/HijackThis.exe


Are you using "selective" or "normal" startup in msconfig? If Selective, look under the startup tab and make a note of anything unchecked.

Then clear the check for "load startup items" entirely and "clean boot" the system. Does the box still appear? If not, it's related to something in that startup tab.

You will have to selectively troubleshoot. If anything was previously disabled, you will have to use "selective" startup and remove the checks for them once more.

Be sure to run HijackThis under the current startup configuration and post the log.
 

EAFiedler

Retired Moderator
Joined
Apr 25, 2000
Messages
14,172
Do you have HijackThis?

If so, click Do a System Scan and save log file and post the entire log here.

If this is running at boot up HijackThis might have it listed.

Get HijackThis (ver 1.99) here if you do not already have it.

Save HijackThis in its own folder and not in a temporary folder.
 

Pancakes

Thread Starter
Joined
Jan 22, 2005
Messages
8
Rollin' Rog said:
Create a new, permanent folder for HijackThis and save the file to that. Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

Direct HijackThis download link: http://www.spywareinfo.com/~merijn/files/HijackThis.exe


Are you using "selective" or "normal" startup in msconfig? If Selective, look under the startup tab and make a note of anything unchecked.

Then clear the check for "load startup items" entirely and "clean boot" the system. Does the box still appear? If not, it's related to something in that startup tab.

You will have to selectively troubleshoot. If anything was previously disabled, you will have to use "selective" startup and remove the checks for them once more.

Be sure to run HijackThis under the current startup configuration and post the log.
Am using selective startup with only a few items unchecked. Will make note of those and clean boot as you suggest. In the meantime here is my Hijackthis log under the current configuration.

Logfile of HijackThis v1.99.0
Scan saved at 10:15:39 PM, on 1/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Hijack This\hijackthis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\Pavilion\XPHNABS3EN\plugin\bin\PCHButton.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
 

Pancakes

Thread Starter
Joined
Jan 22, 2005
Messages
8
Rollin' Rog said:
Same poster, different name. I can't imagine why System Restore wouldn't fix this

Not sure why System Restore did not help, but I tried rolling back to two separate dates both more than 2 weeks before this problem occurred and it didn't stop the error.
 

EAFiedler

Retired Moderator
Joined
Apr 25, 2000
Messages
14,172
I am sure nothing offensive was meant by that remark, more of investigative information.

If someone different has it, then it could be the start of new malware.

Please do not take offense.
 

EAFiedler

Retired Moderator
Joined
Apr 25, 2000
Messages
14,172
Have you tried disabling everything in msconfig and your Startup folder, and rebooting to see if the window still persists?

I'll let Rollin' Rog cover your HijackThis log.
 

Pancakes

Thread Starter
Joined
Jan 22, 2005
Messages
8
EAFiedler said:
Have you tried disabling everything in msconfig and your Startup folder, and rebooting to see if the window still persists?

I'll let Rollin' Rog cover your HijackThis log.

Yes, wanted to post my HJT log first under original configuration. Just tried disabling all startup items (clean boot) and the window does not appear. I will try enabling items one at a time and re-booting to see which is the source of the problem. Will post back when I determine which item is the cause.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Top