Author Topic: Strange Behavior (Read 28836 times)

Sapphire · « **on:** May 26, 2005, 08:27:51 PM »

Hi! I'm seeking some help for a problem I am having. Last week I downloaded and installed the My Comet Cursor software from the site Download.com. I was able to install this software using the Netscape 7.2 browser. When I decided to uninstall the comet cursor software, I had the option to download the uninstall tool using Netscape. After trying this, when I start up my computer I get a download file window that flashes on the screen for a few quick seconds, than it disappears.

This file download window is weird. The file it is supposed to download changes from realsched.exe, to aoltray.exe.

I have Panda Titanium 2004 antivirus on my computer, but a full virus scan dosn't find anything.

I also used the free Symantec virus scan on their website. I ran spyware scans using Ad-Aware Personal SE, and Microsoft Antispyware. None of these scans find anything.

Last night I tried to download and install the Norton Antivirus 30 free trial software, but it wouldn't intall in full. After trying to install that, I recieved another one of those strange file download windows, that flashes for a few seconds. This file download window says jusched.exe.

I am running Windows XP Professional on my computer.

In addition to these strange file download windows, I am unable to access some of my control panel. I cannot get into Add/ Remove programs, I cannot get into the User accounts, I cannot get into the display or sysyem sections. When I double click on the computer clock in the right hand corner of the screen, that doesn't open to reveal the calender and option to adjust the time.

Thanks for your time, and any help would be appreciated!

Fed · « **Reply #1 on:** May 26, 2005, 08:37:56 PM »

Your file download windows sound like programs checking for updates. Google each of their names and you will see.
As to your last question, are you logged in with admin rights?

Sapphire · « **Reply #2 on:** May 26, 2005, 09:48:52 PM »

Thanks for your response. I did google all the exe file names, but that doesn't explain much how to stop those windows from popping up. If this is harmless, than I won't let these windows bother me.

Yes, I have Admin. rights, and am still operating as the Admin. account.

dl65 · « **Reply #3 on:** May 26, 2005, 10:29:15 PM »

Sapphire...... I just went looking and found this info .......hopefully it will help you .
http://www.pchell.com/support/cometcursor.shtml

I also reads several reviews on the app.........definitely not something I'd want on my machines ........too much trouble .

dl65

Fed · « **Reply #4 on:** May 26, 2005, 11:41:19 PM »

You should be able to stop these auto updates from within each program...

realsched.exe = The Real Player automatic update
IMO Real Player is like a virus itself, I use Real Alternative which does everything and is not invasive as Real Player is. Even a small amount of research in google would convince you to delete it & use Real Alternative instead.

aoltray.exe = Puts AOL icon in System Tray (*.* denotes version if present). Connect to AOL via the desktop shortcut or Start -> Programs
This program is not required to start automatically as you can run it when you need to. It is advised that you disable this program so that it does not take up necessary resources.

jusched.exe = This is Sun's Java automatic update
If you would like to disable this scheduler then go to your control panel and click on the java module. The go to the updates tab and uncheck "check for updates automatically".

Quote

I am unable to access some of my control panel. I cannot get into Add/ Remove programs, I cannot get into the User accounts, I cannot get into the display or sysyem sections. When I double click on the computer clock in the right hand corner of the screen, that doesn't open to reveal the calender and option to adjust the time.

Are your Anti Virus/Spyware/Everything programs fully updated?

Have an online check here.
http://www.pandasoftware.com/activescan/
and let us know how things are.

Sapphire · « **Reply #5 on:** May 27, 2005, 12:39:14 AM »

Hi Fed! I ran the active scan for Panda, all it found was some Adware and spyware, but didn't eliminate any of it.

Yes, all my programs are fully updated.

Fed · « **Reply #6 on:** May 27, 2005, 05:19:31 PM »

You should first clean your computer of all adware and spyware, then worry about what's not working after that. It's very important to make sure that all tools are up to date before using them and to check with multiple tools for the same tasks because some pick up things that others miss.
You will probably have to remove some bugs manually but just take them one at a time.

Sapphire · « **Reply #7 on:** May 27, 2005, 10:25:54 PM »

Okay, I re-ran the Panda activescan, and deleted everything adware/spyware except the registry key results because I cannot figure out how to do that.

I can't enter the registry by going Start/Run/RegEdit, because when I hit enter nothing happens.

Fed · « **Reply #8 on:** May 27, 2005, 10:55:46 PM »

Now just to re-cap...
Your only problem now is

Quote

I am unable to access some of my control panel. I cannot get into Add/ Remove programs, I cannot get into the User accounts, I cannot get into the display or sysyem sections. When I double click on the computer clock in the right hand corner of the screen, that doesn't open to reveal the calender and option to adjust the time.

and the things we know as facts are
1)You have run multiple updated anti-spyware/virus programs and come up clean.
2)You are definitely logged on as Administrator.

If this is the case can you download & run Hijackthis and place the logfile in here.
You may also want to try the log here
http://www.hijackthis.de/index.php?langselect=english for yourself.
You can get Hijackthis from the above address.

Sapphire · « **Reply #9 on:** May 28, 2005, 07:26:38 AM »

I downloaded it, but I can't open it.

merlin_2 · « **Reply #10 on:** May 28, 2005, 02:48:22 PM »

reboot pc .......hold down the f8 key.........scan for bugs<safe mode>..... or chose the last good config do you have a firewall??/

Fed · « **Reply #11 on:** May 28, 2005, 04:20:51 PM »

Also run stinger http://vil.nai.com/vil/stinger/ while in safe mode.
Read the instructions about turning off system restore before running.

Sapphire · « **Reply #12 on:** May 28, 2005, 06:19:26 PM »

Fed, I ran the Stinger scan, but it didn't find anything. Guess that's a good thing, right?

Merlin_2, I'm not sure what it is you want me to do while running safe mode? The only firewall I am using at this time is the XP firewall. When I go into control panel, network connections, change settings, and check that box for that firewall.

Fed · « **Reply #13 on:** May 28, 2005, 07:05:59 PM »

Do something for me?
Go to Start>Run and type regedit.exe (full name).

Sapphire · « **Reply #14 on:** May 28, 2005, 09:31:21 PM »

If something is supposed to happen, it doesn't. I typed regedit.exe and hit enter, and nothing happened.

Fed · « **Reply #15 on:** May 28, 2005, 10:11:59 PM »

I think all these things are related & if we fix one we will fix them all so I picked on regedit to play with.
Does that make sense?

Can you search your computer
Start>Search>Files or Folders (on mine)
for regedit.exe to see if it's actually there?

Sapphire · « **Reply #16 on:** May 28, 2005, 10:17:50 PM »

I have regedit.exe located in C:\ Windows

Fed · « **Reply #17 on:** May 28, 2005, 10:23:20 PM »

Check it's properties for anything that looks abnormal.
Try and run it by typing c:\windows\regedit.exe

Sapphire · « **Reply #18 on:** May 28, 2005, 10:36:36 PM »

The properties look okay. Typing in c:\windows\regedit.exe doesn't work either.

Fed · « **Reply #19 on:** May 28, 2005, 10:40:03 PM »

Check in
Start>Settings>Control Panel>Admin Tools>Event Viewer for any errors.

I have to go out for a while so I'll check you later.

Sapphire · « **Reply #20 on:** May 28, 2005, 11:04:17 PM »

Well there are errors, but I have no clue what any of it means. I'm off to bed, so I'll get back to this tomorrow.

Fed · « **Reply #21 on:** May 29, 2005, 01:01:47 AM »

Can you try and execute regedit.exe then go & check the logs for new entries?

Sapphire · « **Reply #22 on:** May 29, 2005, 07:53:46 AM »

And how do I do those 2 things?

Raptor · « **Reply #23 on:** May 29, 2005, 08:02:28 AM »

Follow these steps to access the registry editor:

1. Start
2. Run
3. Type regedit.exe

Then do as Fed suggested:

Quote

Check in
Start>Settings>Control Panel>Admin Tools>Event Viewer for any errors.

And post the information Fed wishes to see.

Sapphire · « **Reply #24 on:** May 29, 2005, 08:41:53 AM »

If I am supposed to post the event error messages, it doesn't let me copy and paste them.

Raptor · « **Reply #25 on:** May 29, 2005, 09:21:14 AM »

Are you able to take a screenshot of the error/log entry displayed and show it to us on the forum?

Sapphire · « **Reply #26 on:** May 29, 2005, 10:47:37 AM »

How do I take a screenshot of something?

Raptor · « **Reply #27 on:** May 29, 2005, 11:52:32 AM »

1. Press the Print Screen button on your keyboard.
-- Often abbreviated to Prnt Scrn.
2. Open an image editing program such as paint
3. Paste the image into the program
-- CTRL + V is a shortcut key for the Paste option
4. Upload your image to a website such as http://www.uploadit.org
5. Use the

code to display your screenshot on this forum.

Sapphire · « **Reply #28 on:** May 29, 2005, 04:45:28 PM »

AMLI: ACPI BIOS is attempting to read from an illegal IO port address (Ox71), which lies in the Ox70-Ox71 protected address range. This could lead to system instability.

Fed · « **Reply #29 on:** May 29, 2005, 05:22:55 PM »

I have no clue what that means either, is that the message that comes up in your event viewer log when you try and open regedit?
Did you look in all 3 sections of the event viewer?

Sapphire · « **Reply #30 on:** May 29, 2005, 08:35:21 PM »

I went to control panel, clicked on administrator tools, clicked on event viewer, and this is an error message for acpi, in the system error messsage.

dl65 · « **Reply #31 on:** May 29, 2005, 09:40:23 PM »

Quote

AMLI: ACPI BIOS is attempting to read from an illegal IO port address (Ox71), which lies in the Ox70-Ox71 protected address range. This could lead to system instability.

I believe this error is refering to a sound card problem ....

Would that make any sense ?

dl65

Fed · « **Reply #32 on:** May 29, 2005, 11:40:34 PM »

A quick google tells what it is but I don't think it's causing the problem.
(Advanced Configuration and Power Interface)
Who knows

Saphire, another thing for you to try...
Re-boot your computer, open the Task Manager and stop all the running programs in the Applications tab.

Then click on the Processes tab, look for an instance of NTVDM and if it's there then stop it, clicking OK to any warnings.

Then go back to Start>Run & try to run regedit again.

dl65 · « **Reply #33 on:** May 30, 2005, 12:35:59 AM »

Sapphire ......... Were you ever able to open up hijackthis ? Because I think your PC is still infected with trojans..... If you have a floppy drive on your pc ......... use another pc and d/l hijackthis again and save it to a floppy .....then run it on your pc and post the log here for us to look at ...... Some trojans or viruses ....will prevent you from accessing the registry and not allow your antivirus software to run properly .......

let us know

dl65

Fed · « **Reply #34 on:** May 30, 2005, 12:57:04 AM »

I agree DL65, or maybe it was a bug that did some damage but now it's been removed & the damage remains.

The truth is out there....

Sapphire · « **Reply #35 on:** May 30, 2005, 10:33:24 AM »

Nope, I do not have a NTVDM process running on task manager.

I tried again, and still cannot open hijackthis.

But I do notice, whenever I reboot, I check the event viewer, and keep finding that same error message for Advanced Configuration and Power Interface.

dl65 · « **Reply #36 on:** May 30, 2005, 01:14:04 PM »

Sapphire...... Could you try to D/L hijackthis from .....
http://www.majorgeeks.com/download3155.html ....D/L V 1.99.1 and save it to a floppy disk ( I know you have tried to open it up and cant ) It should run ok for you from the floppy ........
BTW , when you tried to open it before , did you get any error message ?
Are you able to access anything in your control panel ?

let us know

dl65

Sapphire · « **Reply #37 on:** May 30, 2005, 07:29:26 PM »

Why didn't someone tell me I had to extract the hijackthis.exe file from the zipped folder? Now I can open it. I'll be back with my results.

Fed · « **Reply #38 on:** May 30, 2005, 07:36:34 PM »

Sorry, I assumed you knew to execute execute files to run them.

Anyway, read the directions and do a simple scan, after the scan save the logfile and post it up for DL65.

I seem to remember something about saving Hijackthis to it's own directory (folder) so the save scan option will work. It's been a while since I installed it.

Sapphire · « **Reply #39 on:** May 30, 2005, 07:38:49 PM »

Logfile of HijackThis v1.99.1
Scan saved at 9:32:04 PM, on 5/30/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\apvxdwin.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\WINDOWS\System32\ctfmon.exe
C:\aolextras\icons\HijackThis.exe
C:\Program Files\Netscape\Netscape\Netscp.exe

Sapphire · « **Reply #40 on:** May 30, 2005, 07:39:36 PM »

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://scottstapp.com/
N3 - Netscape 7: user_pref("browser.startup.homepage", "scottstapp.com"); (C:\Documents and Settings\user\Application Data\Mozilla\Profiles\default\b18nhr40.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\user\Application Data\Mozilla\Profiles\default\b18nhr40.slt\prefs.js)
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {41601034-0A76-34BC-12E0-AD2A13FF3339} - C:\WINDOWS\Bsxuthmp.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Search - {9CD7F666-9462-3EC2-341B-C0708821D4A4} - C:\WINDOWS\Bsxuthmp.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [qCP8fRoqE] C:\windows\temp\qCP8fRoqE.exe
O4 - HKLM\..\Run: [AOydxuV] C:\windows\temp\AOydxuV.exe
O4 - HKLM\..\Run: [4bS] C:\Documents and Settings\user\Local Settings\Temp\4bS.exe
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\pavsrv51.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\PsImSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Fed · « **Reply #41 on:** May 30, 2005, 08:22:26 PM »

Can you right click on your regedit.exe and check the file size & version against mine?
There has to be a reason why it won't open.

Mine is version 5.0.2195.6707 with Size 71.7 KB (73,488 bytes)

If yours is the same I guess it's ok but if it's different it may be because I'm on w2k so then we will compare it with an xp one.

Sapphire · « **Reply #42 on:** May 30, 2005, 08:36:01 PM »

size: 132 kb (135,168 bytes)

version: 5.1.2600.1106

Fed · « **Reply #43 on:** May 30, 2005, 08:40:14 PM »

Quote

size: 132 kb (135,168 bytes)
version: 5.1.2600.1106

Wait for DL65, he probably has xp.

BTW, any other things of interest in your Event Viewer, if you Dclick on an event you can then scroll down each event from that new window.

EDIT...
So as not to confuse things, maybe start a new thread for

Quote

AMLI: ACPI BIOS is attempting to read from an illegal IO port address (Ox71), which lies in the Ox70-Ox71 protected address range. This could lead to system instability.

Sapphire · « **Reply #44 on:** May 30, 2005, 08:57:28 PM »

Nope, just that one error message, if that's what you mean?

Fed · « **Reply #45 on:** May 30, 2005, 09:41:21 PM »

Go to
Start>Settings>Control Panel>AdminTools>Services
and compare your startup services with
http://www.codecavalier.com/blackviper/WinXP/servicecfg.htm
This is a cached copy of BlackViper's default list along with recommendations but just stick to the XP defaults given.
You will need to scroll down to get to the list and if possible print it out for ease of comparison.

Look for disabled things that should set to Automatic or Manual.

Sapphire · « **Reply #46 on:** May 30, 2005, 10:16:52 PM »

I compared to black viper, and everything matched.

Fed · « **Reply #47 on:** May 30, 2005, 10:26:42 PM »

Make a new directory (folder) called c:\aaa then download this file http://www.comcen.com.au/~fed/regedit.exe
and place it in the c:\aaa directory.
Then Dclick it & see what happens.
You will have to trust me that it's not a virus.
After you have tried it, delete the directory so my regedit.exe cannot possibly get mixed with yours.

A leap of faith is needed here.

Sapphire · « **Reply #48 on:** May 30, 2005, 10:52:01 PM »

I tried it, nothing happened, so I deleted the directory.

dl65 · « **Reply #49 on:** May 30, 2005, 11:10:09 PM »

Sapphire...... Ok , I see a few things which should be fixed ......So ....the first thing to do is close up anything thats open ......
Now open hijack this ......

Click on scan system and save log file ...

Click on the config button .....when the config window opens ....in the 4 URL boxes Type ........
http://www.msn.com .... ( you can change these later if you wish ).

Click the back button in hijackthis ( lower right corner )

Now mark for removal the following :

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://scottstapp.com/

N3 - Netscape 7: user_pref("browser.startup.homepage", "scottstapp.com"); (C:\Documents and Settings\user\Application Data\Mozilla\Profiles\default\b18nhr40.slt\prefs.js)

N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5 CSBWeb_01.src"); (C:\Documents and Settings\user\Application Data\Mozilla\Profiles\default\b18nhr40.slt\prefs.js)

O2 - BHO: (no name) - SOFTWARE - (no file)

O2 - BHO: (no name) - {41601034-0A76-34BC-12E0-AD2A13FF3339} - C:\WINDOWS\Bsxuthmp.dll (file missing)

O3 - Toolbar: Search - {9CD7F666-9462-3EC2-341B-C0708821D4A4} - C:\WINDOWS\Bsxuthmp.dll (file missing)

O4 - HKCU\..\Run: [Ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing)

Ok .......Now click on fix marked .....
Then reboot into safe mode and run your Panda Antivirus ....... when finished .....reboot back into normal and see how things are ....( check to see if you can get into the control panel .

Then I would go to M/S update page ........
http://v5.windowsupdate.microsoft.com/v5consumer/default.aspx?ln=en-us ....... click on the express scan and then select whichever updates are listed as priority.... and make sure you get SP2 .......unless you have some reason that you dont want it ......... It provides good additional security protection as well as a firewall which you can turn on or off as you see fit .

Let us know

dl65

dl65 · « **Reply #50 on:** May 30, 2005, 11:20:31 PM »

Sapphire..... Almost forgot .......regedit file ....in C\Windows 143kb

dl65

Sapphire · « **Reply #51 on:** May 31, 2005, 12:10:05 AM »

I did everything you told me to do, and everything is still the same.

dl65 · « **Reply #52 on:** May 31, 2005, 12:14:28 AM »

were you able to get the win updates ?

dl65

dl65 · « **Reply #53 on:** May 31, 2005, 12:15:43 AM »

Did anything show up when you ran your anti virus ?

dl65

Sapphire · « **Reply #54 on:** May 31, 2005, 12:21:55 AM »

Yep, I got the updates. Nothing came up on the virus scan.

dl65 · « **Reply #55 on:** May 31, 2005, 12:26:56 AM »

Have you been able to get into the registry ......?
Start/run ..... type in regedit

Do you have any sort of registry cleaner ?

dl65

Sapphire · « **Reply #56 on:** May 31, 2005, 12:33:54 AM »

If I go Start/Run/Command, when the window opens, I type
cd\windows, enter
regedit, enter

the registry opens that way

No, I don't have any kind of registry cleaner.

dl65 · « **Reply #57 on:** May 31, 2005, 12:55:29 AM »

ok ...you can get to the registry .

Can you get into the add/remove programs in the control panel ..?

I'll get you a link to a registry cleaner ........ it will take me a few mniutes .

dl65

dl65 · « **Reply #58 on:** May 31, 2005, 01:05:13 AM »

Here's a link to a good one .......

I sent the link to you and registration info to you via instant message .

dl65

Fed · « **Reply #59 on:** May 31, 2005, 01:25:17 AM »

Quote

Yes, I have Admin. rights, and am still operating as the Admin. account.

How do you know this?

Raptor · « **Reply #60 on:** May 31, 2005, 06:31:28 AM »

Who are you speaking to, Fed?

Sapphire · « **Reply #61 on:** May 31, 2005, 08:16:09 AM »

Fed was talking to me. I don't know for sure that I am logged in as the administrator. I have my computer set up with me as an Admin. account. When I start the computer I get the welcome screen with my Screen name for the admin. account. I also have it set up, so I have to enter a password when the welcome screen comes on.
_______________________________________ __________

DL65, no I cannot get into the Add/Remove programs in the control panel.

Fed · « **Reply #62 on:** May 31, 2005, 02:26:01 PM »

Sapphire, sorry for the interrogation, it's just that all the reading I've done suggests that an mere lowly user account can't access all the things you're having trouble getting to. (Clock, Add & Remove, Users, etc)
I did accept your login status after my 1st post but when you had the Hijackthis install problem

Quote

Why didn't someone tell me I had to extract the hijackthis.exe file from the zipped folder?

I began to think you could have been mistaken.
Being unable to access your 'Users' makes it hard to check your Admin rights haven't been removed or altered too?
I wonder if there's a prize for the longest running thread

Sapphire · « **Reply #63 on:** May 31, 2005, 04:37:41 PM »

What I get out of it is the Admin. account is the only account that can download and install programs. I have been able to download and install stuff.

Fed · « **Reply #64 on:** May 31, 2005, 05:14:35 PM »

From my computer (w2k) I'm not sure for xp...

Quote

Users are prevented from making accidental or intentional system-wide changes. Thus, Users can run certified applications, but not most legacy applications

Administrators have complete and unrestricted access to the computer/domain

Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted

Sapphire · « **Reply #65 on:** May 31, 2005, 05:25:57 PM »

My computer says the same thing.

merlin_2 · « **Reply #66 on:** May 31, 2005, 07:00:59 PM »

do you have important files on this pc.......i recommend a re-install.......while disconnected from the net......and this may help you in the future>>tweak>>http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx.........dont touch comet cursor?/

Sapphire · « **Reply #67 on:** May 31, 2005, 07:53:18 PM »

What would be considered important? I have some audio, and video files that I wouldn't want to lose. I have no way of saving the video files.

Re-install what? Windows XP? How do I do that?

Fed · « **Reply #68 on:** June 01, 2005, 04:10:46 PM »

I'm not sure that being able to download & install programs is any proof of being logged in as Admin with unrestricted access to your computer.

Does anyone else have access to your computer who may have altered things in Users & Passwords?

Can you remember if this problem started at the same time as the comet download or auto update thing or could these 3 things be totally unrelated?

Re-installing xp is a sure fire way of fixing it but we will nevr know what the problem was, it's a matter for you.

Sapphire · « **Reply #69 on:** June 01, 2005, 04:28:43 PM »

Nope, I'm the only person who touches this computer.

I downloaded the Comet Cursor, but it wasn't working. So I decided to uninstall it. They have a special uninstall page to do that. I was able to install, using Netscape, so I chose to uninstall using Netscape. I was instructed to download the uninstaller, and that's when this problem occured.

Computer Hope Forum

News:

Author Topic: Strange Behavior (Read 28836 times)

Sapphire

Fed

Sapphire

dl65

Fed

Sapphire

Fed

Sapphire

Fed

Sapphire

merlin_2

Fed

Sapphire

Fed

Sapphire

Fed

Sapphire

Fed

Sapphire

Fed

Sapphire

Fed

Sapphire

Raptor

Sapphire

Raptor

Sapphire

Raptor

Sapphire

Fed

Sapphire

dl65

Fed

dl65

Fed

Sapphire

dl65

Sapphire

Fed

Sapphire

Sapphire

Fed

Sapphire

Fed

Sapphire

Fed

Sapphire

Fed

Sapphire

dl65

dl65

Sapphire

dl65

dl65

Sapphire

dl65

Sapphire

dl65

dl65

Fed

Raptor

Sapphire

Fed

Sapphire

Fed

Sapphire

merlin_2

Sapphire

Fed

Sapphire