Strange goings on

March 17, 2003

I have had a bit of a problem the last couple of days and I assume it is linked to W98se......but I don't know really.

Here goes: I was happily clonking about on the internet the other night and all of a sudden the slider bar in my browser started going up and down like a mad thing.....everytime I moved my mouse!! I was unable to click on anything, in fact the left click just didn't work, did the old Ctrl, Alt, Del but the slider bar in the close program box was going haywire as well.....in the end I had to restart, ran scan disk in dos.......that was ok!! but when the PC finished booting up, I had no left click......or at least the instructions weren't getting through.....rebooted again, ran scan disk and regfix.....same prob!! In the end I just left it and went and had a large drink. Came back and it seemed to have sorted itself out. Ran system file checker and there was a corrupted file, (cant remember which now but I sorted that) but even more worringly some of my Nav files were wonky. Had to leave it at that point but got onto it the next day and ran an online virus checker and Gladiator......will come back to that in a min, but they didn't really find anything......then it went wonky again, slider bar going weird etc etc, so it couldn't have been the corrupt system file causing the problem. The really strange thing is that the file associations for my pictures has changed.....I had this problem about a month ago and then it went away and my picture file associations changed all by themselves.

One last thing.....Gladiator didn't pick up any worms or trojans which is what I was worried about but I did have two warnings but I don't know what they mean.

They are both for UXP Runtime and the warning was runtime packed system file, and the files are:

C:\windows \system \lame_enc.dll

C:\windows \system \ActiveScan \qrvkrn.dll

Things seem ok at the moment, but obviously something somewhere isn't right.......as I have had two sessions with this problem now. Sorry for the length of the post, any ideas anyone????

March 17, 2003

presume the online scan was panda,this C:\windows \system \ActiveScan \qrvkrn.dll is a harmless panda file and GAV displays it as a warning but its safe,guessing the other ones down to the online scanner too.

mark2 · March 17, 2003

Most references on google to 'lame_enc.dll' refer to an mp3 encoder if that's any help.

Might be worth while getting a start up list see if there is anything running that shouldn't be there

Startup list

Program list

March 17, 2003

Ellas, I used Panda just incase something had messed about with Norton!!!

Mark, thanks for those links, my start up seems ok apart from the fact that I have 2 LoadPowerProfiles.......didn't untick one......yet.....but why 2 do you think.

These are my running programs

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE

C:\PROGRAM FILES\NORTON INTERNET SECURITY FAMILY EDITION\NISSERV.EXE

C:\PROGRAM FILES\NORTON INTERNET SECURITY FAMILY EDITION\IAMAPP.EXE

C:\PROGRAM FILES\NORTON INTERNET SECURITY FAMILY EDITION\NISUM.EXE

C:\WINDOWS\SYSTEM\SPOOL32.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\POPROXY.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\WINDOWS\RUNDLL32.EXE

D:\INCD\INCD.EXE

C:\PROGRAM FILES\R2 STUDIOS\SYSTEM LOCK\SYSLOCK.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\TYPE32.EXE

C:\WINDOWS\SYSTEM\RMCTRL.EXE

C:\WINDOWS\TASKMON.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE

C:\WINDOWS\LOADQM.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

D:\MAILWASHER\MAILWASHER.EXE

C:\WINDOWS\SYSTEM\PSTORES.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

D:\DAP\DAP.EXE

D:\WINZIP\WINZIP32.EXE

mark2 · March 17, 2003

2 power profiles nothing to worry about you can disable either

mark2 · March 17, 2003

the processes look alright if a bit overweight as it were, do you need them all running at start up ?

March 17, 2003

oh......those were what was running when I ran the program, 'puter had been on for a bit by then. the problem that I had just sort of happened, I had been up and running for a while when it first happened and rebooting didn't seem to sort anything out........ :mellow: But it hasn't happened for about 24 hours now....but it might do it again......oh dear!

mark2 · March 17, 2003

Can you post the rest of the start up log, the auto run stuff etc ?

March 17, 2003

Sorry Mark......I had run the running processes program but had checked the start ups in msconfig against the list from that site. Here is what the start up program gave me.........it's long though!!

StartupList report, 17/03/03, 21:41:59

StartupList version: 1.52

Started from : C:\WINDOWS\TEMP\STARTUPLIST.EXE

Detected: Windows 98 SE (Win9x 4.10.2222A)

Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)

* Using default options

==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE

C:\PROGRAM FILES\NORTON INTERNET SECURITY FAMILY EDITION\NISSERV.EXE

C:\PROGRAM FILES\NORTON INTERNET SECURITY FAMILY EDITION\IAMAPP.EXE

C:\PROGRAM FILES\NORTON INTERNET SECURITY FAMILY EDITION\NISUM.EXE

C:\WINDOWS\SYSTEM\SPOOL32.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\POPROXY.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\WINDOWS\RUNDLL32.EXE

D:\INCD\INCD.EXE

C:\PROGRAM FILES\R2 STUDIOS\SYSTEM LOCK\SYSLOCK.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\TYPE32.EXE

C:\WINDOWS\SYSTEM\RMCTRL.EXE

C:\WINDOWS\TASKMON.EXE

C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\WINDOWS\SYSTEM\PSTORES.EXE

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE

C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE

D:\DAP\DAP.EXE

D:\WINZIP\WINZIP32.EXE

C:\WINDOWS\TEMP\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:

[C:\WINDOWS\Start Menu\Programs\StartUp]

EPSON Background Monitor.lnk = C:\ESM2\Stms.exe

Event Reminder.lnk = D:\Printmaster\PrintMaster\PMremind.exe

Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun

SystemTray = SysTray.Exe

NAV DefAlert = C:\PROGRA~1\NORTON~1\NORTON~2\DEFALERT.EXE

Norton eMail Protect = C:\Program Files\Norton SystemWorks\Norton AntiVirus\POPROXY.EXE

StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE

ICSDCLT = C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient

InCD = D:\incd\InCD.exe

TkBellExe = C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot

Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

SystemLock = C:\PROGRAM FILES\R2 STUDIOS\SYSTEM LOCK\SYSLOCK.exe

TaskPlus = D:\TASKPLUS\TASKPLUS0.EXE

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup

nwiz = nwiz.exe /install

IntelliType = "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"

RemoteControl = C:\WINDOWS\SYSTEM\rmctrl.exe

TaskMonitor = C:\WINDOWS\taskmon.exe

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

Norton Auto-Protect = C:\PROGRA~1\NORTON~1\NORTON~2\NAVAPW32.EXE /LOADQUIET

NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"

ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

SchedulingAgent = C:\WINDOWS\SYSTEM\mstask.exe

NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

CSINJECT.EXE = C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe

SCRNSAVE.EXE=

drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:

(Created 15/3/2003, 15:19:6)

[Rename]

C:\WINDOWS\SYSTEM\CP_936.NLS=C:\WINDOWS\SYSTEM\TBM23A5.TMP

C:\WINDOWS\SYSTEM\CP_932.NLS=C:\WINDOWS\SYSTEM\TBM23B0.TMP

C:\WINDOWS\SYSTEM\CP_874.NLS=C:\WINDOWS\SYSTEM\TBM23B1.TMP

C:\WINDOWS\SYSTEM\CP_28591.NLS=C:\WINDOWS\SYSTEM\TBM23B2.TMP

C:\WINDOWS\SYSTEM\CP_21866.NLS=C:\WINDOWS\SYSTEM\TBM23B3.TMP

C:\WINDOWS\SYSTEM\CP_20866.NLS=C:\WINDOWS\SYSTEM\TBM23B4.TMP

C:\WINDOWS\SYSTEM\CP_1258.NLS=C:\WINDOWS\SYSTEM\TBM23B5.TMP

C:\WINDOWS\SYSTEM\CP_1257.NLS=C:\WINDOWS\SYSTEM\TBM23B6.TMP

C:\WINDOWS\SYSTEM\CP_1256.NLS=C:\WINDOWS\SYSTEM\TBM23B7.TMP

C:\WINDOWS\SYSTEM\CP_1255.NLS=C:\WINDOWS\SYSTEM\TBM23B8.TMP

C:\WINDOWS\SYSTEM\CP_1254.NLS=C:\WINDOWS\SYSTEM\TBM23B9.TMP

C:\WINDOWS\SYSTEM\CP_1253.NLS=C:\WINDOWS\SYSTEM\TBM23BA.TMP

C:\WINDOWS\SYSTEM\CP_1252.NLS=C:\WINDOWS\SYSTEM\TBM3000.TMP

C:\WINDOWS\SYSTEM\CP_1251.NLS=C:\WINDOWS\SYSTEM\TBM3001.TMP

C:\WINDOWS\SYSTEM\CP_1250.NLS=C:\WINDOWS\SYSTEM\TBM3002.TMP

C:\WINDOWS\SYSTEM\CP_950.NLS=C:\WINDOWS\SYSTEM\TBM3014.TMP

NUL=C:\WINDOWS\TTFCACHE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

C:\WINDOWS\COMMAND\MODE.COM

LH D:\MFD\MF.EXE

C:\VIAUDIO\VIAUDIO.COM

SET BLASTER=A220 I5 D0 P300

mode con codepage prepare=((850) C:\WINDOWS\COMMAND\ega.cpi)

mode con codepage select=850

keyb uk,,C:\WINDOWS\COMMAND\keyboard.sys

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - D:\DAP\DAPIEBAR.DLL - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE}

(no name) - D:\ACROBAT5\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job

Symantec NetDetect.job

Scan for Viruses.job

--------------------------------------------------

Enumerating Download Program Files:

[{41F17733-B041-4099-A042-B518BB6A408C}]

CODEBASE = http://a1540.g.akamai.net/7/1540/52/200112...meInstaller.exe

[CV3 Class]

InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL

CODEBASE = http://windowsupdate.microsoft.com/R1044/V...en/actsetup.cab

[Microsoft Office Tools on the Web Control]

InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\OUTC.DLL

CODEBASE = http://dgl.microsoft.com/downloads/outc.cab

[symantec RuFSI Registry Information Class]

InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RUFSI.DLL

CODEBASE = http://security2.norton.com/SSC/SharedCont...c/bin/cabsa.cab

[shockwave Flash Object]

InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX

CODEBASE = http://download.macromedia.com/pub/shockwa...ash/swflash.cab

[shockwave ActiveX Control]

InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL

CODEBASE = http://download.macromedia.com/pub/shockwa...director/sw.cab

[plug Class]

InProcServer32 = C:\WINDOWS\DOWNLO~1\CHARGI~1.DLL

CODEBASE = http://dist02.chargitdial.com/chargitplug.dll

[HeartbeatCtl Class]

InProcServer32 = C:\WINDOWS\DOWNLO~1\HRTBEAT.OCX

CODEBASE = http://fdl.msn.com/zone/datafiles/heartbeat.cab

[intraLaunch.MainControl]

InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\INTRALAUNCH.OCX

CODEBASE = file://L:\supercd\IntraLaunch.CAB

[update Class]

InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL

CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/...AB?37591.879375

[Cameractl Class]

InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CAMERA.OCX

CODEBASE = http://www.crtvg.es/camweb/camera.cab

[MSN Chat Control 4.5]

InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNCHAT45.OCX

CODEBASE = http://fdl.msn.com/public/chat/msnchat45.cab

[symantec AntiVirus scanner]

InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\AVSNIFF.DLL

CODEBASE = http://security.symantec.com/SSC/SharedCon...bin/AvSniff.cab

[{FA13A9FA-CA9B-11D2-9780-00104B242EA3}]

CODEBASE = http://www.wildtangent.com/install/wdriver...wave/wtinst.cab

[OPUCatalog Class]

InProcServer32 = C:\WINDOWS\SYSTEM\OPUC.DLL

CODEBASE = http://office.microsoft.com/productupdates...ontent/opuc.cab

[ActiveScan Installer Class]

InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\ASINST.DLL

CODEBASE = http://www.pandasoftware.com/activescan/as/asinst.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------

End of report, 9,321 bytes

Report generated in 0.216 seconds

Command line options:

/verbose - to add additional info on each section

/complete - to include empty sections and unsuspicious data

/full - to include several rarely-important sections

/force9x - to include Win9x-only startups even if running on WinNT

/forcent - to include WinNT-only startups even if running on Win9x

/forceall - to include all Win9x and WinNT startups, regardless of platform

/history - to list version history only

mark2 · March 17, 2003

There are a few things you could disable there and only launch when you require them, let ylou jhave some of your resources back, speed up your comp.

March 17, 2003

Yep???.......like what???.....the mouse thing and Tweekui, incd???? That always takes ages to load.......appreciate you having a look at this mark :)

mark2 · March 17, 2003

Wish you didn't have so much of that resource hog Norton there :D :D

Launch windows explorer and go to

WINDOWS\Start Menu\Programs\Startup, and delete the following shortcuts:

EPSON Background Monitor.lnk = C:\ESM2\Stms.exe

Event Reminder.lnk = D:\Printmaster\PrintMaster\PMremind.exe

Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

Then empty your Temp and Temporary Internet File Folders. You should then go to C:\windows\downloaded program files and remove the following Active X Control:

IntraLaunch.MainControl]

InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\INTRALAUNCH.OCX

CODEBASE = file://L:\supercd\IntraLaunch.CAB[{41F17733-B041-4099-A042-B518BB6A408C}]

CODEBASE = http://a1540.g.akamai.net/7/1540/52/200112...meInstaller.exe

Go to start, run and type msconfig then press enter. Go to the start up tab and uncheck the following

StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE

InCD = D:\incd\InCD.exe

TkBellExe = C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot

Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup

nwiz = nwiz.exe /install

IntelliType = "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe (assuming this is a multimedia keyboard and you don't use the multimedia functions)

RemoteControl = C:\WINDOWS\SYSTEM\rmctrl.exe what does this belong to ?

Press apply and reboot when prompted.

you will get a message regarding system configuration utility put a tick in the box in lower left corner and you won't see it again until you run msconfig again.

you should find you start a little quicker after doing the above. :) :)

March 17, 2003

waste of time unchecking this TkBellExe = C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot as realplayer will just create another entry when you use it again and continue to do it every time its unchecked.

mark2 · March 17, 2003

Apparently latest real player no longer does, :huh: so I'm told :huh:

March 17, 2003

mark2 I have tried removing it,using latest versions,as this site tells you you need to delete files http://www.pacs-portal.co.uk/startup_pages...tartup_full.htm

March 17, 2003

more info http://www.mikescomputerinfo.com/TkBellExe.htm

Boris · March 17, 2003

RemoteControl = C:\WINDOWS\SYSTEM\rmctrl.exe what does this belong to ?

This is Cyberlink PowerDVD I think.

March 17, 2003

well........TKbell.exe hasn't reticked itself!!! Just looked :)

I didn't get a message regarding system configuration utility though......is that bad? I did get a message saying that Norton couldn't start automatic email protection but went into Norton and put it on manually and that is ok......everything else seems ok.......thanks, :)

Oh yes......the remote control thing is something to do with powerdvd

mark2 · March 17, 2003

That links to http://www.mikescomputerinfo.com/TkBellExe.htm

also this:-

To disable "tkbell.exe" in the new version (1) Start RealOne Player (2) Tools -> Preferences (3) Automatic services in the Categories pane (4) Uncheck all options and then OK

at Pacmans Portal

March 17, 2003

nellie2 it reinstalls itself next time you use r/player,mark2 I have tried those options in r/player they do not work,I just block it with my firewall.

mark2 · March 17, 2003

Any noticeable difference Nellie (hope so) :P

there are one or two other things in your downloaded program files may not be needed too.

Have you run defrag recently ?

March 17, 2003

did defrag about a week ago.......do that sort of thing on a fairly regular basis

March 18, 2003

Have you tried reinstalling IE

Prince of Calcutta · March 18, 2003

and clean your mouse ?

;)

March 18, 2003

Mouse is optical.........I haven't reinstalled IE6 'cos the problem doesn't seem to be browser related, as it can start happening whether I am surfing or not. :(

Mark.......I meant to say, my boot up is a bit quicker, but not a great deal. Thanks for all the good info though, nice to be able to clear out all the junky stuff you don't really need. :)

Sign In

Strange goings on

Recommended Posts

Guest Nellie2

Link to comment

Share on other sites

Guest ellas

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest Nellie2

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest Nellie2

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest Nellie2

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest Nellie2

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest ellas

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest ellas

Link to comment

Share on other sites

Guest ellas

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest Nellie2

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest ellas

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest Nellie2

Link to comment

Share on other sites

Guest ordep

Link to comment

Share on other sites

Link to comment

Share on other sites

Guest Nellie2

Link to comment

Share on other sites

Join the conversation

Important Information