cursor disappears and the window becomes inactive; Windows ME

[Louis Peter]

Often when I start up my computer or awaken it, I have problems with my cursor disappearing and the window that I'm working in goes to inactive (i.e., the dark blue banner at the top of the window goes to gray). This will happen every minute or so for about the first 20 minutes. S far I have noticed it when I'm using "MS Word" and any browser I use. I have run Spybot and AdAware several times but it has not cleared up the problem. At the end of running Spybot and AdAware, a number of "toolbar" entries remain and are unable to be deleted. The dialogue box indicates that they may still be in use. I can't delete them even when I restart my computer and re-run the anti-spyware programs. I'm unsure if the "toolbar" entries are the issue or not. I'm running Windows ME. Many thanks for considering my problem.

 

[Heeter]

Hello Louis Peter,

Welcome to the OSNN forums,

It sounds like you are dealing with spyware. If you are restart computer in "Safe Mode" (Most probably pressing F8 while computer is booting up), you can run around and delete stuff in your machine that under normal startup you can't. Try running Spybot under "Safe Mode".

Try that and let us know how it goes.

Heeter

 

[Louis Peter]

Heater, thanks for reponding. I ran adaware and spybot in safe mode and eliminated all critical objects. Unfortunately the problem has continued to occur intermittently. On some occasions (fewer than 20%), problem appears to be the result of internet explorer pop-up ads, even thoguh I use Firefox as my browser. On all occasions, I can hear my hard drive crank for a few seconds when the cursor disappears. Thanks for your further consideration.

 

[Heeter]

Hi Louis Peter,

Does it seize up to the point that you have to reboot? It's seems to me, from how I understand what your saying, is that an application seems to suck up your resources for a little while it runs. By any chance do you have Norton's antivirus? You are getting popup ads from nowhere and appearing on your desktop?

Just trying to figure out what is happening, maybe Norton's resource heavy application is running in the background, maybe a trojan is still lurking in the shadows, etc.....


Heeter

 

[Louis Peter]

Hi, Heater. Yes, I have Norton anti-virus and have had it for many years, however it is only recently that the cursor problem has occurred. Yes, I seem to get popups from nowhere when I initially reawaken my computer. I might get two or three in the few minutes that I begin working and then they stop. Yes, it seems like something is sucking up my computer resources momentarily when the cursor disappears, even when there is no popup involved (i.e., you can hear the harddrive crank for a few seconds). When I click back into the window I was working in (whether it was a "word" doc, email message or browser window), the cursor returns and i can continue. However the cursor might disappear another half a a dozen times over the course of the next 10 minutes. Eventually, the problem seems to stop after I've been working consecutively for 10-20 minutes or more. Yes, my computer seizes up and I have to reboot often, but this seems to be unrelated to the cursor disappearing issue since they don't happen together. I chalked that one up to the seemingly highly unstable Win ME OS.

Interestingly, when I look at my virus history in Norton it advises that I have 3 viruses that have been "left alone" and not quarantined. They are all "W32.Beagle.AO@mm" viruses. Could this be the issue? Thanks again for trying to help!

 

[Heeter]

That could be it right there, The Beagle worm. I would certainly download the removal tool from Symantic/Norton site and get rid of it. The Beagle is a trojan, so it sucks up resources as it tries to connect to the 'net and such. Don't forget to turn off your System Restore before running the tool, as the bug hides in your "Volume System Information" folder.

On a side note, have you thought of maybe upgrading to XP? With MS not supporting WinME with security patches and upgrades, WinME can become a security risk while on the 'net, let alone it's a very volitile and unstable OS even when running smoothly.

Heeter

 

[Louis Peter]

Hmmm, I downloaded and ran the Norton tool. It indicated that the W32.Beagle, Trojan. Tooso has not been fund on my computer despite the fact that my virus history says that I have 3 of these (W32.Beagle.AO.mm) that have been "left alone" on my computer.

Yes, I have considered upgrading to XP. I'm curious if it's an easy upgrade but would certainly want to resolve this other issue first. Any other thoughts? Thanks!

 

[Louis Peter]

If I upgrade my OS to win xp from win me would that likely get rid of the problem that I'm having?

 

[ElementalDragon]

reinstalling your OS, or upgrading to a new one (as long as you do a full format and reinstall to do said upgrade) will fix the problem, since it is deleting every single thing from your hard drive and starting clean. I'd still try to find out some way of removing the virus/spyware that's on your computer before reinstalling/upgrading your OS, or at least backing up data that you absolutely need.

Also...... Windows ME isn't the greatest OS to begin with. don't think WinME really EVER had a good part about it. seemed to basically be Windows 98, except more crash happy. Before we recommend upgrading to Windows XP, i'd like to ask what your system specs are? CPU type and speed, ammount of RAM, etc...

 

[Louis Peter]

Specs are as follows:

Compaq Presario 5000Z
35GB hard drive (16GB still available)
AMD Athlon (I think the processor speed is around 900Mhz)
640 MB RAM
WIN ME 4.90.3000

Thx!

 

[ElementalDragon]

hmm...... i believe it should run XP. it might not run extremely fast, but it shouldn't be a problem. anybody else have any input?

 

[kcnychief]

Specs are as follows:

Compaq Presario 5000Z
35GB hard drive (16GB still available)
AMD Athlon (I think the processor speed is around 900Mhz)
640 MB RAM
WIN ME 4.90.3000

Thx!

That will run XP fine. Here are the system requirements for
XP Home
http://www.microsoft.com/windowsxp/home/evaluation/sysreqs.mspx
XP Pro
http://www.microsoft.com/windowsxp/pro/evaluation/sysreqs.mspx

You should also run the Upgrade Advisor..
http://www.microsoft.com/windowsxp/pro/upgrading/advisor.mspx

The Upgrade Advisor can also be run from the XP CD, incase you don't want to download. This gives you an idea if any of your current software/hardware will experience any problems running in the XP environment

 

[Louis Peter]

Ok, thanks guys. I will see about updating the OS. I'm still a bit at a loss on the virus. It appears to be a difficult one to resolve. I assume that under normal conditions, when upgrading to XP from ME, my files would automatically be restored. If that's the case, wouldn't the virus be reinstalled?

 

[ejn74]

You don't want to upgrade. you want to save all important items to a location other than th drive you will install the OS on. Upgrading from me will not get rid of the issues completely. After ypu have saved every thing you will then want to wipe the hard drive and install the new OS.

 

[napalmnthemorning]

Did you try running HijackThis and get a read out on whats running on your PC. Post it here if you can. You want to make sure if you do save any of your files they aren't infected. The bottom line however Louis Peter is your going to want to reformat and install XP at some point in time. You'll be glad you did.

 

[Louis Peter]

Thanks for yur responses. Here is the log from the hijack scan:

Logfile of HijackThis v1.99.1
Scan saved at 11:35:36 PM, on 7/11/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\EOQQGN.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMPAQ\DIGITAL DASHBOARD\DEVGULP.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\WINDOWS\SYSTEM\CARPSERV.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\WINDOWS\SYSTEM\E_S4I2K1.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\CASIO\PHOTO LOADER\PLAUTO.EXE
C:\WINDOWS\COMPAQ\EREG\REMIND32.EXE
C:\PROGRAM FILES\EPSON\EPSON CARDMONITOR\EPSON CARDMONITOR1.1.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presario/deskredir.dll?c
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir.dll?c
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\lg829sjl.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\lg829sjl.slt\prefs.js)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD0.DLL
O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\SYSTEM\WINSTAT12.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBAR.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [Dcfssvc] C:\PROGRA~1\COMMON~1\KODAK\HYDRA_DR\DCFSSVC.EXE --pdr: ""C:\Program Files\Common Files\KODAK\HYDRA_DR\dcmnter.pdr""
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [Digital Dashboard] Crogram Files\Compaq\Digital Dashboard\DevGulp.exe
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\SYSTEM\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /O7 "EPUSB1:" /M "Stylus Photo RX500"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [eoqqgn] C:\WINDOWS\SYSTEM\eoqqgn.exe
O4 - HKLM\..\Run: [hny] C:\WINDOWS\SYSTEM\hny.exe
O4 - HKLM\..\Run: [pflushh] C:\WINDOWS\SYSTEM\pflushh.exe
O4 - HKLM\..\Run: [jgs] C:\WINDOWS\SYSTEM\jgs.exe
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\Run: [glteddx] C:\WINDOWS\SYSTEM\glteddx.exe
O4 - HKLM\..\Run: [iaewuag] C:\WINDOWS\SYSTEM\iaewuag.exe
O4 - HKLM\..\Run: [bvav] C:\WINDOWS\SYSTEM\bvav.exe
O4 - HKLM\..\Run: [bzekj] C:\WINDOWS\SYSTEM\bzekj.exe
O4 - HKLM\..\Run: [axvep] C:\WINDOWS\SYSTEM\axvep.exe
O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\SYSTEM\E_S4I2K1.EXE /P24 "EPSON Stylus Photo RX500" /M "Stylus Photo RX500" /EF "HKCU"
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Reminder-cpq40601.lnk = C:\WINDOWS\Compaq\Ereg\Remind32.exe
O4 - Startup: EPSON CardMonitor.lnk = C:\Program Files\EPSON\EPSON CardMonitor\EPSON CardMonitor1.1.exe
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: Compaq Knowledge Center.lnk = C:\Program Files\Compaq Knowledge Center\bin\silent.exe
O8 - Extra context menu item: SirSearch - file://C:\Program Files\PWRSMND1\Cache\SelectedContextSearch.htm
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb02986US_ZNxmk31169US
O8 - Extra context menu item: &Viewpoint Search - res://C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBAR.DLL/CXTSEARCH.HTML
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {43E1F2E4-C2BA-11D3-AC40-0050049804AB} (Update Class) - http://64.39.69.14/dev/update.cab
O16 - DPF: {2B1AA38D-2D12-11D5-AAD0-00C04FA03D78} (LocalExec Control) - https://www.i-login.net/nps/portal/...gadgets.shortcut.ShortcutGadget/LocalExec.CAB
O16 - DPF: {34BC63CA-BFEF-11D4-A1D0-00C04FA03D6A} (Axdappxica Control) - https://www.i-login.net/nps/portal/...and.gadgets.LaunchItemGadget/bin/DAppXICA.CAB
O16 - DPF: {8F5194C4-5FEB-42D7-ACCE-DB249CE255F5} (HiOpt Class) - https://137.65.3.31/sales/opt.cab
O16 - DPF: {E06373B3-02C9-11D5-8BE8-00D0B7C0A3B1} (WinHook Class) - https://137.65.3.31/sales/14072/applets/axhook.cab
O16 - DPF: {17238D90-7CA7-4FEB-97D7-2D7B1DC89724} (XRPC Class) - https://137.65.3.31/sales/14072/applets/siebelrpc.cab
O16 - DPF: {0DD4833D-DFFA-11D3-94D7-0050DAC353B6} (DndCtrl Class) - http://www.ofoto.com/OfotoDND.cab
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - http://137.65.82.64/main/Install/CentraDownloader.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw7fd.law7.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {631F0C94-C02F-40AC-A31B-DDC39731FC81} (Siebel Option Pack for IE 7.0.4) - https://phoenix.i-login.net/sales/14169/applets/SiebelOptionPack.cab
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - http://www.shop.intuit.com/store/executables/ie/IDA.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/30a0d6e44cafacdfa515/netzip/RdxIE601.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\WINDOWS\msxml4.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

 

[Louis Peter]

Can anyone advise on what I should do with the results of the Hijack This scan posted? Thanks in advance!

 

[ejn74]

Hey Louis did you get it working or are there still problems?