[pyro_nemesis]

Hi,

I have a rather strange popup problem on my laptop. Every so often (randomly between every 10 - 60 mins or so) I get a blank popup on my taskbar, as if a new window is opening, but no window appears, and it always disappears in under a second. I've managed to get my mouse over it, but no description appears before it's gone again.

I'm not sure if perhaps it is just a popup that is getting killed by a popup blocker, and I'm just seeing a ghost image of it, or if maybe I have an infection.

I managed to capture a screenshot of it a few minutes ago, which should help you to see what I'm trying to describe. Again, it's the blank window in the taskbar @ the bottom.

I've run AdAware SE and scanned w/ both Norton and the online Symantec AV software and found nothing. The system process list doesn't appear to have anything abnormal in it, and my computer isn't slowed from this. Also, Zone Alarm hasn't made any notifications of its activity.

Btw I have Windows XP w/ SP2 and all updates.

I hope that I've adequately described this problem, and would greatly appeciate any help.

Thanks,
Steve

Edited by pyro_nemesis, 13 September 2005 - 12:00 PM.

[Advertisements]

I would speculate that it is a popup getting killed (what is the popup blocker?)--does it have an audible noise for blocks, but I don't think those sites I see have popups.

Messenger service off?

Have you actually posted a hijacklog to malware yet?

[gerryf]

I would speculate that it is a popup getting killed (what is the popup blocker?)--does it have an audible noise for blocks, but I don't think those sites I see have popups.

Messenger service off?

Have you actually posted a hijacklog to malware yet?

[pyro_nemesis]

I have the google toolbar w/ it's popup blocker, and zone alarm has some basic popup blocking, but that's about it.

It doesn't make the noise for a blocked popup either. It happens even when I am not connected to the internet, so I don't think it's from a particular website.

I haven't posted a hijackthis log yet, and that's the next thing I'm going to try.

Thanks,
Steve

[pyro_nemesis]

okay, I ran HijackThis and here's what I got:






Logfile of HijackThis v1.99.1
Scan saved at 11:12:38 AM, on 9/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Adobe\Photoshop 7.0\Photoshop.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Steve\My Documents\My Software Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -

C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program

files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail

Notifier\G001-1.0.25.0\gnotify.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair

Pro\RegistryRepairPro.exe 4
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe

Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital

Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft

Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Google Search - res://c:\program

files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program

files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program

files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program

files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program

files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program

files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -

http://go.microsoft....k/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -

http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) -

http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) -

http://download.zone...ctor/WebAAS.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} -

http://us.dl1.yimg.c...utocomplete.cab
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\Toshiba\Power

Management\CeEPwrSvc.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. -

C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program

Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - C:\Program Files\Norton

SystemWorks\Norton Utilities\NPROTECT.EXE (file missing)
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony

Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner -

%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony

Shared\AVLib\Sptisrv.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\Ivp\Swupdate\swupdtmr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

C:\WINDOWS\system32\ZoneLabs\vsmon.exe











Anything look suspicious?

Thanks again,
Steve

[gerryf]

suspicious as in spyware, not at first glance, but you have a number of things that look to regularly schedule updates.

You said it occurs regularly...what's the pattern? My first inclination is the gmail notifier

[pyro_nemesis]

I've had the gmail notifier for quite some time, long before this problem started. Also, I get this problem even when the gmail notifier is shut down, as well as when I turn off any messenger programs.

Thanks for your help,
Steve

[pyro_nemesis]

I forgot to mention, it seems to happen roughly once every 10-15 minutes. Sometimes I don't notice it for almost an hour, but I would guess this is only because I miss it.

It's quite brief (around a second or less) but appears through any fullscreen programs (which is when I notice it the most). It's quite annoying when trying to watch a movie, as I'm sure you can imagine.

Thanks,
Steve

[chompymcchomp]

Hi guys,
I am having the exact same problem as pyro_nemesis. Blank window in the task bar for a second or so. It doesn't seem like it does anything else but that. I ran Spybot and Adaware. I'm running XP SP2, norton 2k5 and also using firefox as browser.

Thanks,
Sean

[pyro_nemesis]

Hi guys,
  I am having the exact same problem as pyro_nemesis. Blank window in the task bar for a second or so.  It doesn't seem like it does anything else but that.  I ran Spybot and Adaware.  I'm running XP SP2, norton 2k5 and also using firefox as browser.

Thanks,
Sean

I think this problem is solved....

I've been hearing that HP printer software (possible other HP software as well) can be the cause of this. I uninstalled all of my HP printer software and drivers, and the problem seems to have gone away. If you have any HP devices installed on your computer, I suggest uninstalling them to see if this fixes the problem.

If the problem returns once you reinstall everthing, try emailing HP about your problem. I haven't reinstalled my printer yet, but if the problem comes back, I'll email HP.

I hope this helps,
Steve

[chompymcchomp]

I think this problem is solved....

I've been hearing that HP printer software (possible other HP software as well) can be the cause of this.  I uninstalled all of my HP printer software and drivers, and the problem seems to have gone away.  If you have any HP devices installed on your computer, I suggest uninstalling them to see if this fixes the problem.

If the problem returns once you reinstall everthing, try emailing HP about your problem.  I haven't reinstalled my printer yet, but if the problem comes back, I'll email HP.

I hope this helps,
Steve

Hi there, i was just about to post the exact same thing. I had some HP printing software too. I read somewhere that these blank taskbar popups were results of "bad coding" or something of the like.
Since the uninstall about an hour ago the windows have ceased.

FYI. i had the digital camera printer thats able print off of camera memory cards installed. and its software.

Thanks
Sean

[pyro_nemesis]

Hi there, i was just about to post the exact same thing.  I had some HP printing software too.  I read somewhere that these blank taskbar popups were results of "bad coding" or something of the like. 
Since the uninstall about an hour ago the windows have ceased.

FYI. i had the digital camera printer thats able print off of camera memory cards installed. and its software.

Thanks
Sean

I'm glad it fixed the problem, I just hope that HP fixes this and provides updates.

Steve

[JonEdangerousli]

Ok, I was having the same problem. Text of chat with HP non-support tech follows:

Sandy: Hi John,
Sandy: Welcome to HP Total Care for All-In-One products. My name is Sandy. How may I help you today?
John : Hi Sandy
John : I have an issue with the software
John : perhaps you have a fix for it
John : every 15 min an empty window pops up on my taskbar for about one second
Sandy: I regret for the inconvenience caused to you.
John : I've researched this and found that it is your software that is doing this
Sandy: John, Could you please let me know what exact that popup says
John : it is taking focus away from other documents I'm typing
Sandy: I regret for the inconvenience caused to you.
John : for the second it is on the screen
Sandy: I understand
John : this is a major inconvenience
Sandy: It will be help full, if you will be able to let me know what that popup says
John : it is an empty windowJohn : that pops up in the taskbar
Sandy: Because this might be an issue related to your computer or Operating system
John : no, it's the hp software
Sandy: Okay
Sandy: Let me know since how long you are experiencing this issue with your All in One?
John : since I installed the software
Sandy: Okay
Sandy: Before we proceed, Could you please provide me the Model Number of the All in One?(Ex : Officejet 7100, PSC 1200, etc.,.)
John : psc-1315
Sandy: Okay
Sandy: John, have you tried any thing to resolve this issue?
John : yes, I uninstalled the hp software
John : that resolved the issue
John : however the printer doesn't work without it
John : should I pack it up and return it?
Sandy: No
Sandy: Right now is HP software installed in the computer?
John : yes, I downloaded the latest version and reinstalled it
Sandy: Okay
Sandy: Are you able to print, copy and scan ?
John : yes
John : http://www.geekstogo...showtopic=63181
Sandy: Okay
John : I am not the only person experiencing this
John : as that link shows
Sandy: John, this issue might be occurring due to the HP Imaging monitor
John : I tried unistalling only that part of the software
John : but it didn't resolve the issue
Sandy: I will provide you few troubleshooting steps to resolve this issue, please copy these steps to a notepad or word document
John : ok
Sandy: I appreciate your patience and efforts to resolve the issue
Sandy: To resolve the problem, remove HP Digital Imaging monitor entries from the start up of the computer using MSConfig utility.

=== Running MSConfig ===

You can run MSConfig by following these steps:

1. Click Start and select Run.
2. Type "msconfig" and press Enter.
3. Click the Startup tab.
4. Uncheck the entries in the start up having the prefix HP.
5. Also, uncheck all the entries related to HP Digital Imaging monitor entry from the start up.
6. Click OK.
7. Restart the system.



Note: After restarting the computer you will see system configuration window, in the bottom of this window you will find a box that says do not show this message again please check this option and click on OK, if you do not check this box the system configuration window will keep on appears when ever you reboot the computer
Sandy: Let me know when you are done with copying
John : ok, I've copied the entire conversation for future reference
Sandy: Great
Sandy: Are you comfortable with the steps and information I have provided to you?
John : yes, if this doesn't resolve the issue I'll be back here
John : thank you
John : do you have a list of all the entries related to HP Digital Imaging monitor?
Sandy: Unfortunately no
Sandy: Let me provide you with the chat session id.
Sandy: The session Id of this chat is 10011011126885012378, In the case this problem persist please use this session id as reference,when you login again to the "HP Total Chat Support" this will help us to serve you faster and better.
John : that might be a good list to have
Sandy: Sure, we I will find it out an keep a record, from now on
Sandy: I apologize for the inconvenience
John : thank you for your help
Sandy: I appreciate your patience and efforts
Sandy: It has been great pleasure assisting you
Sandy: Have a great day and week end
Sandy: Bye and Take care

4. Uncheck the entries in the start up having the prefix HP.
5. Also, uncheck all the entries related to HP Digital Imaging monitor entry from the start up.
6. Click OK.
7. Restart the system.



Note: After restarting the computer you will see system configuration window, in the bottom of this window you will find a box that says do not show this message again please check this option and click on OK, if you do not check this box the system configuration window will keep on appears when ever you reboot the computer
Sandy: Let me know when you are done with copying
John : ok, I've copied the entire conversation for future reference

Sandy: Great
Sandy: Are you comfortable with the steps and information I have provided to you?
John : yes, if this doesn't resolve the issue I'll be back here
John : thank you
John : do you have a list of all the entries related to HP Digital Imaging monitor?
Sandy: Unfortunately no
Sandy: Let me provide you with the chat session id.
Sandy: The session Id of this chat is 10011011126885012378, In the case this problem persist please use this session id as reference,when you login again to the "HP Total Chat Support" this will help us to serve you faster and better.
John : that might be a good list to have
Sandy: Sure, we I will find it out an keep a record, from now on
Sandy: I apologize for the inconvenience
John : thank you for your help
Sandy: I appreciate your patience and efforts
Sandy: It has been great pleasure assisting you
Sandy: Have a great day and week end
Sandy: Bye and Take care