Desktop missing! 3

[tazzzkitty]

Yesterday, when I turned on my computer, I had no desktop. No icons, no taskbar, and could not right click. I could only get to things through task manager. But then it seems like everything works fine when I get to it.

I have Windows XP and it was updated. I changed no options that I can recall. Not in themes or anything. I had no restore points to use and I did virus scans that caught nothing.

Eventually, I decided to try to reinstall Windows XP. When it was finished reinstalling, it came up fine, and the desktop was there. But it was VERY slow, so I decided to reboot. Then it came up with no desktop AGAIN.

I still could find nothing wrong and I have since reinstalled one more time and the same thing happened. The first time it came up with the desktop, but then after restarting, no desktop.

Also, if I click on the start menu/taskbar options icon in Control Panel, it won't even open.

Other things I've tried:

Restarting in safe mode: I had a desktop. All options I checked while there, seemed normal.

clicking explorer.exe in the windows folder: it looked like it was trying to run, but then quit.

Chkdisc found no errors

Any suggestions you may have would be appreciated! Thanx.

 

[bcastner]

When you run it again, Start, Run, msconfig

Look at your Startup tab. There has to be a wacky startup program in there.

 

[tazzzkitty]

Well, I looked in msconfig for what loads on startup. Nothing seemed unusual, but i did turn off a few things that don't need to load on startup, including one program I don't even have anymore. Then I restarted and it still didn't load the desktop correctly. Any other ideas??? lol

 

[bcastner]

Any USB devices installed, connected and not turned on?

 

[tazzzkitty]

Nope!

 

[bcastner]

Download this startup tracker program, run it, and post the results here. It creates a .txt file:

http://www.dougknox.com/xp/utils/xp_starttrack.htm

 

[tazzzkitty]

Here's the results:

12/1/2003 11:58:16 AM

-- Registry - HKEY_LOCAL_MACHINE RunOnce --
,main drive Loader wininfo.exe

-- Registry - HKEY_LOCAL_MACHINE Run --
SoundMan SOUNDMAN.EXE
HPDJ Taskbar Utility C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
,main drive Loader wininfo.exe
NvCplDaemon RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz nwiz.exe /install
MULTIMEDIA KEYBOARD C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
AVG_CC C:\PROGRA~1\AVGANT~1\avgcc32.exe /STARTUP
Microsoft Works Update DetectiC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
MSConfig C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

-- Registry - HKEY_CURRENT_USER RunOnce --
No Items Found

-- Registry - HKEY_CURRENT_USER Run --
Weather C:\Program Files\AWS\WeatherBug\Weather.exe 1
MsnMsgr "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
,main drive Loader wininfo.exe
AIM C:\Program Files\AIM95\aim.exe -cnetwait.odl
Update Service "C:\Program Files\Common Files\Teknum Systems\update.exe" /startup

-- Registry - HKEY_USERS\.DEFAULT Run --
,main drive Loader wininfo.exe

-- Start Menu - Current User --
No Items Found

-- Start Menu - All Users --
Microsoft Office.lnk
Symantec Fax Starter Edition Port.lnk

-- Disabled Items --
lwbwheel
pptd40nt
flatbed
qttask
update
Adobe Gamma Loader

-- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon --
explorer.exe

-- Running Processes --
System Idle Process
System
smss.exe \SystemRoot\System32\smss.exe
csrss.exe
winlogon.exe winlogon.exe
services.exe C:\WINDOWS\system32\services.exe
lsass.exe C:\WINDOWS\system32\lsass.exe
svchost.exe C:\WINDOWS\system32\svchost -k rpcss
svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
spoolsv.exe C:\WINDOWS\system32\spoolsv.exe
wininfo.exe "C:\WINDOWS\System32\wininfo.exe"
nhksrv.exe "C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe"
avgserv.exe C:\PROGRA~1\AVGANT~1\avgserv.exe
nvsvc32.exe C:\WINDOWS\System32\nvsvc32.exe
explorer.exe "C:\WINDOWS\explorer.exe"
MMKeybd.exe "C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe"
Traymon.exe "C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe"
osd.exe "C:\Program Files\Netropa\Onscreen Display\OSD.exe"
avgcc32.exe "C:\Program Files\AVG Antivirus\avgcc32.exe"
aim.exe "C:\Program Files\AIM95\aim.exe"
msnmsgr.exe "C:\Program Files\MSN Messenger\msnmsgr.exe"
svchost.exe C:\WINDOWS\System32\svchost.exe -k imgsvc
iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
StartupTracker3.exe "C:\Program Files\startup tracker\StartupTracker3.exe"
wmiprvse.exe

 

[bcastner]

wininof.exe is screwing you up. It has already been reported as malware.

http://www.pacs-portal.co.uk/startup_pages/startup_num.php

Quote:

,main drive Loader wininfo.exe Suspected malware as it appears in 3 different registry locations!!!

See:

http://forums.techguy.org/t151017/s.html

 

[bcastner]

Most definately run Hijack This! and block the wininfo.exe file:

http://www.spywareinfo.com/articles/hijacked/#removalzip

 

[tazzzkitty]

OMG, it's fixed. I disabled wininfo.exe, restarted, then deleted it, restarted again. The desktop comes up normal now. Thank you so much!

 

[bcastner]

Remove from the recycle bin.

Watch that it does not reappear from the cache of protected files.

Turn of System Restore using Help and Support from the Start Button.

Turn it back on and set a new restore point.

These things have a way of re-appearing. Do a Start, search for wininfo.exe to make sure it does not lurk somewhere.

You are most welcome for the help. As many here said above, it just is not normal for XP to behave the way you were experiencing.

Final note:

Keep handy what I call the "Troubleshooting Trinity":

Hijack This!
Spybot Search and Destroy 1.2
AdAware

http://www.spywareinfo.com/articles/hijacked/#removalzip

 

[itsfisko]

Hi all I have read all your posts with interest. I have a simular sort of problem on my 100+ xp pro network. The problem is that the users desk top often don't appear at first logon and may require several attempt to get their desktop. Running delprof has some effect but not always. The users have folder redirection with a desktop setup in documents and settings in the computer.It is not a major problem more of an annoyance as the pupils get no desktop or should I more correctly say the defualt user desktop which is not what i want as this has drive access. Any help would be appreciated.

Some lead, some follow....I just Hope!

 

[mmendes]

itsfisko,
Did you ever find a solution to your problem? I have the same scenerio. 50 WinXP Pro desktops which occassiionally and at random, malfunction at boot up. User reboots a few times, problem is gone for a few days or even weeks. I have noticed that the svchost.exe that launches rpcss sits at 100% CPU when this happens. Any idea?

Thanks,
mmendes

 

[cb49747]

I was hoping for some help here. I'm having the same problem however I do not see this wininfo.exe running anywhere for me.

I downloaded the startup tracker and this is what I got.

-- Registry --
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

No Items Found

-- Registry --
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

ATIPTA C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
Symantec NetDriver Monitor C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
DVDLauncher "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
SoundMAXPnP C:\Program Files\Analog Devices\Core\smax4pnp.exe
SideWinderTrayV4 C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe
HPDJ Taskbar Utility C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
HPHmon03 C:\WINDOWS\system32\hphmon03.exe
Share-to-Web Namespace Daemon C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
RoxioEngineUtility "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
RoxioDragToDisc "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
RoxioAudioCentral "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime

-- Registry --
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

No Items Found

-- Registry --
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Spyware Doctor "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
ctfmon.exe C:\WINDOWS\system32\ctfmon.exe
Cacheman C:\Program Files\Cacheman\Cacheman.exe
H/PC Connection Agent "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

-- Registry --
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce

RunNarrator Narrator.exe

-- Registry --
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

Spyware Doctor "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

-- Start Menu - Current User --
No Items Found

-- Start Menu - All Users --
Acrobat Assistant.lnk
Microsoft Office.lnk

-- Disabled Items --
fwink
iTunesHelper
msmsgs
SkypeStatusClientTCP
realsched
Norton System Doctor
PowerReg SchedulerV2

-- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon --
Explorer.exe

-- Running Processes --
System Idle Process
System
smss.exe \SystemRoot\System32\smss.exe
csrss.exe C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe winlogon.exe
services.exe C:\WINDOWS\system32\services.exe
lsass.exe C:\WINDOWS\system32\lsass.exe
ati2evxx.exe C:\WINDOWS\System32\Ati2evxx.exe
svchost.exe C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe C:\WINDOWS\system32\svchost -k rpcss
svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe C:\WINDOWS\System32\svchost.exe -k NetworkService
svchost.exe C:\WINDOWS\System32\svchost.exe -k LocalService
CCSETMGR.EXE "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
SNDSrvc.exe "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"
SPBBCSvc.exe "C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"
CCEVTMGR.EXE "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
spoolsv.exe C:\WINDOWS\system32\spoolsv.exe
mdm.exe "C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"
NAVAPSVC.EXE "C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe"
NPFMNTOR.EXE "C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe"
NPROTECT.EXE C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
sdhelp.exe "C:\Program Files\Spyware Doctor\sdhelp.exe"
NOPDB.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
svchost.exe C:\WINDOWS\System32\svchost.exe -k imgsvc
symlcsvc.exe "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe"
wdfmgr.exe C:\WINDOWS\system32\wdfmgr.exe
explorer.exe C:\WINDOWS\Explorer.EXE
alg.exe C:\WINDOWS\System32\alg.exe
svchost.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter
jusched.exe "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe"
CCAPP.EXE "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
DVDLauncher.exe "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
smax4pnp.exe "C:\Program Files\Analog Devices\Core\smax4pnp.exe"
SWTrayV4.EXE "C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe"
hpztsb04.exe "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe"
hphmon03.exe "C:\WINDOWS\system32\hphmon03.exe"
hpgs2wnd.exe "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
hpgs2wnf.exe C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe -Embedding
DrgToDsc.exe "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
RxMon.exe "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
qttask.exe "C:\Program Files\QuickTime\qttask.exe" -atboottime
hphipm09.exe C:\WINDOWS\system32\HPHipm09.exe
ctfmon.exe "C:\WINDOWS\system32\ctfmon.exe"
Cacheman.exe "C:\Program Files\Cacheman\Cacheman.exe"
wcescomm.exe "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
AcroTray.exe "C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe"
Playlist.exe "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe" -Embedding
MSOFFICE.EXE "C:\Program Files\Microsoft Office\Office10\msoffice.exe"
iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
swdoctor.exe "C:\Program Files\Spyware Doctor\swdoctor.exe" /H
msmsgs.exe "C:\Program Files\Messenger\msmsgs.exe" -Embedding
WINZIP32.EXE "C:\PROGRA~1\WINZIP\winzip32.exe" "D:\My Downloads\System\StartupTracker3.zip"
StartupTracker3.exe "C:\Documents and Settings\burgers\Local Settings\Temp\StartupTracker3.exe"
wmiprvse.exe C:\WINDOWS\System32\wbem\wmiprvse.exe

-- Running Services --

Name: ALG
Description: Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\alg.exe

Name: Ati HotKey Poller
Description:
Startup Mode: Auto
Run from: C:\WINDOWS\System32\Ati2evxx.exe

Name: AudioSrv
Description: Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Browser
Description: Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: ccEvtMgr
Description: Symantec Event Manager
Startup Mode: Auto
Run from: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

Name: ccSetMgr
Description: Symantec Settings Manager
Startup Mode: Auto
Run from: "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"

Name: CryptSvc
Description: Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

Name: DcomLaunch
Description: Provides launch functionality for DCOM services.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost -k DcomLaunch

Name: Dhcp
Description: Manages network configuration by registering and updating IP addresses and DNS names.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: dmserver
Description: Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Dnscache
Description: Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k NetworkService

Name: ERSvc
Description: Allows error reporting for services and applictions running in non-standard environments.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Eventlog
Description: Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\services.exe

Name: EventSystem
Description: Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: helpsvc
Description: Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: HidServ
Description: Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: HTTPFilter
Description: This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k HTTPFilter

Name: lanmanserver
Description: Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: lanmanworkstation
Description: Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: LmHosts
Description: Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

Name: MDM
Description: Supports local and remote debugging for Visual Studio and script debuggers. If this service is stopped, the debuggers will not function properly.
Startup Mode: Auto
Run from: "C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe"

Name: navapsvc
Description: Handles Norton AntiVirus Auto-Protect events.
Startup Mode: Auto
Run from: "C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe"

Name: Netlogon
Description: Supports pass-through authentication of account logon events for computers in a domain.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\lsass.exe

Name: Netman
Description: Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Nla
Description: Collects and stores network configuration and location information, and notifies applications when this information changes.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: NPFMntor
Description: Detects installation of Symantec Firewall clients
Startup Mode: Auto
Run from: "C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe"

Name: NProtectService
Description: Protects files deleted from command line prompt and applications
Startup Mode: Auto
Run from: C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

Name: PlugPlay
Description: Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\services.exe

Name: Pml Driver
Description:
Startup Mode: Manual
Run from: C:\WINDOWS\system32\HPHipm09.exe

Name: PolicyAgent
Description: Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\lsass.exe

Name: ProtectedStorage
Description: Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\lsass.exe

Name: RasMan
Description: Creates a network connection.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: RemoteRegistry
Description: Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k LocalService

Name: RpcSs
Description: Provides the endpoint mapper and other miscellaneous RPC services.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost -k rpcss

Name: SamSs
Description: Stores security information for local user accounts.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\lsass.exe

Name: Schedule
Description: Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: SDhelper
Description:
Startup Mode: Auto
Run from: C:\Program Files\Spyware Doctor\sdhelp.exe

Name: seclogon
Description: Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: SENS
Description: Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

Name: SharedAccess
Description: Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: ShellHWDetection
Description:
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: SNDSrvc
Description: Symantec Network Drivers Service
Startup Mode: Auto
Run from: "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"

Name: SPBBCSvc
Description: Symantec SPBBC
Startup Mode: Auto
Run from: "C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"

Name: Speed Disk service
Description: Used to schedule disk defragmentation
Startup Mode: Auto
Run from: C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

Name: Spooler
Description: Loads files to memory for later printing.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\spoolsv.exe

Name: srservice
Description: Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: SSDPSRV
Description: Enables discovery of UPnP devices on your home network.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

Name: stisvc
Description: Provides image acquisition services for scanners and cameras.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k imgsvc

Name: Symantec Core LC
Description: Symantec Core LC
Startup Mode: Auto
Run from: C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Name: TapiSrv
Description: Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: TermService
Description: Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost -k DComLaunch

Name: Themes
Description: Provides user experience theme management.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: TrkWks
Description: Maintains links between NTFS files within a computer or across computers in a network domain.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

Name: UMWdf
Description: Enables Windows user mode drivers.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\wdfmgr.exe

Name: upnphost
Description: Provides support to host Universal Plug and Play devices.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

Name: W32Time
Description: Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: WebClient
Description: Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

Name: winmgmt
Description: Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

Name: wuauserv
Description: Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: WZCSVC
Description: Provides automatic configuration for the 802.11 adapters
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Any help would be greatly apreciated.

 

[linney]

Try these.

Removing adware & spyware
faq608-4650

Microsoft (GIANT Antispyware) Beta available
Thread779-979113

Try the free version of "Ewido"

http://www.ewido.net/

How is your machine in Safe Mode, or when logged in as another user?

 

[cb49747]

I norton antivirus current and finds no viruses, I have Spybot current and finds nothing.

In Safemode it works fine and when I log on as a different user same thing, I get the background but no icons or startup bar.

I also ran highjack this and have the log file that if anyone would think that would help.

 

[linney]

Do try
FAQ608-4650
Don't rely just on Norton in case it is missing something, a second opinion can save you a lot of time and effort.


"In Safemode it works fine and when I log on as a different user same thing". I am reading this to mean that you only have a problem in your user profile and not in others?

"To copy a user profile", see Help and Support program

811151 - How to Copy User Data to a New User Profile

http://support.microsoft.com/default.aspx?scid=kb;en-us;811151&FR=1&PA=1&SD=HSCH

Error Message: Windows Cannot Load Your Profile Because It May Be Corrupted (Q318011)

http://support.microsoft.com/support/kb/articles/q318/0/11.asp

See if you can narrow down the cause and difference between Safe Mode and Normal Mode?

310353 - How to Perform a Clean Boot in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310353&FR=1&PA=1&SD=HSCH

316434 - HOW TO: Perform Advanced Clean-Boot Troubleshooting in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;316434&FR=1&PA=1&SD=HSCH

310560 - How to Troubleshoot By Using the Msconfig Utility in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310560&FR=1&PA=1&SD=HSCH

 

[cb49747]

linney,

Thanks for your help.

I mis spoke about the profile. I have the same problem with the other profiles. The only way I can get it to work is in safe mode. I have tried most of the above with no result. I will try the clean boot option listed and see what that does. I did notice hover that it loads the background than sits, doesn't even look as if the pc is running than after 10 min. It loads up and works fine.

I not how to check to see if something is running durring that 10min.

 

[linney]

Does Ctrl+Alt+Del bring up the Task Manager during that idle period?

Again I advise a second opinion of virus, trojan, worm scanning software.

If you want further information obtainable from your "Hijack This" log, take it to this site for analysis. It MAY give you some entries to check out further, I emphasize MAY, as it is only the Analysis opinion.

HijackThis log file analysis

http://www.hijackthis.de/index.php

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

If they don't work you could try repairing windows by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

 

[cb49747]

Thanks again I have tried a few of the above mention antivirus and spyware software and get the same results, nothing.

I can do a ctrl alt delete and bring up the task manager. I have tried closing explorer.exe and then restarting and nothing. I still wait 10min and then it opens up and pc is fine.

I have also run the system file checker as well. I will get analysis on my highjack log and let you know what I get.

Thanks again for your help.

 

[linney]

Have a look in your Event Viewer too.

Have a look at any Services that are hanging or not starting. Windows Image Acquisition (WIA) comes to mind.

Is there any process in Task Manager that is using heaps of CPU during the hang?