Applications appearing on the desktop

Discussion in 'ProcessGuard' started by Wayne B, Jan 31, 2004.

Thread Status:
Not open for further replies.
  1. Wayne B

    Wayne B Registered Member

    Joined:
    Jan 4, 2004
    Posts:
    48
    The latest example of this is SDNTC.EXE. This is Norton Speed Disk. SDNTC.EXE on the desktop that showed up was a dummy file and somehow System Works is now pointed to it instead of the version in Program Files.

    I copied the version in Program Files to the desktop and it works fine now.

    I also protected it with Process Guard.

    I think the instructions suggested reinstalling the firewall and then protecting it in Process Guard.

    I will do this soon, but this was a work around for now.

    After I understand what is going on better I might rebuild everything and protect. I want to learn more before I do that though.

    Do you know what might be causing dummy executable files to show up on my desktop like this?

    I have had others.
     
  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi WayneB

    Sorry I cannot help you on this one as I am not a Norton System Works user.

    I cannot think how PG could cause this problem, system works probably installs deeply into the OS so that it can perform it's functions.

    Hopefully another users may be able to help or possibly contact Norton.
     
  3. gkweb

    gkweb Expert Firewall Tester

    Joined:
    Aug 29, 2003
    Posts:
    1,932
    Location:
    FRANCE, Rouen (76)
    I don't fully understand what is your pb, but i am a Norton SW user and i haven't any pbs with icons and everything else using PG.
     
  4. Wayne B

    Wayne B Registered Member

    Joined:
    Jan 4, 2004
    Posts:
    48
    I have had other applications show up on the desktop that are not Norton. This problem is with other programs also.
     
  5. siliconman01

    siliconman01 Registered Member

    Joined:
    Mar 6, 2003
    Posts:
    780
    Location:
    West Virginia (USA)
    Just out of curiousity, do you use Wormguard 3?
     
  6. Wayne B

    Wayne B Registered Member

    Joined:
    Jan 4, 2004
    Posts:
    48
    No the version of Wormguard is 4.

    I am going to uninstall my Norton programs and reinstall them.

    This problem is not caused by DiamondCS products. I had this problem before I used any of their products.

    I have just been trying to use Process Guard to stop it or at least block it until I can figure out what is causing it.
     
  7. siliconman01

    siliconman01 Registered Member

    Joined:
    Mar 6, 2003
    Posts:
    780
    Location:
    West Virginia (USA)
    I think the 4 is a "misprint" on the released version of Wormguard 3. That is unless DCS has released 4 in recent days and I have missed the announced.

    anyhow. ;) Doesn't sound like it is relevant because you were seeing problem prior to installation.
     
  8. Bowserman

    Bowserman Infrequent Poster

    Joined:
    Apr 15, 2003
    Posts:
    510
    Location:
    South Australia
    You are correct :)......designed to keep us on the edge of our seat untill WG 4 is released :blink: :) :D.

    Regards,
    Jade.
     
  9. Wayne B

    Wayne B Registered Member

    Joined:
    Jan 4, 2004
    Posts:
    48
    Another example of this I found tonight is helpctr.exe. This is the help and support from the start button in Windows XP Pro.

    I disabled Process Guard and that did not help.

    I searched and found many versions of it, some with zero length. Two in the prefetch area again.

    I deleted as many as I could and made a shortcut to the good one.

    This is on all of my computers. I would like to figure out what is causing it.

    I will probably have to rebuild them all. If I had an idea what is causing it I could better protect against it.
     
  10. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi WayneB,
    Can you download and run AutoStart Viewer from DCS here: http://www.diamondcs.com.au/index.php?page=products
    Run Autostart viewer with the Show services & drivers both ticked- Save the results to a file then copy and paste in your next post.
    We may see something that needs attention.

    Thanks. Pilli
     
  11. Wayne B

    Wayne B Registered Member

    Joined:
    Jan 4, 2004
    Posts:
    48
    I have included this as you asked, Pilli.

    DiamondCS Autostart Viewer (www.diamondcs.com.au) - Report for Wayne@P4, 02-02-2004
    c:\windows\system32\autoexec.nt
    C:\WINDOWS\system32\mscdexnt.exe
    C:\WINDOWS\system32\redir.exe
    C:\WINDOWS\system32\dosx.exe
    c:\windows\system32\config.nt
    C:\WINDOWS\system32\himem.sys
    c:\windows\system.ini [drivers]
    timer=timer.drv
    c:\windows\system.ini [boot]\shell
    C:\WINDOWS\Explorer.exe
    c:\windows\system.ini [boot]\scrnsave.exe
    C:\WINDOWS\System32\logon.scr
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
    C:\WINDOWS\Explorer.exe
    HKCU\Control Panel\Desktop\scrnsave.exe
    C:\WINDOWS\System32\logon.scr
    HKCR\vbefile\shell\open\command\
    C:\WINDOWS\System32\WScript.exe "%1" %*
    HKCR\jsfile\shell\open\command\
    C:\WINDOWS\System32\WScript.exe "%1" %*
    HKCR\jsefile\shell\open\command\
    C:\WINDOWS\System32\WScript.exe "%1" %*
    HKCR\wshfile\shell\open\command\
    C:\WINDOWS\System32\WScript.exe "%1" %*
    HKCR\wsffile\shell\open\command\
    C:\WINDOWS\System32\WScript.exe "%1" %*
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ccApp
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ccRegVfy
    C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon
    RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\AdaptecDirectCD
    C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\RegProt
    c:\regprot\regprot.exe /start
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\nwiz
    nwiz.exe /install
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SpeedOptimizer
    C:\PROGRA~1\SPEEDO~1\SPO.EXE
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\DownloadAccelerator
    C:\PROGRA~1\DAP\DAP.EXE /STARTUP
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe
    C:\WINDOWS\System32\ctfmon.exe
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS
    C:\Program Files\Messenger\msmsgs.exe
    HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
    C:\WINDOWS\system32\SHELL32.dll
    C:\WINDOWS\system32\SHELL32.dll
    C:\WINDOWS\System32\webcheck.dll
    C:\WINDOWS\System32\stobject.dll
    C:\WINDOWS\Tasks\Norton SystemWorks One Button Checkup.job
    C:\Program Files\Norton SystemWorks\OBC.exe
    C:\WINDOWS\Tasks\Symantec NetDetect.job
    C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
    C:\Documents and Settings\Wayne\Start Menu\Programs\Startup\Process Guard.lnk
    C:\Program Files\ProcessGuard\procguard.exe
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    C:\Program Files\Microsoft Office\Office10\OSA.EXE
    HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
    autocheck autochk *
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
    C:\WINDOWS\system32\userinit.exe
    HKLM\System\CurrentControlSet\Control\WOW\cmdline
    C:\WINDOWS\system32\ntvdm.exe
    HKLM\System\CurrentControlSet\Control\WOW\wowcmdline
    C:\WINDOWS\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386
    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\
    C:\WINDOWS\System32\dcsws2.dll
    C:\WINDOWS\system32\mswsock.dll
    C:\WINDOWS\system32\rsvpsp.dll
    HKLM\System\CurrentControlSet\Services\AFD\
    C:\WINDOWS\System32\drivers\afd.sys
    HKLM\System\CurrentControlSet\Services\AudioSrv\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\Browser\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\BT848\
    C:\WINDOWS\system32\drivers\BT848.sys
    HKLM\System\CurrentControlSet\Services\BTTUNER\
    C:\WINDOWS\system32\drivers\BTTUNER.sys
    HKLM\System\CurrentControlSet\Services\BTXBAR\
    C:\WINDOWS\system32\drivers\BTXBAR.sys
    HKLM\System\CurrentControlSet\Services\ccEvtMgr\
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    HKLM\System\CurrentControlSet\Services\ccPxySvc\
    C:\Program Files\Norton Internet Security\ccPxySvc.exe
    HKLM\System\CurrentControlSet\Services\Creative Service for CDROM Access\
    C:\WINDOWS\System32\CTsvcCDA.exe
    HKLM\System\CurrentControlSet\Services\CryptSvc\
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\Dhcp\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\Diskeeper\
    C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
    HKLM\System\CurrentControlSet\Services\dmserver\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\Dnscache\
    C:\WINDOWS\System32\svchost.exe -k NetworkService
    HKLM\System\CurrentControlSet\Services\ERSvc\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\Eventlog\
    C:\WINDOWS\system32\services.exe
    HKLM\System\CurrentControlSet\Services\helpsvc\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\imonNT\
    C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
    HKLM\System\CurrentControlSet\Services\iSMBIOS\
    \??\C:\WINDOWS\System32\drivers\iSMBIOS.SYS
    HKLM\System\CurrentControlSet\Services\lanmanserver\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\lanmanworkstation\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\LmHosts\
    C:\WINDOWS\System32\svchost.exe -k LocalService
    HKLM\System\CurrentControlSet\Services\MDM\
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    HKLM\System\CurrentControlSet\Services\navapsvc\
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    HKLM\System\CurrentControlSet\Services\NISUM\
    C:\Program Files\Norton Internet Security\NISUM.EXE
    HKLM\System\CurrentControlSet\Services\NProtectService\
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    HKLM\System\CurrentControlSet\Services\NVSvc\
    C:\WINDOWS\System32\nvsvc32.exe
    HKLM\System\CurrentControlSet\Services\PfModNT\
    \??\C:\WINDOWS\System32\PfModNT.sys
    HKLM\System\CurrentControlSet\Services\PGMsgProt\
    C:\Program Files\ProcessGuard\pg_msgprot.exe
    HKLM\System\CurrentControlSet\Services\PlugPlay\
    C:\WINDOWS\system32\services.exe
    HKLM\System\CurrentControlSet\Services\PolicyAgent\
    C:\WINDOWS\System32\lsass.exe
    HKLM\System\CurrentControlSet\Services\procguard\
    \??\C:\WINDOWS\System32\drivers\procguard.sys
    HKLM\System\CurrentControlSet\Services\RpcSs\
    C:\WINDOWS\system32\svchost -k rpcss
    HKLM\System\CurrentControlSet\Services\SamSs\
    C:\WINDOWS\system32\lsass.exe
    HKLM\System\CurrentControlSet\Services\SAVRTPEL\
    \??\C:\WINDOWS\System32\Drivers\SAVRTPEL.SYS
    HKLM\System\CurrentControlSet\Services\SBService\
    C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    HKLM\System\CurrentControlSet\Services\Schedule\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\Secdrv\
    C:\WINDOWS\System32\DRIVERS\secdrv.sys
    HKLM\System\CurrentControlSet\Services\seclogon\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\SENS\
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\SharedAccess\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\ShellHWDetection\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\SIODRV\
    \??\C:\WINDOWS\System32\drivers\SIODRV.SYS
    HKLM\System\CurrentControlSet\Services\Speed Disk service\
    C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    HKLM\System\CurrentControlSet\Services\Spooler\
    C:\WINDOWS\system32\spoolsv.exe
    HKLM\System\CurrentControlSet\Services\srservice\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\stisvc\
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    HKLM\System\CurrentControlSet\Services\Themes\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\TrkWks\
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\uploadmgr\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\W32Time\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\WebClient\
    C:\WINDOWS\System32\svchost.exe -k LocalService
    HKLM\System\CurrentControlSet\Services\winmgmt\
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\WMDM PMSP Service\
    C:\WINDOWS\System32\MsPMSPSv.exe
    HKLM\System\CurrentControlSet\Services\wuauserv\
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    HKLM\System\CurrentControlSet\Services\WZCSVC\
    C:\WINDOWS\System32\svchost.exe -k netsvcs
     
  12. Wayne B

    Wayne B Registered Member

    Joined:
    Jan 4, 2004
    Posts:
    48
    The Microsoft error that they want me to send, says that it is a driver error.

    The only driver error in the device manager is the scanner and that has had a question by it for a long time and works anyway.

    I do need to uninstall my Norton software and reinstal it. The live update is not working correctly.

    I have some unusual devices. TV card and 3D hardware. I have not had any trouble with these lately though.

    My other computers do not have these devices and still have this problem of applications appearing on the desktop.

    I you see anything that might be worth looking into let me know.
     
  13. siliconman01

    siliconman01 Registered Member

    Joined:
    Mar 6, 2003
    Posts:
    780
    Location:
    West Virginia (USA)
    Wayne B,

    I would like to alert you to some "interferences" that can/do occur on some systems using Wormguard 3. These happened on my system. I have been following your thread here and see some very strong similiarities.

    1. Norton LiveUpdate fails to function after installing Wormguard 3. This failure is observed when trying to manually activate LiveUpdate from within the NAV main screen or from the Control Panel. Automatic LiveUpdate in the Task Scheduler is not affected.

    To correct this, use Windows Explorer, locate LUALL.exe and create a shortcut for LUALL.exe on your desktop or in your Quick Launch bar. This will allow you to manually activate Norton's LiveUpdate without having to open the main screen of NAV. Please note also that there is a new version of Norton LiveUpdate that was released on 6-January-2004; however, this will not resolve the overall conflict with WG 3.

    2. The Help and Support function no longer works correctly after installing Wormguard 3.

    To correct this, use Windows Explorer, locate Helpctr.exe in your Binaries folder. Create a shortcut for Helpctr.exe and place it on your desktop or in your Quick Launch bar. This will permit you to use the Help and Support feature.

    HTH
     
  14. Wayne B

    Wayne B Registered Member

    Joined:
    Jan 4, 2004
    Posts:
    48
    I have done this with helpctr.exe and the exe for Speed Disk. I have not tried it with LUALL.exe.

    The odd thing about Speed Disk is that inside SW it points to the desktop and now works.

    Is there any news on when these problems will be corrected?
     
  15. siliconman01

    siliconman01 Registered Member

    Joined:
    Mar 6, 2003
    Posts:
    780
    Location:
    West Virginia (USA)
    I suspect it will be Wormguard 4 release. From the way it has been explained on some of the forum threads, it is actually a Windows problem. However, I've never had it surface until WormGuard 3 is installed. And these failures do not occur on my machine unless WormGuard 3 is installed.
     
  16. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    WayneB, I am not an expert but your ASviewer report looks OK to me.

    WG3 could be causing some problems with Norton or vice versa.
     
  17. Wayne B

    Wayne B Registered Member

    Joined:
    Jan 4, 2004
    Posts:
    48
    That it is actually a Windows problem makes scense because I am sure I have seen this problem even before I got DiamondCS software. Wormguard 3 probably does something to trip up Windows more often.
     
  18. ronny

    ronny Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    231
    Location:
    Belgium
    Yep, the same here. :(
    I am a registered user of TDS-3, ProcessGuard,Port Explorer and...Worm Guard. But it is only when the protection of WormGuard is installed (enabled) that i get these (little) annoyances , like helpctr.exe +OBC.exe (all 0-bytes) appearing on my desktop.
    And, one time, NSW wasn't working correctly anymore and i had to re-install it.

    But i heard that Worm Guard 4 is on his way (at least i hope ;) ) and that this latest version will solve this. :)
     
Thread Status:
Not open for further replies.