Xp Sp@ Glitch

[aghoffmann]

Ever since installing the XP SP2 I get a pop-up warning message every time I boot up. In the blue banner at the top it says "Stop Device". The text of the message is "This application will not run in ths Operating System", then it has an "OK" button. Any ideas?

See attached image:

Thanks!

[TheTerrorist_75]

More information needed. Is your computer proprietary (Dell, HP/Compaq or etc.)? Is XP the original OS installed or was it upgraded to XP? What are your system hardware specs? What non-Windows programs are you running?

Application Compatibility in Windows XP

[aghoffmann]

More information needed:

Is your computer proprietary (Dell, HP/Compaq or etc.)?

• No, its not proprietary, it’s a “home builtâ€

o Asus P4P800-E Deluxe Socket 478 Mother Board with 8-channel Audio, AGP 8x, USB 2.0, Firewire, 10/100/1000 Gigabite LAN, WiFi, WOL, WOR and Hyperthreading Techonolgy support

o Intel Pentium 4 / 3.0 GHz / 512K Cache / 800Mhz FSB / Socket478/ Hyperthreading / Processor

o Sapphire Radeon 9600se Video Card / 128 MB DDR / AGP 8x / TV Out & DVI

o 2, Ultra 512MB PC3200 DDR 400MHz Memory (1024 MB total)

o Maxtor 120GB / 7200 / 8MB / 9.3 / ATA-150 Serial ATA Hard drive

o Toshiba SDR1112 DVD Burner

o MSI 16x DVD-ROM Drive

o Mitsumi Interal USB 2.0 Floppy, 7-1 Card Reader

Is XP the original OS installed or was it upgraded to XP?

• Yes XP is the original OS. I purchased the Microsoft Windows XP Pro Edition OEM Version with the above hardware.

What are your system hardware specs?

• See above… does that cover it?

What non-Windows programs are you running?

• To my knowledge there are no “non-Windows†programs, however the kids may have loaded some games that aren’t Windows. Is there a way to determine if there are some non-Windows programs?

Thanks for looking into this. This isn’t really a big deal, it doesn’t seem to be affecting my system performance, and I haven’t noticed any hardware or software that aren’t working… it’s just an annoyance to have to deal with it every time I boot up, and it makes me wonder what it is that “application that will not run on this Operating System…â€

BTW… I am an organ donor….

Edited July 13, 2006 by Andy

[shanenin]

do you have a lomega 7 in one card reader? if so you may need to update the drivers

http://iomega-na-en.custhelp.com/cgi-bin/i...p?p_faqid=16446

I am sure lots of different pieces of hardware could give that error, but when I googled it, that card reader gave me the most hits.

Edited July 13, 2006 by shanenin

[xxkbxx]

Do a broswe through MSConfig to see if there is something attempting to start up with your computer that shouldn't be

[aghoffmann]

Hi Shanenin,

I don't have any Iomega readers. I also checked the hardware in ControlPanel>System>System Properties>Device Manager and all the devices seem to be operating properly. Hmmm...

Thanks,

Andy

[aghoffmann]

Hi xxkbxx,

I looked through the "Startup" tab in the System Configuration Utility (aka MSconfig?). I saw several familiar looking files and a couple that I think I could do without, however there were a bunch that I didn't recognize. I don't have any experiece using MSconfig so I don't know how to determine what the unfamiliar files may be doing, or what the ramafication of "disabling" files may be.

The same inexperience applies to the other tabs in the System Configuration Utility window. (General, SYSTEM.INI, WIN.INI, BOOT.INI and Services). These look like things that I shouldn't play around with.

Thanks,

Andy

Edited July 14, 2006 by Andy

[blim]

Oooh, oooh, I know this one! ...I think....

Definitely do NOT mess with MSCONFIG unless you're a techy! It is a "look but don't touch" part of the computer.

BUT there is a highly recommended and easy to use "gadget" that tells you what is safe to get rid of on start up and what is not.

MikeLin's Startup Control

In the top of the PC Support section, there is a sticky called "Commonly Recommended Links" and there are a couple more gadgets similar to MikeLins, but from reading, most folks think MikeLin's is the easiest to use.

Oh! By the way, welcome to the forums! Look around, dive in and hope to hear a lot more from you.

Liz

Edited July 14, 2006 by blim

[TheTerrorist_75]

You can check Startup entries using this http://www.castlecops.com/StartupList.html.

If any entries are shown to be capable of being disabled at startup use MikeLin's Startup Control Panel, as linked above, to disable them.

If you are unsure list them here and I will look at them.

Never mess with anything using msconfig other than the Startup entries.

Edited July 14, 2006 by TheTerrorist_75

[aghoffmann]

The Terrorist 75 and Liz,

Thanks for the info on figuring our start up Start up files. I downloaded MikeLins Startup Control Panel and have been learning a lot.

• Many of the entries are pretty obvious by the file name.

• There are several that I could probably do without because I don’t use the programs much if at all.

(ie Nero, iTunes, maybe the Adobe Gamma Loader)

o What are the benefits of “unchecking†these entries?

o Do they move to the Deleted list?

o Can they be restored?

• There is one that I can’t figure out in the “HKLM / Run†tab: GNRICXPK… any ideas?

• I didn’t see any others that might be causing the “Stop Device†message, any ideas? I’ve listed the contents by tabs below if you'd like to browse it.

Thanks,

Andy

_______________________________________

Here are all the files listed in Mike Lins Start up, listed by tab:

Startup (users)

• No files

Startup (common)

• Acrobat Assistant - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

• Adobe Gamma Loader - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

• InterVideo WinCinema Manager - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe

• Service Manager - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

• WinZip Quick Pick - C:\Program Files\WinZip\WZQKPICK.EXE

HKLM / Run

• ATIPTA - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

• ccApp - "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

• EPSON Stylus Photo ... C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"

• Fxredir - C:\WINDOWS\System32\fxredir.exe

• GNRICXPK - C:\PROGRA~1\FLASHC~1\GNRICXPK.exe

• InCD - C:\Program Files\Ahead\InCD\InCD.exe

• IntelliPoint - "C:\Program Files\Microsoft IntelliPoint\point32.exe"

• iTunesHelper - C:\Program Files\iTunes\iTunesHelper.exe

• NeroFilterCheck - C:\WINDOWS\system32\NeroCheck.exe

• OmniPage - C:\Program Files\Caere\OmniPagePro90\opware32.exe

• Picasa Media Detector - C:\Program Files\Picasa2\PicasaMediaDetector.exe

• QD FastAndSafe

• QuickTime Task - "C:\Program Files\QuickTime\qttask.exe" -atboottime

• SoundMan - SOUNDMAN.EXE

• SunJavaUpdateSched - C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

• Symantec NetDriver Monitor - C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

• type32 - "C:\Program Files\Microsoft IntelliType Pro\type32.exe"

HKCU / Run

• MsnMsgr - "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

• PhotoShow Deluxe Media Manager - C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe

Run Once

• No Files

Deleted

• No Files

[TheTerrorist_75]

First let's get rid of the Stop error. It is because of your Mitsumi media reader. You will need to remove the software for it from Add/Remove Programs. Once this has been fixed you can use Startup Control Panel to disable programs that I will list later.

XPSP2 STOP DEVICE

I'm having the same problem with my Mitsumi card reader. Has anyone found a solution yet?

SOLUTION FOUND!!!

I called Mitsumi technical support (800)MITSUMI = (800)648-7864.

THE ANSWER: The drivers on the website or on the CD were ONLY for Windows 95, (and I suspect also for Win98 first edition). The card readers work fine in Windows XP without the special drivers. Probably in Win2K, WinME, and Win98SE too, but I don't know.

Go to Control Panel, Add or Remove Programs, remove "Flash Card Reader" and anything else that looks likely to have come from Mitsumi.

You may have to also go to the Device Manager and remove the devices. They show up under "Disk drives" - USB2.0CardReader CF RW USB Device, and Combo USB Device. (I did not have to do this, but she said you might have to. [note: They also show up under "Storage volumes"-"Generic volume" on my system, but hopefully this won't be necessary. (check the properties section to verify what you're removing)]).

DON'T mess with gnricxpk.exe or GNRICXPK in the Startup section of MSCONFIG or System Configuration Utility (or any cruder method, for that matter). Instead, remove any drivers that were installed from either the website or Mitsumi driver CD.

I had already tried disabling GNRICXPK from the Startup sequence using the System Configuration Utility. It did get rid of the "Stop Device" error, but it wasn't the real problem. It also disabled the ability to remove Iomega flash memory devices without having to stop them first. I suspect the card reader wouldn't have worked correctly either, but I did not verify this.

The problem is so hard to correct because almost nobody with a modern operating system has installed the old drivers. I had installed the drivers when I first got my machine because the card reader wasn't working, and I was desperate. It turned out to be a bad connector which I had to replace, but I never went back and removed the drivers. XP didn't complain until I updated to SP2.

Edited July 16, 2006 by TheTerrorist_75

[TheTerrorist_75]

Before I have you disable any startup programs I have noticed a couple that may be malware. To be sure I want to to follow the directions below and post a HijackThis log here: http://www.besttechie.net/forums/index.php?showforum=6.

Run the following online scanners. They may take awhile to install their files and scan your computer. Let them run.

http://www.kaspersky.com/virusscanner

http://housecall.trendmicro.com/

Download, update, run and remove anything they find;

AdAware

AdAware tutorial

SpyBot S&D

SpyBot tutorial

Once they are done download (save the file to your desktop), update and run;

ewido anti-malware for Win2K/XP

ewido anti-spyware Setup: Version 4.0 (Tutorail)

1. Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.

2. Once the setup is complete you will need run ewido and update the definition files.

3. On the main screen select the icon "Update" then select the "Update now" link.

>Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.

4. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.

5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".

6. Under "Reports"

>Select "Automatically generate report after every scan"

>Un-Select "Only if threats were found"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.

1. Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.

IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:

2. Lauch ewido-anti-spyware by double-clicking the icon on your desktop.

3. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan"[b/].

4. ewido will now begin the scanning process, be patient this may take a little time.

Once the scan is complete do the following:

5. If you have any infections you will prompted, then select "Apply all actions"

6. Next select the "Reports" icon at the top.

7. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).

8. Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan.

You should post the ewido scan report with the HijackThis log.

Please go to control panel/ folder options/ view and select show hidden and system files

Also uncheck "hide file extensions of known file types"

Download Hijack This. After downloading HijackThis do the following.

Put HijackThis in a Permanent folder.

Click My Computer, then C:\

In the menu bar, File->New->Folder.

That will create a folder named New Folder, which you can rename to "HJT" or "HijackThis". Now you have C:\HJT.

Put your HijackThis.exe there, and double click to run it.

This will allow backups to be made and saved By Hijack This in case something goes wrong.

HijackThis 1.99.1

How To Post a Correct HijackThis Log

[aghoffmann]

Terrorist 75,

The quote form XPSP2 STOP DEVICE described my problem to a T. I went into Add/Remove programs and deleted the driver and rebooted. That stoped the notice from coming up and the card readers still work fine. I also noticed that GNRICXPK is no longer in my StartUp list

The USB2.0CardReader CF RW USB Device, and Combo USB Device are listed in the Device Manager, but I did NOT remove them yet. Do I still need to do that, or am I good since the notice is gone and the readers still work?

I use the readers a lot... I'm into digital photography so I use them almost daily and do I don't want to take any chances of messing them up.

I'll work on your other instruction next (I might not be able to untill tomorrow evening as I'll be out of town tomorrow)

Thanks for your help on this.

Andy

[TheTerrorist_75]

If the card reader is working fine leave them alone in Device Manager. If you start experiencing problems remove them in Device Manager then reboot for XP to recognize them again. Let me know once your scans and HJT have been completed and the experts have determined you are clean. I can then supply you the list of your startup entries. I have gone through your list and saved the changes to a Word document.

[aghoffmann]

Hi Terrorist 75,

I have finally followed up on your suggestion to get checked at the Malware Forum. I have gone through their recommendations and now have a clean bill of health. Here's the link to that topic:

http://www.besttechie.net/forums/index.php?showtopic=9364

You mentioned that you thought some of the programs in my startup may be questionable. I'd like to follow up on that. Do you need a new list of startup programs?

Also, another issue that I have noticed lately that makes me suspect something is amiss is that in web pages that have forms some of the form fields now have a yellow background and they didn't used to. I notice this both on pages I visit on the web, as well as pages I wrote myself (ColdFusion code) that are availabe only to my home "network" (two machines). I know the code does not define any color backgrounds for the fields.

Thanks,

Andy

[TheTerrorist_75]

This is from your first Startup list.

This is the recommended action with the startup list.

"Y" - Normally leave to run at start-up

"N" - Not required - typically infrequently used tasks that can be started manually if necessary (Disable)

"U" - User's choice - depends whether a user deems it necessary

"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"

"?" - Unknown

Startup (common)

U• Acrobat Assistant - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

Used to create PDF files with Acrobat Distiller. For Win9x*systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the "U" recommendation

U• Adobe Gamma Loader - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

Adjusts monitor colours across all programs, including Photoshop. It is needed by some graphics professionals who want their monitor calibrated. Most home users will not need it. In my case I can verify this as Photoshop loads fine

N• InterVideo WinCinema Manager - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe

WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs

N• Service Manager - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

SQL Server Service Manager - provides tray access to SQL server, the server agent and MSDTC. Available via Start -> Programs

N• WinZip Quick Pick - C:\Program Files\WinZip\WZQKPICK.EXE

Added with WinZip version 8.1. "The new WinZip Quick Pick taskbar tray icon gives you instant access to WinZip and your Zip files. Just left click the icon to open WinZip, or right click it to instantly reopen recently used Zip files, access your Favorite Zip Folders, open WinZip Help, or start WinZip itself.". You can right-click and close it - choosing to not re-load it at start-up

HKLM / Run

U• ATIPTA - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings

Y• ccApp - "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

Part of Norton AntiVirus 2003. Auto-protect and E-mail check will not function without this

U• EPSON Stylus Photo ... C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"

Epson Status Monitor - gets installed with many Epson printers and gives you a progress of your print jobs as they are printing.

U• Fxredir - C:\WINDOWS\System32\fxredir.exe

Canon MultiPASS fax redirector

• GNRICXPK - C:\PROGRA~1\FLASHC~1\GNRICXPK.exe (Don't touch! Read previous reply)

Y• InCD - C:\Program Files\Ahead\InCD\InCD.exe

Ahead_InCD packet writing software. Similar to DirectCD. - For Nero 5.0 or 5.5 (InCD3), it does not need to start with Windows. You can run InCD.exe manually before inserting an appropriately formatted CD-RW (CD-MRW) disk. - For Nero 6.0, 6.3 or 6.6 (InCD4), it does need to start with Windows. It does not function correctly when you try to run it manually, and you will not have write access to MRW (Mount Rainier) formatted CD-RW (CD-MRW) or DVD-MRW disks. To regain write access and other features, InCD 4 must start with Windows.

U• IntelliPoint - "C:\Program Files\Microsoft IntelliPoint\point32.exe"

Microsoft_Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features

Y• iTunesHelper - C:\Program Files\iTunes\iTunesHelper.exe

Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation

U• NeroFilterCheck - C:\WINDOWS\system32\NeroCheck.exe

Associated with "Nero Burning Rom" CD writing software. Checks for driver issues

N• OmniPage - C:\Program Files\Caere\OmniPagePro90\opware32.exe

Part of OmniPage Pro from Scansoft (was Caere) - "the fastest, easiest way to turn paper documents into digital files you can edit." Opware32.exe links Word, via OLE, with OmniPage. If running, a user can call up OmniPage from inside of Word and ask it to scan something, via "File, Acquire Page." Also some of OmniPage's Options dialog boxes are accessible from within Word. Only required by novices and is Available via Start -> Programs

N• Picasa Media Detector - C:\Program Files\Picasa2\PicasaMediaDetector.exe

Media detector for Picasa's automatic photo organizer

N• QD FastAndSafe

Automatically runs Fast & Safe clean-up from Norton/Quarterdeck Cleansweep. Deletes safe to remove files such as Temporary Internet Files (cache). Recommended you run it manually

X• QuickTime Task - "C:\Program Files\QuickTime\qttask.exe" -atboottime

CoolWebSearch parasite related

N• SoundMan - SOUNDMAN.EXE

System Tray icon for the Realtek AC97 Audio Sound Manager for AC97 onboard audio. Available via Start -> Settings-> Control Panel

N• SunJavaUpdateSched - C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

Checks with Sun's Java updates site to see if newer Java versions are available. Visit http://java.sun.com or just run the Java Plug-In Control Panel

U• Symantec NetDriver Monitor - C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

Part of Symantec's LiveUpate (eg, Norton). Not required if you run manual upadates but probably requireD if you leave them to run automatically - hence the "U" recommendation

N• type32 - "C:\Program Files\Microsoft IntelliType Pro\type32.exe"

For MS programmable keyboards. If you disable Intellitype in Startup, any "Hot Keys" that are changed by the user to perform functions other than default settings, defer back to their default settings. Not required unless you have changed them

HKCU / Run

X• MsnMsgr - "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

Added by the W32/NETSKY-AN WORM!

N• PhotoShow Deluxe Media Manager - C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe

Simple Star PhotoShow_Deluxe photo editing and organizing software; makes it easy to send and share digital photos.. Bundled with software from Nero, ComCast, SnapFish, MacroMedia and others.

Edited August 1, 2006 by TheTerrorist_75

[aghoffmann]

Hi Terrorist 75,

Before I change things in the start up files I have a few questions:

• Is Mike Lin’s program what I should be using to disable programs?

• If I change something that I later want to have back, how do I do that?

• Since the last list I sent you I’ve added a few programs. Below is a list of the new entries listed in Mike Lin’s Startup

Also, any ideas on the yellow form fields described in my last post?

Thanks,

Andy

_______________________________________

Here are the NEW files listed in Mike Lin’s Start up since installing the new Norton AV, the various programs installed to clean up Malware (*ewido etc) and installing a “Cool-i-Cam digitizing tablet. They are listed by tab:

Startup (users)

• Quick StartUp C:\PENSOFT\fquick32.exe

• Start C:\PENSOFT\Quick95.exe

Startup (common)

• Annotate All C:\DIGITAL IMAGING CREATIVITY KIT\PreAnntt.exe

HKLM / Run

• !ewido "C:\Program Files\ewido anti-spyware 4.0\ewido.exe /minimized

• NAV CfgWiz "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"

• PenLock

• WService WService.EXE

HKCU / Run

• No New Files

Run Once

• No New Files

Deleted

• No New Files

[TheTerrorist_75]

Leave the new ones running. Those for the tablet will re-enable themselves if stopped. Definitely use Min Lins program to stop any services. You should be able to restart them using that program. As for the yellow shading that may be a security feature of the browser to let you know that you should check that it is secure before supplying information in those fields.