error on windows xp home startup

  • Thread starter Thread starter gordon
  • Start date Start date
G

gordon

Hi

On my notebook computer I get an errror each time I start up (I am using
windows xp home). This error comes in a dilaog box with a red circle and
white X on the left hand side.

The error reads

"Windows cannot find '/idlist,:520:1592,'. Make sure you typed the name
correctly, and then try again. to search for a file, click the start button
and then click search".

I can click OK to close this box - but it should not occur. I have nothing
in the start-up group on my menus. The windows explorer is opening up
automatically to my documents.

The 1592 bit seems to change each time I reboot.

Any assistance appreciated.

Thanks

Doug
 
Alan,

Sorry, but I didn't find that helpful. I am not very confident with
msconfig - is there potential to damage my computer?

Doug
 
I see no possible way you can do damage.
If you uncheck something then you can always recheck it.
If in doubt, do nothing and get a second opinion here.

Check in Msconfig.
(Start-Run-MSCONFIG-Startup tab)
If you cannot see anything in Msconfig then:

Start-Run-msinfo32
Click the + beside Software Environment to expand.
Click Startup Programs
Ctrl+A to Select All, Ctrl+C to Copy.
Paste that information in your message.

....Alan
 
Hi,

If you stick to the startup tab, you will not run into trouble. Nothing
there is required by the system on boot, it's all optional. Deselecting
(unchecking) boxes will put you in selective startup mode, this is normal.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org
 
Thanks to Alan,Rick and PcButts.

I was thinking that there was something happening in the background like
that.

I did a series of system restores and found that the problem was with some
spyware.

I'll still run the hyjack routine and post here anyway as there maybe
something i missed.

Cheers
 
here is the log - hope this is what you need to help me.

ogfile of HijackThis v1.99.1

Scan saved at 11:39:01 PM, on 1/08/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Eraser\eraser.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

C:\HijackThis.exe

C:\WINDOWS\system32\wuauclt.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://dsl.optusnet.com.au/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.tpg.com.au

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyServer =
ftp=syd-net-fw2.tpg.com.au:3200;http=syd-net-fw2.tpg.com.au:3200

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program
Files\Intel\Wireless\bin\ZCfgSvc.exe

O4 - HKLM\..\Run: [IntelWireless] C:\Program
Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program
Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft
AntiSpyware\gcasServ.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.tpg.com.au

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121144107410

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

O17 -
HKLM\System\CCS\Services\Tcpip\..\{B5C82B41-5AC6-4169-AA48-E640CB4B98BE}:
NameServer = 4.2.2.2,4.2.2.3

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} -
c:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O20 - Winlogon Notify: IntelWireless - C:\Program
Files\Intel\Wireless\Bin\LgNotify.dll

O23 - Service: Ati HotKey Poller - Unknown owner -
C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: EvtEng - Intel Corporation - C:\Program
Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program
Files\Intel\Wireless\Bin\OProtSvc.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program
Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel
Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
 
Thanks

But its back again this morning - no reason - no web surfing - notbook was
turned off - just no reason apart from that they are loading by themselves.


Ad-aware found two tracking cookies - (e-mail address removed),/cgi-bin and
(e-mail address removed)

could these be causing the problems?

I quarateened these before - and they just come back.

cheers

Doug
 
You have what I like to call a stubborn one. Run this but be warned it will
clean out all temp files, cookies, MRU's, prefetch, bak, search history, web
history, everything that is not needed.
http://www.pcbutts1.com/downloads/CleanUp40.exe After you use it run
hijackthis again and post another log.

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com
 
Pcbutts

Thanks again for your help.


The only change that I made to my computer between the last fix and
this one is the plugging in of a HP USB keyboard. Is it possible that
this could be the cause? I only bought the keyboard at the computer
market on Saturday.

I will try the fix that you suggest and repost the hyjack log.

Doug
 
Alan

Thanks for your response.

I think that you maybe right about the msconfig solution. I am not a
complete novice - i am a programmer by trade - but I generally dont
touch this part of the system. So I am a little reluctant to do things
that i can't reverse out from.

I think that i may have a bad registry entry due to a hp usb keyboard
driver, or alternatively due to the intel wireless chip driver not
working properly. But that is speculation on my part.

I'll post the output from the msinfo32 file tonight - if you dont mind
having a look.

Additionally, I noticed that my network drives were not mapped
correctly - but i thought that this may have been more to do with the
system restore taking the machine back in time rather than any malware.

Thanks again

Doug
 
Doug (or Godon) or whomever.

You can reverse anything you uncheck in Msconfig.
The idlist error is very (in fact, extremely) likely due to an Intel
wireless chip driver.

....Alan
 
Alan

I uninstalled the usb keyboard and removed a program called eraser. I also
removed some of the other users in the control userpasswords2 application.
I removed ACTuser, and ASPnet. I am using log in without password too. I
like your DTS-L site too - and Kelly's greate corner. Very valuable
resources for me in future.

Now my sys info is as follows:
All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AGRSMMSG agrsmmsg.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ATIPTA c:\program files\ati technologies\ati control panel\atiptaxx.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_CC c:\progra~1\grisoft\avgfre~1\avgcc.exe /startup All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_EMC c:\progra~1\grisoft\avgfre~1\avgemc.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_Run c:\progra~1\grisoft\avgfre~1\avgw.exe /runonce NT AUTHORITY\SYSTEM
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_Run c:\progra~1\grisoft\avgfre~1\avgw.exe /runonce NT AUTHORITY\LOCAL
SERVICE HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_Run c:\progra~1\grisoft\avgfre~1\avgw.exe /runonce NT AUTHORITY\NETWORK
SERVICE HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_Run c:\progra~1\grisoft\avgfre~1\avgw.exe /runonce .DEFAULT
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adobe Reader Speed Launch c:\progra~1\adobe\acroba~1.0\reader\reader~1.exe
All Users Common Startup
CTFMON.EXE c:\windows\system32\ctfmon.exe NT AUTHORITY\SYSTEM
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe NT AUTHORITY\LOCAL SERVICE
HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe NT AUTHORITY\NETWORK SERVICE
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe CENTRINOHOME\Doug
HKU\S-1-5-21-3427727331-2678038678-1383322507-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe .DEFAULT
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
EOUApp c:\program files\intel\wireless\bin\eouwiz.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IntelWireless c:\program files\intel\wireless\bin\ifrmewrk.exe /tf intel
proset/wireless All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IntelZeroConfig c:\program files\intel\wireless\bin\zcfgsvc.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Office c:\progra~1\micros~2\office10\osa.exe -b -l All Users
Common Startup
Power2GoExpress CENTRINOHOME\Doug
HKU\S-1-5-21-3427727331-2678038678-1383322507-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RemoteControl "c:\program files\cyberlink\powerdvd\pdvdserv.exe" All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SynTPEnh c:\program files\synaptics\syntp\syntpenh.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SynTPLpr c:\program files\synaptics\syntp\syntplpr.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
desktop desktop.ini NT AUTHORITY\SYSTEM Startup
desktop desktop.ini CENTRINOHOME\Doug Startup
desktop desktop.ini .DEFAULT Startup
desktop desktop.ini All Users Common Startup
gcasServ "c:\program files\microsoft antispyware\gcasserv.exe" All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

but the error has gone away again (until tomorrow???)?

Thanks for your help - sorry if I was a bit too cautious about msconfig
yesterday - had many bad experiences with my previous laptop.

Cheers

Doug
 
Alan

The message is back again...

And here is my sysinfo from todya - looks the same as yesterday...

All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AGRSMMSG agrsmmsg.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ATIPTA c:\program files\ati technologies\ati control panel\atiptaxx.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_CC c:\progra~1\grisoft\avgfre~1\avgcc.exe /startup All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_EMC c:\progra~1\grisoft\avgfre~1\avgemc.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_Run c:\progra~1\grisoft\avgfre~1\avgw.exe /runonce NT AUTHORITY\SYSTEM
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_Run c:\progra~1\grisoft\avgfre~1\avgw.exe /runonce NT AUTHORITY\LOCAL
SERVICE HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_Run c:\progra~1\grisoft\avgfre~1\avgw.exe /runonce NT AUTHORITY\NETWORK
SERVICE HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVG7_Run c:\progra~1\grisoft\avgfre~1\avgw.exe /runonce .DEFAULT
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adobe Reader Speed Launch c:\progra~1\adobe\acroba~1.0\reader\reader~1.exe
All Users Common Startup
CTFMON.EXE c:\windows\system32\ctfmon.exe NT AUTHORITY\SYSTEM
HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe NT AUTHORITY\LOCAL SERVICE
HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe NT AUTHORITY\NETWORK SERVICE
HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe CENTRINOHOME\Doug
HKU\S-1-5-21-3427727331-2678038678-1383322507-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CTFMON.EXE c:\windows\system32\ctfmon.exe .DEFAULT
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
EOUApp c:\program files\intel\wireless\bin\eouwiz.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IntelWireless c:\program files\intel\wireless\bin\ifrmewrk.exe /tf intel
proset/wireless All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IntelZeroConfig c:\program files\intel\wireless\bin\zcfgsvc.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Office c:\progra~1\micros~2\office10\osa.exe -b -l All Users
Common Startup
Power2GoExpress CENTRINOHOME\Doug
HKU\S-1-5-21-3427727331-2678038678-1383322507-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RemoteControl "c:\program files\cyberlink\powerdvd\pdvdserv.exe" All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SynTPEnh c:\program files\synaptics\syntp\syntpenh.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SynTPLpr c:\program files\synaptics\syntp\syntplpr.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
desktop desktop.ini NT AUTHORITY\SYSTEM Startup
desktop desktop.ini CENTRINOHOME\Doug Startup
desktop desktop.ini .DEFAULT Startup
desktop desktop.ini All Users Common Startup
gcasServ "c:\program files\microsoft antispyware\gcasserv.exe" All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
 
Use Msconfig as a troubleshooter, selectively disable items and reboot
until you find the cause.

....Alan
 
Alan,

I have tried all of the items in the start-up group.

Is it possible that this relates to a user profile? I have found that
the error doesnt occur if i use control userpasswords2 and i make it
that a person (me) has to log on. This removes the error - however
when I make it that a user doesnt have to log on - the error appears to
come back. I might try to create a new user - and give them admin
rights and then look to delete or rename my old profile.

This is a perplexing problem - and to me it defies logic - i can
reboot, log off, restart, shutdown - and all is well - but if the date
changes in the meantime then the problem resurfaces!! Maybe that is an
observation rather than a co-relation but i am stumped logic wise.
 
If it is relates to user profiles, then I cannot help.
Nobody else has ever used a computer of mine, so I have no need of
profiles.

....Alan
 
Back
Top