Mouse lost and computer freeze after latest update 4.6.731

[surfseek]

Hello there  

I think I may have possibly found the solution to my problem of mouse disappearing and computer freezing when updating Avast, since version 4.6.731.

I think it is to do with Zone Alarm. I would like to mention however that my Zone alarm settings have not caused any conflict until this latest Avast update.

Having checked my computer endlessly for viruses,Trojans etc and all being clear I thought I would try changing settings in Zone Alarm. I disabled Basic Mail Safe setting and un-ticked Protect Zone Lab Client. I read somewhere in other posts,certainly about Mailsafe and thought I would at least give it a try. Well, something seems to be working for the moment as all seems to be up and running WELL. As I speak I am going to try again................Dum De Dum De Dum

.................De Dum. WHOOPEE . I think all is now well.

I am a bit confused though because I got this freezing etc. when I un-installed Zone Alarm. Maybe it might be to do with getting rid of some of the entries that came up in spyware checker from Zone Alarm. All except

VX2.BetterInternet - Browser Plugin, Adware
File Name - C:\WINDOWS\bi.ini  

I can't seem to get rid of this one.

I will keep you posted  because it is still being a bit erratic.

Hey there David, just got your last post. I will keep this very valuable info in reserve if it plays up again. I have to be honest I have tried to use HJT in the past and got very confused.Bit nervous about that. Also, How do I reinstall my mouse driver on Windows 98. I have a logitech mouse.

surfseek

[Lisandro]

I can't seem to get rid of this one.

Schedule a boot-time scanning: Start avast! > Right click the skin > Schedule a boot-time scanning
Select for scanning archives. Boot.

Other way is scanning in SafeMode (repeatedly press F8 while booting): http://support.microsoft.com/default.aspx?scid=kb;en-us;315222

Other good thing is disable System Restore, boot, enable it again. If you find a virus keeps coming back after you delete it, it's most probably infected the System Restore folder, the best way to solve this is to disable System Restore, reboot your machine and then enable it again. After all, run a full avast! scanning. System Restore cannot be disabled on Windows 9x and it's not available in Windows 2k.

[surfseek]

''Also useful as a diagnostic tool - Download HiJackThis.zip - HJT Information HiJackThis Tutorial 1 or HiJackThis Tutorial 2
For an on-line analysis - HiJackThis Log file - On-line Analysis
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.
OR HiJackThis Log file - On-line Analysis 2

OR - Post your hijackthis-Log contents here.......

Have you tried reinstalling your mouse driver just to confirm that is fine.

Well here goes.Bit the bullet and did the HJT. Winzip does confuse me because I never know where to find the file which has been unzipped!!

Logfile of HijackThis v1.99.1
Scan saved at 23:46:40, on 14/11/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS_199[1]\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.co.uk/iesearch/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0809&s=search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0809&s=search
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&s=search&query=%s&i=enu
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:12080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] systray.exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\MOUSE\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://makeover.ivillage.co.uk/save/makeover.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37390.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab

.Haven't done the mouse bit yet.

Thanks as ever. Any views on above?

surfseek

[surfseek]

Hi there,

Thanks again for info.

I am running Windows 98. I don't have a system restore facility. I tried to schedule a boot scan as you suggested but it is greyed out and that option is not available to me. I will do a scan in safe mode and see what that does.

In the meantime, any suggestions as to how I reinstall mouse driver?

Thanks

Surfseek

[Lisandro]

I am running Windows 98. I don't have a system restore facility. I tried to schedule a boot scan as you suggested but it is greyed out and that option is not available to me.

Yeah, it's only available in Windows Xp or 2000.

I will do a scan in safe mode and see what that does.

It will be good.

In the meantime, any suggestions as to how I reinstall mouse driver?

Can't you download from the manufacturer website?

[DavidR]

If you have resolved the freezing issue, I would leave the mouse driver alone.

Here is an on-line analysis of your logfile, there are a number of entries indicated as nasty and possibly nasty.
http://hijackthis.de/logfiles/cb9c0c7e4645600b3f1beb7c8f1eaa77.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0809&s=search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0809&s=search
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&s=search&query=%s&i=enu

Do you recognise them as something you wanted?
If not fix them in HJT.

[surfseek]

In the meantime, any suggestions as to how I reinstall mouse driver?

Can't you download from the manufacturer website?

Hi there again,

I think I will have to do that. I eventually found how to update driver. Apparently there is one but I have to insert a Disk which I have never had. I have an OEM computer.

Re your last post I will hang on a while for mouse.

The three entries you mention are all to do with Compaq. I have a compaq presario computer. Well they look as if they are to do with presario!

Will any damage be done if I get rid of these entries?

I have clicked on them and two seem to be Alta Vista And the other one Yahoo.Strange. I don't need any of these. Shall I go ahead and delete them in HJT. What have they got to do with Presario?

Thanks a mill

surfseek







Surfseek

[DavidR]

I wouldn't have thought so, however, HJT does make a back-up should it be necessary to restore them.

I also can't really see why those would need to be set-up, what happens if you make a search where something is not found, probably sends you to the Compaq web site or it makes your default search engine the presario web site? I think it is just them having a redirect to their search engine flavor of the month and as such not really necessary.

[surfseek]

:'( :-[David,

Thanks very much for that.

Blast, Blast and Blast

I'm sorry to report and frustrated that it has happened again on summary window of update. Mouse loss and freeze. I have noticed something that might be relevant. Each time over the last few freezes it seems to happen on download18!!. I actually ran a test many hours ago because I had noticed it froze on 18 but it didn't come up again till now!!!

What do you think?

You are being so very helpful  . I only wish we could get to the root of this.

P.S. I ran a boot scan overnight. Clean

Bye for now

surfseek

[DavidR]

Can you say what you mean by mouse loss, the pointer freezing or disappearing or something else?

A system could freeze for a number of reasons some hardware (bad memory,graphics, Heat, PSU), some software related and possibly running out of system resources (a little more information on your system might be helpful), too much running. Trying to track them down is very troublesome and time consuming. A google search for "screen freeze in win 98" without the quotes returns many hits.

If you are able to get a copy of the mouse driver, you could save it on your HDD and when asked for a location of the driver, browse/point to its location on the HDD.

I have also noticed on your HJT log something which has been seen here before which may be spyware/adware:
C:\WINDOWS\SYSTEM\PSTORES.EXE
In the system folder it is likely that it is OK but worth checking here: Jotti - Multi engine on-line virus scanner

[BILL G]

     What VER. of ZAF do you have?  I notice Settings may change after a Crash, PWR Shutdown, Reinstall, Ect  I also CK for  something Calling Home on the Logs. I have Mail Uncheck to  avoid Conflict with Avast. I have Protect Client Checked.
     
     When I get a Slowdown or Freezup I go to Task Manager &  look at CPU & Process for a Clue to the problem.

     Have You done any File & Reg. Cleaning?

[surfseek]

Hi David R,

My mouse pointer and egg timer disappear completely and then 'puter freezes.

What other info would you like about my system.?

I have 11 items running at start up.

System Tray
Scan registry
Task Monitor
Load Power Profile x 2
Avast Web serve
Ashmaisv
Zone Labs client
KB891711
Avast
True Vector


Microsoft Windows 98 4.10.2222 A
Clean install using OEM Preinstall Kit /T:C:\WININST0.400 /SrcDir=C:\WINDOWS\OPTIONS\CABS /IS /IW /IQ /ID /IV /IZ /II /NR /II /C  /U:xxxxxxxxxxxxxxxxx
IE 5 6.0.2800.1106
Uptime: 0:03:28:10
Normal mode
On "OEMCOMPUTER"
Compaq
AuthenticAMD AMD-K6(tm) 3D processor
248MB RAM
74% system resources free
Windows-managed swap file on drive C (8712MB free)
Available space on drive C: 8712MB of 11513MB (FAT32)
Available space on drive D: 601MB of 2792MB (FAT32)


I have version 6.0.667.000 of Zone Alarm (Free).

Forgive me, but what is ' I also CK for  something Calling Home on the Logs'

I have re-checked 'protect zone lab client'.

I do a scan reg regularly and a defrag. I also run CC cleaner about once a week.

I don't have a task manager running Windows 98. (i don't think so anyhow).

 :'(I do get the task list up however after the freeze and loss of mouse at the summary window after an Avast update and it says Avast not responding. I can't seem to check cp usage however. I can't access much else without the mouse.

 :(I have been away for a few days. The first thing I did was get an update and consequently a  freeze also. This time it was download 13 that froze and not 18.

 :'(I hope this info will be of some use in the hope that we might be able to solve this problem with Avast updates on my computer.

I am trying to use this Jottis malware scanner at mo. These are the results:

File:  PSTORES.EXE 
Status:  OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) 
MD5  9540e610e33dd94ebc58c12315c20120 
Packers detected:  -
Scanner results 
AntiVir  Found nothing
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
Fortinet  Found nothing
Kaspersky Anti-Virus  Found nothing
NOD32  Found nothing
Norman Virus Control  Found nothing
UNA  Found nothing
VBA32  Found nothing


Thank you

Bye for now

Surfseek

[DavidR]

1. The KB891711 may have a direct bearing on this, cursor/Icon disappearance:
http://www.microsoft.com/technet/security/Bulletin/MS05-002.mspx

Microsoft Security Bulletin MS05-002
Vulnerability in Cursor and Icon Format Handling Could Allow Remote Code Execution (891711)

Issued: January 11, 2005
Updated: April 12, 2005
Version: 2.0

Can you recollect when you installed this KB891711 and if these problems started to occur since then?
If this is a start-up item you could try disabling the start-up entry for it and see if this is having a direct effect.

2. It looks like the Pstores is not an issue.

Not wanting to put words into Bill G's mouth but I think Bill G is saying check the Zone Alarm logs for any programs (that you don't recognise) with an outbound connection that you didn't initiate at about the time of the freeze. However, I think this unlikely since it looks like your system is clear but always worth a look.

[surfseek]

:)Hi there,

I installed KB891711 on 17th March 05. I have not had any problems or conflicts with this installation during this period. Either with mouse disappearing or freezing. The only possible problem I may have with it, maybe now,(re your post) after the addition of the last version update for Avast. (4.6.731).

I will try disabling it at start up and see if that stops the problem. Does that mean though that KB89711 will then not be running if I do that and what are the possible consequences of that?

Thanks for getting back so promptly

Surfseek

[DavidR]

1. If you disable it at startup then no it won't be running.
2. The consequences of that is that you may be vulnerable to the attack that is mentioned in the link I gave you to the KB article. See the FAQ and Vulnerability information available on the link.

There is a lot of information there which should help you decide if the problem you are experiencing is related to this patch and the chance of having the vulnerability present for a short period of time whilst testing to see if by not running this KB you don't get the freeze. I can't make that decision for you.