Video Problem

WINDOWS XP Home SP2
1000mb RAM
Seagate Barracuda 80GB SATA Drive
Pentium 4 @ 2.8 Ghz with HT
D865GBFL Intel Motherboard with latest Bios upgrade P23

Previous Video configuration
Intel Extreme Graphics
Nec AccuSync 91F

Current Video Configuration
ATI Radeon 9550
ViewSonic VP912B LCD Monitorconnected via the DVI connector.

Hello,

I am listing all my specs so that they will be easy to access. The problems I am having is that when windows loads and is starts to show the desktop and

icons, it looks like my current video configuration loads ( Gamma, Contrast and Brightness ) After about 5 seconds or so, the screen brightens up and the

colors are a little drap. I have to access the ATI control panel and it will automatically reset my settng to my last saved. The colors are absolutly great

with this card. This started happening about 6 months ago when I was using my previous configuration. Per Intel, I flashed the current bios, used add-remove

programs to remove the Extreme Graphics drivers and reinstalled the latest drivers, same problem. Went and upgraded to my ViewSonic, same problem, installed

the ATI Graphics card, same problem. Removed the ATI card and software, reseated the card, reinstalled the ATI software, same problem. Hooked up two other

monitors, same problem. So at this point, I don't believe that it is a fault with the monitor or the graphics card. I am wondering why windows won't save my

current configuration and am starting to wonder if there is a registry value that holds this info that is missing or corrupt.
Any feedback on this would be greatly appreciated.

Ken

 

Something is probably changing the configuration at startup.

I have Adobe Photoshop on my PC and it uses the Adobe Gamma Loader on startup. It does a wonderful job of adjusting my monitor.

Could you please use HijackThis to generate a log file of all of your startup items. Post the log file here and we can take a look.

 

Closed Haul,

Here is my Startup list, did you want the HJT log also? I am a moderator in training on the Tom Coyote forum for Malware removal. I know how to read the logs for Malware, but nothing else.

Thanks for your quick reply,

Ken

StartupList report, 3/20/2005, 3:47:05 PM
StartupList version: 1.52.2
Started from : D:\HiJackThis\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Caere\OmniPagePro90\opware32.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\WINDOWS\System32\RunDLL32.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\ClipMate6\ClipMate.exe
C:\Program Files\HJTHotkey\HJTHotkey.exe
C:\Program Files\Norton AntiVirus\OPScan.exe
C:\Program Files\Messenger\msmsgs.exe
D:\HiJackThis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Ken\Start Menu\Programs\Startup]
PowerReg Scheduler.exe
SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
APC UPS Status.lnk = C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe
Forget Me Not.lnk = ?
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
Microsoft Works Calendar Reminders.lnk = ?
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

IgfxTray = C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\system32\hkcmd.exe
SoundMAXPnP = C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
SoundMAX = "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
NeroCheck = C:\WINDOWS\system32\NeroCheck.exe
InCD = C:\Program Files\Ahead\InCD\InCD.exe
OmniPage = C:\Program Files\Caere\OmniPagePro90\opware32.exe
IMONTRAY = C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
USRpdA =
3c1807pd =
POINTER = C:\Program Files\Microsoft Hardware\Mouse\point32.exe
MaxtorOneTouch = C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
MXO Auto Loader = C:\WINDOWS\MXOALDR.EXE
WorksFUD = C:\Program Files\Microsoft Works\wkfud.exe
Microsoft Works Portfolio = C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
Microsoft Works Update Detection = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe
DiskeeperSystray = "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe "
WinPatrol = "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe "
Zone Labs Client = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
(Default) =
ATI DeviceDetect = C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
ATIPTA = C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

OfotoNow USB Detection = C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
(Default) =
ATI Launchpad =
ATI Remote Control = C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
SpywareGuard Download Protection - C:\Program Files\SpywareGuard\dlprotect.dll - {4A368E80-174F-4872-96B5-0B27DDD11DB2}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - c:\program files\google\googletoolbar1.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Norton AntiVirus - Scan my computer - Ken.job
Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[{03F998B2-0E00-11D3-A498-00104B6EB52E}]
CODEBASE = https://components.viewpoint.com/MT...iewpoint.com/pub/products/platform_intro.html

[PCPitstop Utility]
InProcServer32 = C:\WINDOWS\DOWNLO~1\PCPitstop.dll
CODEBASE = http://pcpitstop.com/pcpitstop/PCPitStop.CAB

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

[iCC Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\pcpConnCheck.dll
CODEBASE = http://www.pcpitstop.com/internet/pcpConnCheck.cab

[ChainCast VMR Client Proxy]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ccpm_0237.dll
CODEBASE = http://64.124.45.181/downloads/ccpm_0237.cab

[Symantec AntiVirus scanner]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\avsniff.dll
CODEBASE = http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\opuc.dll
CODEBASE = http://office.microsoft.com/officeupdate/content/opuc.cab

[Microsoft.WinRep]
InProcServer32 = C:\WINDOWS\System32\Winrep.dll
CODEBASE = https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

[Ofoto Upload Manager Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\axofupld.dll
CODEBASE = http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocx
CODEBASE = http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

[XML DOM Document 4.0]
InProcServer32 = %SystemRoot%\System32\msxml4.dll
CODEBASE = file://C:\Documents and Settings\Ken\Local Settings\Temp\EI40_\msxml4.cab

[mhLabel Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\mhLbl.dll
CODEBASE = http://www.pcpitstop.com/mhLbl.cab

[MSN File Upload Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\MsnUpld.dll
CODEBASE = http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab

[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
CODEBASE = http://www.pandasoftware.com/activescan/as5/asinst.cab

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37905.3147222222

[WebResponseAttachments Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\FILETR~1.OCX
CODEBASE = https://webresponse.one.microsoft.com/oas/ActiveX/FileXfer.cab

[Symantec RuFSI Registry Information Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\rufsi.dll
CODEBASE = http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

[ActiveDataInfo Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\SymAData.dll
CODEBASE = http://www.symantec.com/techsupp/activedata/SymAData.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[GpcContainer Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\ieatgpc.dll
CODEBASE = https://lsiops.webex.com/client/v_mywebex-lsiops/webex/ieatgpc.cab

[ActiveDataObj Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ActiveData.dll
CODEBASE = https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 11,515 bytes
Report generated in 0.078 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

I don't think it's malware...

I just wanted to see your startup.

 

Remove IGFXTRAY.

It is part of your old Intel graphics card and it is still loading. Please let me know if this works.

 

Close_Hauled,

I went to MSCONFIG and disabled IGFXTRAY, it didn;t work. Still the same problem.

Ken

 

Really?

That thing is for adjusting your monitor. I thought for sure that was it. I will look some more.

 

Remove HKCMD.EXE as well.

That is also left over from the Intel drivers.

I might also recommend starting Spybot in advanced mode and finding "System Startup" in the Tools menu on the left to confirm the changes made by MSCONFIG.

 

Check color management as well.

If you right-click on the desktop and select Properties, you will be presented with the Display Properties dialog box. Click on the Settings tab, and then click on the Advanced... button. You will be presented with a new dialog box that has a Color Management tab. The color profiles are associated with .ICM files. You may remove the profile from the list, or find one that works for your monitor.

The laptop that I am using now does not have a proile, so the list is blank. My Windows XP machine has a custom profile that I created with Adobe. I would say that in your case, it is safe to delete any profiles.

 

Close_Hauled,

IGFXTRAY is disabled. The color profile was for my VP912B monitor, I removed it, rebooted and still no change.

Thanks for your time in trying to solve this problem.

Ken

 

No problem.

Every time I think I got it... I'll look some more.

What I have been doing is looking up each of your processes in this database. You might want to do the same. I found some stuff that you don't need at all, but are not related to this issue.

 

What about HKCMD.EXE.

I posted that one earlier. You may have missed it.

 

Close_Hauled

I am at work at the moment. I will disable HKCMD.EXE when I get home and post back the results.

Ken

 

From your hijack this log....

I'm willing to bet this is the source of your problem. Either delete or move the shortcut in the start>all programs>startup folder and then reboot and see if the problem is gone. You can go here to read a bit about what Adobe Gamma Loader is and what it does.
http://www.adobe.com/support/techdocs/321608.html

 

Zander,

Thank you, I will definitlly try that when I get home and post back.

Ken

 

Close_Hauled, Zander,

BINGO, the Adobe Gamma Loader was the culprit. I disabled it in MSCOFIG, and rebooted and was back to normal. Looked for it in the Startup folders and it wasn't present.

You guys are the best. I am in training at the Tom Coyote Spyware forum and when I deem that a user is clean of spyware and that the problem may be software or hardware related, I always send them to your forum. I log on as ken545 over at TC

www.tomcoyote.org

Do you see anything else in my log as far as running processes that I can get rid of to speed up my system. Although my system is running like a top at the moment.

I can't thank you enough for all your time and patience.

Ken

 

Thanks for posting back and letting us know what did the trick! As for other unnecessary processes, I see a bunch of stuff in your startup items that I could do without. Actually, most of it. But, I don't want to tell you what to get rid of and what not to get rid of. It's the old "one man's garbage is another's treasure" thing. Have a look at the startup items in the log. These are the ones I'm talking about.

Go here and search for the name that's listed in msconfig. For example, the first one in the list:

IgfxTray = C:\WINDOWS\system32\igfxtray.exe

In this case search for IgfxTray. Then look at the status column in the in the information it returns to find out if it's necessary or not. There's a key at the top of the page you can refer to for info on what each status letter means. If you do a search for a msconfig item and don't get any search results, try the file name listed (in this case, igfxtray.exe). I looked at most of your's and you should get returns for most. If you do this, I think you'll probably find some you can eliminate.

 

Zander,

Thanks again. I will go through those startup entries and make some adjustments one at a time, don't want to lose some of the good programs that I do use.

Thanks again,
Ken

 

Adobe Gamma Loader

You can still use the Gamma Loader if you want. You just need to configure it properly. If you still have Adobe Gamma control panel, then you can adjust your monitor. I have a 21" Sony that I use it with. I do a lot of photo and video editing as well as games. I really like the improvement of the image quality after using it.

 

Close_Hauled,

I have been using the control panel that came with my ATI Radeon 9550, and it seems to work ok for me.

Where do I find the Adobe Gamma Loader Control Panel??

Ken