Systray icon cannot find associated program

In searching this BBS for answers to how to remove icons from the systray, I did find answers that suggested finding the program to which the icon related and then click the appropriate box in the program options.

However, I cannot find any programs associated with the icons.

1. I recognize the programs in MSCONFIG, except that to be sure I would need to look at the HKLM/software/microsoft, etc. string and I cannot find it.

2. I found the icons when "customizing" the task bar where you can choose to "hide always," "always show," & "hide only when inactive." However, the icon does not show on the systray when I choose "always show," so I cannot look at properties.

3. The 3 icon names are: " if you pay peanuts... ", author name, & .....you get monkeys." These do look like viruses or spam, but when I do a virus scan, my disc is clean.

Thanks for any help you can provide

 

Systray icon -- cannot find associated program

Thanks, PeteC, for your suggestions.

I do now already use both Ad-Aware and Spybot but did double check my settings to make sure I was up to date in that department.

The problem I have with Spybot is that in checking all the red boxes for registry "fixes" in the past has really messed up my computer, so I do not do that now.

I use Registry First Aid for registry repairs.

However, after running all of the above, the icons I wanted to remove are still there.

Do you have any other ideas?

Thanks, Judy

 

Hi Judy,

Download HijackThis from link in my signature. Save it to a permanent folder (I create a new folder in C:\ named HJT). Open and hit scan, then save log. Once it is saved it will open in notepad. Select all from the edit button, copy and paste the results here. Don't fix anything with it yet! Someone experienced with the logs will advise you.

 

Pete,
If Judy is using the spyware software, deleting the entries will "mess up her computer ". Judy, if you're not sure what to keep or not, Google it and decide if the program the red entry is associated with is worth the sacrifice in PC performance and your personal privacy. If the answer is "yes ", post back and we will give you a spyware free link for just about ANYTHING.

Johanna

 

Here is my hijack log suggested by LD Tate

As suggested by Johanna, I did google a lot of programs and got rid of many that I did not want.

However, it has been hard to remove "Smiley Central" from FunWeb Products. Did get some information from their web site, but as yet not all can be removed.

I did remove from add/remove, & and from the explorer tree, and
,,,,,, tried to find registry entries, but could not find any... I do believe this is the source of my systray icons....


Logfile of HijackThis v1.98.0
Scan saved at 3:09: PM, on 7/27/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
C:\WINDOWS2\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS2\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MailFrontier\mlfbuddy.exe
C:\Program Files\Macro Express3\MacExp.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS2\system32\cidaemon.exe
C:\AntiSpyware\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/searc

h/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\Program

Files\Touchpoint\Blank.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -

c:\program files\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} -

C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINDOWS2\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -

C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program

files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec

Shared\ccApp.exe "
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS2\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Matador] "C:\Program Files\MailFrontier\mlfbuddy.exe"

-quiet
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - Startup: Macro Express 3.lnk = C:\Program Files\Macro

Express3\MacExp.exe
O8 - Extra context menu item: &Google Search - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\WINDOWS2\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS2\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

C:\WINDOWS2\System32\Shdocvw.dll
O12 - Plugin for .bcf: C:\Program Files\Internet

Explorer\Plugins\NPBelv32.dll
O15 - Trusted Zone: http://*.windowsupdate.microsoft.com
O15 - Trusted Zone: http://windowsupdate.microsoft.com
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -

https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) -

https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O17 -

HKLM\System\CCS\Services\Tcpip\..\{E7AF10D9-DC7F-41A8-8D01-DA77482FD1DC}:

NameServer = 67.36.128.26 206.141.192.60
O20 - AppInit_DLLs: C:\WINDOWS2\System32\GWMHOOK.DLL


Thanks again for all your help, Judy

 

Judy you download regseeker and search for Smiley Central / FunWeb.
RegSeeker

Someone experienced with the logs will advise you concerning your HJT log.

 

I see one item which I cannot find on my XP OS, nor could I find it with google. Neither case is a good sign.
O20 - AppInit_DLLs: C:\WINDOWS2\System32\GWMHOOK.DLL
Do you know where this came from? Right click and select Properties on that file, and it should tell you who made it.
Do you happen to have the folder C:\Windows, and are there files in it? The reason I ask this is because you have windows installed in C:\Windows2. This really is not a problem except for this.
When you install a program, and if it installs something into C:\Windows, and doesn't use the variable %windir%, which would be the correct windows folder no matter what the name, some minor problems such as you describe may occur.
The same can occur if something is sent to C:\Windows\System32, instead of %windir%\System32.

 

Thanks for all your help.

Unfortunately, my system crashed and all the "garbage" was removed.

So, the hijack log is no longer valid, and I hope I can alert you with this message to no longer spend time on my case.

I wish I could have let you know sooner, but I was really in a crash mode.

And, yes, I did have 2 windows from an earlier time when I had to re-install windows but didn't want to re-format at that time.

So, it is a good thing that I finally did have to re-format even though it was so time consuming... and luckily I had just backed up all my data using NovaStor -- excellent product.