Maximum PC

As you can see, I've started getting this above error message when I use msconfig to disable startup items.

I'm logged in as an administrator. This happens with both my regular user account and the admin account in Safe Mode.

Googling this for over four hours yesterday narrows this down to problems with HP printer drivers, Norton AV, or McAfee AV.

Naturally, I use an Epson printer with Avira Personal Free AV.

Malwarebytes and a full Avira AV scan come up clean. The startup changes I make still "take", but this new message is a puzzle.

Anyone else with this problem? I'll bet not!

ASRock 880 GM-LE
2x2GB Kingston DDR3 1066 RAM
Athlon II X4 640
XP Home SP3 fully patched

Can you post the full list of startup programs without the warning window blocking it? Expand the command section of the list for more info.

OvenMaster, I get the same message on my desktop system running Windows XP SP3 as well whenever I run msconfig and change something, but I have no idea what could be causing it. I have an Epson All-in-One and use Norton 360 on all three of my machines.

Is this what you're looking for?
The weird looking stuff like "TINTSETP" and "IJPMIG" are Asian character stuff that showed up when I enabled East Asian languages. Other things are for Avira, ATI graphics, and TClock, TrayIt!, and MS Works. I did research and recognize everything showing.

Symantec says this is a known msconfig/registry issue with SP3:
http://community.norton.com/t5/Norton-I ... d-p/489648
https://www-secure.symantec.com/norton- ... ect_pubweb

Thanks for the information, OvenMaster.

Sorry I couldn't be more help.

I ran HijackThis. Here's the log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:22:04 PM, on 12/19/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\AMD\RAIDXpert\jetty\extra\win32\Wrapper.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
C:\Program Files\Macrium\Reflect\ReflectService.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\AMD\RAIDXpert\_jvm\bin\java.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\CoreTemp32\Core Temp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\TrayIt\TrayIt!.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\HijackThis\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://encrypted.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\RazaWebHook32.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [EPSON Stylus C88 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE /P23 "EPSON Stylus C88 Series" /O6 "USB001" /M "Stylus C88"
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Core Temp] "C:\Program Files\CoreTemp32\Core Temp.exe"
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: FAHControl.lnk = C:\Program Files\FAHClient\FAHControl.exe
O4 - Startup: TrayIt!.lnk = C:\Program Files\TrayIt\TrayIt!.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\RazaWebHook32.dll/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: AMD RAIDXpert (AMDRAIDXpert) - Unknown owner - C:\Program Files\AMD\RAIDXpert\jetty\extra\win32\Wrapper.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - C:\Program Files\Macrium\Reflect\ReflectService.exe

--
End of file - 6860 bytes

>bump!<
Anyone?

Oooh, sorry man...forgot all about this thread. Good chance that it's Norton then? First thing I would try is altering msconfig from safe mode. Anything that might have it on lock-down shouldn't even run in safe mode.

I don't have Norton. I use Avira Free AV, and I don't have an HP printer. And logged in as Admin in Safe Mode doesn't help.

The changes I make "take", so it's not a matter of not being able to change things. It's the fact that this error message pops up in the first place that is making me tear my hair out.

I'm starting to think this is being caused by a recent Windows Update session that I had on December 15, with eight security updates for Windows, and one for IE8... because there was no problem before this.
KB2618444
KB2633952
KB2633171
KB2620712
KB2619339
KB2618451
KB2639417
and
KB2624667
All are removable, so I will need to see if uninstalling them one at a time fixes the problem (probably after Christmas, that is)

Alright, I'm a little clearer on the sit-rep now. Didn't have a whole lot of time to re-read the OP last night, sorry. Avira and Malewarebytes came up clean, huh? How about SuperAntispyware, I see that's an option (one that I actually prefer to Malewarebytes these days). Registry cleaner run?

Since the changes to the boot config actually work, fussing over the error message alone is a little OCD. There I said it, we can move on.

In 20 odd years or so of computer repair, I can only remember coming across a problem like this a handful of times. Now to be honest a couple of concussions suffered when I was in the Army do make my memory a little fuzzy sometimes, but logic hasn't failed me yet. Logic (and experience) tells me that security updates is an unlikely cause of your issues. I'm not saying that it's impossible, just that it's unlikely enough that uninstalling 80+ security updates one at a time should be an absolute last resort.

I thought Microsoft wasn't supporting XP with updates anymore?

Anyway, the few times that I have run into a problem like this the root cause has always been viral infection. These are generally more sophisticated viruses in that they seem to have characteristics designed to circumvent traditional novice removal techniques like disabling the .exe through msconfig. They can also make registry manipulation through regedit impossible as well. For diagnostic purposes you may want to see if regedit is affected. Keep in mind that you can hose your entire OS install by mucking around in the registry, so only do this if you are as savvy a user as you seem to be. Just find an old dead end entry, try to delete it, and see what happens.

I understand that the malware scans have come up negative, but that doesn't mean that your problem didn't have a viral cause. Avira has a pretty sophisticated heuristic scanning engine for a free app. It runs in the background in concert with the more traditional database detection routine (unless you manually disabled it) looking for activity deemed to be malicious in nature. If you did get AIDS, and Avira caught it posthumously, some remnants may have remained after if was removed i.e. this particular error message. Glancing quickly at your HijackThis log, I see \ReflectService.exe. Do you run disk imaging software? This could be viral and masquerading as a legit program, or it could be another porous disc imaging program prone to manipulation by malicious code. The fact that it runs from the program folder suggests that it was user installed obviously, but my feeling is that imaging utilities should be installed as a Windows Service and run from System32 much like your IME for Asian text. I also don't see an entry for imaging software in msconfig, but it's hard to tell without expanded windows.

I could be wrong (it happens every now and then ), but a scenario like this would be a more likely cause than a suspect XP security update that nobody else seems to be having a problem with.

When I get some time, probably after Christmas, I'll look at your logs again in more detail. Until then good luck, and happy holidays!

Extended support for Windows XP ends sometime in June 2014.

I did try SuperAntiSpyware as well. Clean results.

I haven't run a Registry cleaner... I'll admit to being leery of those.

Yes, ReflectService.exe is part of Macrium Reflect, a disk backup/image program. I installed this back in September 2011.

I presently have Avira's heuristics on medium, the default level. At this precise moment, for some reason, Avira just popped up a notice during using Defraggler that my copied OEM XP disc files have a Trojan in XP\DOTNETFX\SETUPDB.DLL , so I don't know if making Avira any more sensitive will actually help me out.

I'll admit to being sorta OCD on an issue like this. I just get obsessive with this thing getting the least hiccup.

Thanks for looking at this. I'm in no rush, as long as I don't have any major problems here. Have a good Christmas!

Tom

I have been using Ccleaner for years and have had no problems using it in XP or win7 so far. I would download it, install it and run the registry section of the program. It will ask you to save the old registry, do it, then make the changes it suggests. This way all you do is double click on the old save and it will restore to it if a problem arises...it won't.

Nasty

That error is caused a lot of times from an HP Service running(The HP driver service... dont have exact name, but after you disable it that normally goes away... do you have an HP printer hooked to this machine? (HPDMZL or something like that... Anywho i didnt see anything in the startup from HP so i wasnt 100% sure if that was the case)

Will do, Nasty, later today.

Nope, I have an Epson Stylus C88+. This build has never had an HP installed.

Okay. I removed all the Windows Updates that were downloaded and installed on December 15, 2011, three days before I noticed this warning popup starting to happen. The popup still pops up.
I uninstalled Avira Free AV (too many false positives lately. I mean, come on, .dll files on my XP Home SP1 CD??), and the popup still shows when using msconfig.
I installed Avast Free AV, and the popup still shows.
I reinstalled the Windows Updates. Still shows.

Somehow, I'm not surprised. Probably just going to have to live with this... unless anyone else has ideas.

One word sticks out that that's "Service". From post one, I have my own question: What are you using MSCONFIG to disable? MSCONFIG w/ an enabled service could be a cycle. Tried uninstalling it? MSconfig should be treated as the registry as it's just an extension of it, and we don't. Don't muck around in either of those like it's kindergarten.

Don't just delete stuff from the registry. You guys suggesting it are fucking nuts. And if your name is not "Dell", you're out of extended support because XP is still supported officially. Doesn't matter anyway...you can get XP updates. "Support" is "customer support". If you had it, you'd talk to them and not us.

Please, Please, PLEASE don't post in the Free Clinic with bunk fucking advice you found on Google. This is one place we need to stay pure and not talk out our ass. It's harder to fix now in this post than it was on post #1 and are giving him the run-around.
------------------------------------------------
Ovenmaster...slow the role. Windows rocks because it gives us the ability to fuck it up. I hope you didn't go too far into these suggestions as it really can turn out to be something we can't reverse. I seldom pull this out but, but I'm using it like a six-shooter now: 23,738 posts dude...170 posts seem kind of like a gesture to consider, not utilize right off the bat. I really fear that, at this point, you're hosed; But let's see. NEVER play in XP reg...NEVER. I'm sure you backed up the REG as all say to do and you can restore it right now, get back to the original configuration, and makes the simple problem workable. If not....there's levels of fucked up to try and figure out.

Really...not your fault Oven, but most of the early "help" fucked you up more. This is The Clinic; to be treated logically, with experience in the matter at hand, and not to play orderly when a Doctor is needed.

Chum, sometimes I think you don't read these threads before you post. You just basically regurgitated half the stuff I already said, and nobody suggested anything "fucking nuts."

In addition, the startup tab in msconfig is not an extension of the registry. It's nothing of the sort. It's a GUI for the system startup, and nothing else. Manipulating msconfig will not result in the irreparable damage that can be caused by rooting around in the registry. Stop being such a sensationalist.

If he wants to get OCD about an error message, so be it. Lord knows I get fussy about my performance sometimes...