Choppy sound/disappearing mouse

[hybrid]

I have just reinstalled Windows XP Home SP2 and have got this problem for the second time. This problem has just reinforced my view that Linux is so much better than Windows ;). If any of you know anything that might be able to help me, I would be very grateful.

 

Sounds on Windows are now extremely choppy, especially this is noticable at startup and shutdown with the Windows XP sounds. Also, after logging on and using a program or two, the mouse pointer freezes and stays in one position. It still works, but you can't see it, so you have to guess by rollover effects where the pointer is. There is a workaround to use the Show location of pointer when I press Ctrl in the Mouse Properties, and this is how I'm actually forced to use Windows.

 

As far as I can tell, this problem started just after installing Visual Basic 2005 Express Edition (with MSDN and MS SQL Server). Since this brings along .NET Framework 2.0 and MSXML 6.0, however, I'm not sure what is doing this. I've tried removing all the components of VB2005, to no avail. I've also already just rebuilt Windows from having this problem, so I'm not very happy with Microsoft at the moment. [img]<___base_url___>/uploads/emoticons/default_dry.png[/img]

 

From Googling my problem, the only related thing I've found has been:

 

[/url][url=http://www.experts-exchange.com/Security/Q_21641382.html]http://www.experts-exchange.com/Security/Q_21641382.html

 

But I don't have a subscription, so I can't see the answer. :( I don't think it's spyware, though, because this is a completely new installation of Windows.

 

Any help would be greatly appreciated. :)

[anyweb]

you dont need a subsription on that site,

 

just scroll down to see the replies

 

;)

 

cheers

anyweb

[hybrid]

you dont need a subsription on that site, 

just scroll down to see the replies

 

;)

 

cheers

anyweb

 

Thanks, anyweb, I'd never realised that :)

 

From looking at that and its links, I'm still not sure why this is happening.

 

I've now got results from Process Explorer, Autoruns and Rootkit Revealer, if that helps anyone.

 

Process Explorer:

Code:

Process PID CPU Description Company Name System Idle Process 0 98.46 Interrupts n/a Hardware Interrupts DPCs n/a Deferred Procedure Calls System 4 SMSS.EXE 564 Windows NT Session Manager Microsoft Corporation CSRSS.EXE 612 0.77 Client Server Runtime Process Microsoft Corporation WINLOGON.EXE 636 Windows NT Logon Application Microsoft Corporation SERVICES.EXE 680 Services and Controller app Microsoft Corporation SVCHOST.EXE 856 Generic Host Process for Win32 Services Microsoft Corporation SVCHOST.EXE 912 Generic Host Process for Win32 Services Microsoft Corporation SVCHOST.EXE 980 Generic Host Process for Win32 Services Microsoft Corporation wuauclt.exe 2652 Automatic Updates Microsoft Corporation SVCHOST.EXE 1068 Generic Host Process for Win32 Services Microsoft Corporation SVCHOST.EXE 1124 Generic Host Process for Win32 Services Microsoft Corporation ccProxy.exe 1172 Symantec Network Proxy Service Symantec Corporation ccSetMgr.exe 1192 Symantec Settings Manager Service Symantec Corporation ISSVC.EXE 1244 IS Service Symantec Corporation SNDSrvc.exe 1256 Network Driver Service Symantec Corporation SPBBCSvc.exe 1272 SPBBC Service Symantec Corporation ccEvtMgr.exe 1368 Symantec Event Manager Service Symantec Corporation LEXBCES.EXE 1656 LexBce Service Lexmark International, Inc. LEXPPS.EXE 1748 LEXPPS.EXE Lexmark International, Inc. SPOOLSV.EXE 1740 Spooler SubSystem App Microsoft Corporation MSCORSVW.EXE 1924 .NET Runtime Optimization Service Microsoft Corporation GEARSEC.EXE 1960 gearsec GEAR Software MDM.EXE 1980 Machine Debug Manager Microsoft Corporation NAVAPSVC.EXE 2008 Norton AntiVirus Auto-Protect Service Symantec Corporation NVSVC32.EXE 396 NVIDIA Driver Helper Service, Version 81.95 NVIDIA Corporation SYMLCSVC.EXE 812 Symantec Core Component Symantec Corporation WDFMGR.EXE 1004 Windows User Mode Driver Manager Microsoft Corporation PQV2iSvc.exe 1220 V2i Protector Service Module PowerQuest Corporation ALG.EXE 3196 Application Layer Gateway Service Microsoft Corporation SVCHOST.EXE 3696 Generic Host Process for Win32 Services Microsoft Corporation LSASS.EXE 692 LSA Shell (Export Version) Microsoft Corporation EXPLORER.EXE 600 Windows Explorer Microsoft Corporation SOUNDMAN.EXE 2136 Realtek Sound Manager Realtek Semiconductor Corp. ccApp.exe 2152 Symantec User Session Symantec Corporation StartupMonitor.exe 2196 CTFMON.EXE 2240 CTF Loader Microsoft Corporation FIREFOX.EXE 144 Firefox Mozilla Corporation procexp.exe 2428 0.77 Sysinternals Process Explorer Sysinternals Process: Procexp Pid: -2 Type Name

 

Will have to split into two posts :)

[hybrid]

Autoruns won't actually fit into a post, so I'll find somewhere to host it.

 

Rootkit Revealer:

 

Code:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesProcessed 18/12/2005 14:53 4 bytes Data mismatch between Windows API and raw hive data. C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\OFFICE\msodata035.dat 18/12/2005 14:58 1.36 KB Hidden from Windows API. C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\OFFICE\msodata036.dat 18/12/2005 14:58 3.57 KB Hidden from Windows API. C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\0EA9F058d01 18/12/2005 14:59 44.46 KB Hidden from Windows API. C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\98CB2FE9d01 18/12/2005 15:00 558.46 KB Hidden from Windows API. C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\CC40D7EEd01 18/12/2005 14:59 19.42 KB Hidden from Windows API. C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\E0EB16ECd01 18/12/2005 14:59 80.38 KB Hidden from Windows API. C:\Documents and Settings\Peter\Local Settings\Temp\~DFE38F.tmp 18/12/2005 14:44 112.00 KB Visible in Windows API, but not in MFT or directory index. C:\Documents and Settings\Peter\Recent\ProcessExplorerNt.lnk 18/12/2005 15:00 460 bytes Hidden from Windows API. C:\Documents and Settings\Peter\Recent\README.TXT.lnk 18/12/2005 15:00 603 bytes Hidden from Windows API.

[znx]

Quick browse of the processes:

 

GEARSEC.EXE - 1960 - gearsec - GEAR SoftwarePQV2iSvc.exe - 1220 - V2i Protector Service Module - PowerQuest Corporation

Haven't seen these before... quick google indicates both are normally known utils (dvd copier and backup util). Remember though that you can name a process anything. Other than that all the processes look to be normal. 

Also glancing in ProcExp .. you can see that nothing is using the CPU really:

 

CSRSS.EXE - 612 - 0.77 - Client Server Runtime Process - Microsoft Corporationprocexp.exe - 2428 - 0.77 - Sysinternals Process Explorer - Sysinternals

 

Rootkit Revealer

 

All this reveals is nothing really :)

 

I can't seem anything in either of those logs to suggest anything of the spyware/virus ilk.

[hybrid]

Yeah, I'm not really expecting spyware on this Windows build, as I only built it yesterday, and it's only got Office and other essentials on it.

 

Code:

GEARSEC.EXE - 1960 - gearsec - GEAR Software

I don't know what this is, and I don't have a DVD copier program that I know of. However, users on this site seem to think the following:

 

PART OF ITUNES! trust me really i installed itunes and then this is in my task list

I do have iTunes installed (and PowerDVD 5.0 for that matter), so one of these may explain that.

 

Another user thinks it is "PowerQuest Drive Image 2000", which might make some sense (see below), even though I have v7.0.

 

Code:

PQV2iSvc.exe - 1220 - V2i Protector Service Module - PowerQuest Corporation

This is part of PowerQuest Drive Image 7.0, which I have and use, so this should be running.

 

But I still don't know what makes my sound choppy and mouse cursor disappear. I'm not even sure it relates to Visual Studio/.NET and I haven't been able to get a stable version of Windows running since my fairly major PHP problem on Linux (I don't know what happened with that either.).

 

I'm intrigued, confused and frustrated with having just spent a day installing an unstable copy of Windows, but if I knew which piece of software was causing this, I could avoid it and reinstall.

 

But installing Windows again would break Linux and GRUB. :( Sometimes don't you just hate Windows? ;)

 

Thanks for the help anyway, znx. :)

[anyweb]

some unexplained windows problems are due to bad drivers or lack of drivers

 

so.... if your pc is an OEM pc, then go to the OEM site and download and install every driver for your machine that is available.

 

most important one is the CHIPSET driver

 

cheers

anyweb

[hybrid]

It turns out I have two problems here (the sound, and the mouse) and they are unrelated, despite the fact that they started at about the same time.

 

I have a 1.5 GB NTFS partition on my second HD to use as a Windows swap drive. I switched to using swapfile from the C: drive and the sound corruption is gone. :)Might be a problem on the physical disk, but for now, that bit is done. One down, one to go :).

 

The mouse seems to stop working almost immediately upon opening an Office 2003 application (particularly Outlook, because it loads both itself and MS Word for writing emails, I guess). I've tried reinstalling Office, disabling Norton Internet Security's integration with Office to no avail. It might be that my original suspicions about .NET 2.0 and/or Visual Studio were wrong. So, this question is still open and isn't fixed yet.

 

So, a mixed result from this problem so far. [img]<___base_url___>/uploads/emoticons/default_mellow.png[/img]

[hybrid]

Worked it out. :)

 

It was PQV2iSvc.exe (which should be running and has worked for a long time without problem). I watched Task Manager's processes tab whilst using MS Word and there were CPU spikes of between 50-80% caused by PQV2iSvc. Setting the service's startup setting to Manual fixed the mouse. Thankfully, if I do need to do a backup, Drive Image automatically starts the service when it starts, so there is no impact on my system.

 

Thanks for the ideas guys, but I got there in the end :).

[znx]

good detective work is required for admins these days ;)