Choppy sound/disappearing mouse

[hybrid]

I have just reinstalled Windows XP Home SP2 and have got this problem for the second time. This problem has just reinforced my view that Linux is so much better than Windows ;). If any of you know anything that might be able to help me, I would be very grateful.

 

Sounds on Windows are now extremely choppy, especially this is noticable at startup and shutdown with the Windows XP sounds. Also, after logging on and using a program or two, the mouse pointer freezes and stays in one position. It still works, but you can't see it, so you have to guess by rollover effects where the pointer is. There is a workaround to use the Show location of pointer when I press Ctrl in the Mouse Properties, and this is how I'm actually forced to use Windows.

 

As far as I can tell, this problem started just after installing Visual Basic 2005 Express Edition (with MSDN and MS SQL Server). Since this brings along .NET Framework 2.0 and MSXML 6.0, however, I'm not sure what is doing this. I've tried removing all the components of VB2005, to no avail. I've also already just rebuilt Windows from having this problem, so I'm not very happy with Microsoft at the moment. [img]<___base_url___>/uploads/emoticons/default_dry.png[/img]

 

From Googling my problem, the only related thing I've found has been:

 

[/url][url=http://www.experts-exchange.com/Security/Q_21641382.html]http://www.experts-exchange.com/Security/Q_21641382.html

 

But I don't have a subscription, so I can't see the answer. :( I don't think it's spyware, though, because this is a completely new installation of Windows.

 

Any help would be greatly appreciated. :)

[anyweb]

you dont need a subsription on that site,

 

just scroll down to see the replies

 

;)

 

cheers

anyweb

[hybrid]

you dont need a subsription on that site, 

just scroll down to see the replies

 

;)

 

cheers

anyweb

 

Thanks, anyweb, I'd never realised that :)

 

From looking at that and its links, I'm still not sure why this is happening.

 

I've now got results from Process Explorer, Autoruns and Rootkit Revealer, if that helps anyone.

 

Process Explorer:

Code:

Process    PID    CPU    Description    Company Name
System Idle Process    0    98.46        
Interrupts    n/a        Hardware Interrupts    
DPCs    n/a        Deferred Procedure Calls    
System    4            
SMSS.EXE    564        Windows NT Session Manager    Microsoft Corporation
  CSRSS.EXE    612    0.77    Client Server Runtime Process    Microsoft Corporation
  WINLOGON.EXE    636        Windows NT Logon Application    Microsoft Corporation
SERVICES.EXE    680        Services and Controller app    Microsoft Corporation
SVCHOST.EXE    856        Generic Host Process for Win32 Services    Microsoft Corporation
SVCHOST.EXE    912        Generic Host Process for Win32 Services    Microsoft Corporation
SVCHOST.EXE    980        Generic Host Process for Win32 Services    Microsoft Corporation
  wuauclt.exe    2652        Automatic Updates    Microsoft Corporation
SVCHOST.EXE    1068        Generic Host Process for Win32 Services    Microsoft Corporation
SVCHOST.EXE    1124        Generic Host Process for Win32 Services    Microsoft Corporation
ccProxy.exe    1172        Symantec Network Proxy Service    Symantec Corporation
ccSetMgr.exe    1192        Symantec Settings Manager Service    Symantec Corporation
ISSVC.EXE    1244        IS Service    Symantec Corporation
SNDSrvc.exe    1256        Network Driver Service    Symantec Corporation
SPBBCSvc.exe    1272        SPBBC Service    Symantec Corporation
ccEvtMgr.exe    1368        Symantec Event Manager Service    Symantec Corporation
LEXBCES.EXE    1656        LexBce Service    Lexmark International, Inc.
  LEXPPS.EXE    1748        LEXPPS.EXE    Lexmark International, Inc.
SPOOLSV.EXE    1740        Spooler SubSystem App    Microsoft Corporation
MSCORSVW.EXE    1924        .NET Runtime Optimization Service    Microsoft Corporation
GEARSEC.EXE    1960        gearsec    GEAR Software
MDM.EXE    1980        Machine Debug Manager    Microsoft Corporation
NAVAPSVC.EXE    2008        Norton AntiVirus Auto-Protect Service    Symantec Corporation
NVSVC32.EXE    396        NVIDIA Driver Helper Service, Version 81.95    NVIDIA Corporation
SYMLCSVC.EXE    812        Symantec Core Component    Symantec Corporation
WDFMGR.EXE    1004        Windows User Mode Driver Manager    Microsoft Corporation
PQV2iSvc.exe    1220        V2i Protector Service Module    PowerQuest Corporation
ALG.EXE    3196        Application Layer Gateway Service    Microsoft Corporation
SVCHOST.EXE    3696        Generic Host Process for Win32 Services    Microsoft Corporation
LSASS.EXE    692        LSA Shell (Export Version)    Microsoft Corporation
EXPLORER.EXE    600        Windows Explorer    Microsoft Corporation
SOUNDMAN.EXE    2136        Realtek Sound Manager    Realtek Semiconductor Corp.
ccApp.exe    2152        Symantec User Session    Symantec Corporation
StartupMonitor.exe    2196            
CTFMON.EXE    2240        CTF Loader    Microsoft Corporation
FIREFOX.EXE    144        Firefox    Mozilla Corporation
procexp.exe    2428    0.77    Sysinternals Process Explorer    Sysinternals

Process: Procexp Pid: -2

Type    Name

 

Will have to split into two posts :)

[hybrid]

Autoruns won't actually fit into a post, so I'll find somewhere to host it.

 

Rootkit Revealer:

 

Code:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesProcessed    18/12/2005 14:53    4 bytes    Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\OFFICE\msodata035.dat    18/12/2005 14:58    1.36 KB    Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\OFFICE\msodata036.dat    18/12/2005 14:58    3.57 KB    Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\0EA9F058d01    18/12/2005 14:59    44.46 KB    Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\98CB2FE9d01    18/12/2005 15:00    558.46 KB    Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\CC40D7EEd01    18/12/2005 14:59    19.42 KB    Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla\Firefox\Profiles\9eth3rpv.default\Cache\E0EB16ECd01    18/12/2005 14:59    80.38 KB    Hidden from Windows API.
C:\Documents and Settings\Peter\Local Settings\Temp\~DFE38F.tmp    18/12/2005 14:44    112.00 KB    Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Peter\Recent\ProcessExplorerNt.lnk    18/12/2005 15:00    460 bytes    Hidden from Windows API.
C:\Documents and Settings\Peter\Recent\README.TXT.lnk    18/12/2005 15:00    603 bytes    Hidden from Windows API.

[znx]

Quick browse of the processes:

 

GEARSEC.EXE - 1960 - gearsec - GEAR SoftwarePQV2iSvc.exe - 1220 - V2i Protector Service Module - PowerQuest Corporation

Haven't seen these before... quick google indicates both are normally known utils (dvd copier and backup util). Remember though that you can name a process anything. Other than that all the processes look to be normal. 

Also glancing in ProcExp .. you can see that nothing is using the CPU really:

 

CSRSS.EXE - 612 - 0.77 - Client Server Runtime Process - Microsoft Corporationprocexp.exe - 2428 - 0.77 - Sysinternals Process Explorer - Sysinternals

 

Rootkit Revealer

 

All this reveals is nothing really :)

 

I can't seem anything in either of those logs to suggest anything of the spyware/virus ilk.

[hybrid]

Yeah, I'm not really expecting spyware on this Windows build, as I only built it yesterday, and it's only got Office and other essentials on it.

 

Code:

GEARSEC.EXE - 1960 - gearsec - GEAR Software

I don't know what this is, and I don't have a DVD copier program that I know of. However, users on this site seem to think the following:

 

PART OF ITUNES! trust me really i installed itunes and then this is in my task list

I do have iTunes installed (and PowerDVD 5.0 for that matter), so one of these may explain that.

 

Another user thinks it is "PowerQuest Drive Image 2000", which might make some sense (see below), even though I have v7.0.

 

Code:

PQV2iSvc.exe - 1220 - V2i Protector Service Module - PowerQuest Corporation

This is part of PowerQuest Drive Image 7.0, which I have and use, so this should be running.

 

But I still don't know what makes my sound choppy and mouse cursor disappear. I'm not even sure it relates to Visual Studio/.NET and I haven't been able to get a stable version of Windows running since my fairly major PHP problem on Linux (I don't know what happened with that either.).

 

I'm intrigued, confused and frustrated with having just spent a day installing an unstable copy of Windows, but if I knew which piece of software was causing this, I could avoid it and reinstall.

 

But installing Windows again would break Linux and GRUB. :( Sometimes don't you just hate Windows? ;)

 

Thanks for the help anyway, znx. :)

[anyweb]

some unexplained windows problems are due to bad drivers or lack of drivers

 

so.... if your pc is an OEM pc, then go to the OEM site and download and install every driver for your machine that is available.

 

most important one is the CHIPSET driver

 

cheers

anyweb

[hybrid]

It turns out I have two problems here (the sound, and the mouse) and they are unrelated, despite the fact that they started at about the same time.

 

I have a 1.5 GB NTFS partition on my second HD to use as a Windows swap drive. I switched to using swapfile from the C: drive and the sound corruption is gone. :)Might be a problem on the physical disk, but for now, that bit is done. One down, one to go :).

 

The mouse seems to stop working almost immediately upon opening an Office 2003 application (particularly Outlook, because it loads both itself and MS Word for writing emails, I guess). I've tried reinstalling Office, disabling Norton Internet Security's integration with Office to no avail. It might be that my original suspicions about .NET 2.0 and/or Visual Studio were wrong. So, this question is still open and isn't fixed yet.

 

So, a mixed result from this problem so far. [img]<___base_url___>/uploads/emoticons/default_mellow.png[/img]

[hybrid]

Worked it out. :)

 

It was PQV2iSvc.exe (which should be running and has worked for a long time without problem). I watched Task Manager's processes tab whilst using MS Word and there were CPU spikes of between 50-80% caused by PQV2iSvc. Setting the service's startup setting to Manual fixed the mouse. Thankfully, if I do need to do a backup, Drive Image automatically starts the service when it starts, so there is no impact on my system.

 

Thanks for the ideas guys, but I got there in the end :).

[znx]

good detective work is required for admins these days ;)