[GrofLuigi]

It's the latest for XPSP3. You have it, maybe reapply it if you feel like it.

GL

* Edit: the issue described there is not your issue, it's the .LNK handler vulnerability

This post has been edited by GrofLuigi: 25 September 2010 - 07:44 PM

[GrofLuigi]

I'm increasingly convinced it's the Intel driver, maybe hooking Windows functions to manage multiple desktops. Unfortunately, on my machine, which has Intel display, I haven't installed .Net 3.5 which they require for the GUI. If you can, check the advanced display properties and turn of any management functions of multiple displays.

Also, check your video drivers at HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO - you have 3, which is not suspicious, but there might be a leftover of older driver and/or mirror driver of some kind (from remote control software, for example. Just follow the GUIDs (search), don't delete anything. And updating the display driver would certainly be beneficial.

This is probably an overkill, but doesn't hurt to have a look.

GL

[Sp0iLedBrAt]

Quote

updating the display driver would certainly be beneficial

I wish! The latest driver is 6.14.10.4764 and was released in 2007 :sigh:
I will look into it and report back.

Cheers

[iamtheky]

http://winhlp.com/node/16#comment-2155

i believe that should link to the comments in regards to .6018 of shell32.dll

[Sp0iLedBrAt]

@iamtheky

I followed the instructions in your link (with 3-4 different free hex editors) and I didn't find the named values there, nor in shell.32.dll extracted from WindowsXP-KB2286198-x86-ENU.exe. I even tried this link http://winhlp.com/node/16#comment-1936 , 3 or 4 comments below the one you provided.

@GrofLuigi: I found 2 GUIDs:

1. {DEB039CC-B704-4F53-B43E-9DD4432FA2E9} in \Registry\Machine\System\CurrentControlSet\Control\Video\{DEB039CC-B704-4F53-B43E-9DD4432FA2E9}\0000, which should be normal; I even found it in one of the posts here http://www.msfn.org/...i-setup-solved/

2. {23A77BF7-ED96-40EC-AF06-9B1F4867732A} in \Registry\Machine\System\CurrentControlSet\Control\Video\{23A77BF7-ED96-40EC-AF06-9B1F4867732A}\0000 , which doesn't show up anywhere in the log file I attached.

I also have \REGISTRY\Machine\System\ControlSet001\Services\ialm\Device0 and \REGISTRY\Machine\System\ControlSet001\Services\ialm\Device1, which would explain why Google video chat reports I have PC Camera0 and PC Camera1.

This is the exported key + the one previously
 key.reg (1.36K)
Number of downloads: 2
 HKLM_SOFTWARE_Classes_Directory_Background_shellex.reg (962bytes)
Number of downloads: 3

This post has been edited by Sp0iLedBrAt: 26 September 2010 - 02:08 PM

[GrofLuigi]

Just as I thought.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\igfxcui]

(you lose Right click anywhere on desktop > intel graphic properties)
To restore, use your HKLM_SOFTWARE_Classes_Directory_Background_shellex.reg from above.

See here for latest driver. What is the exact name of the devices (they appear as two) in Device Manager?

The other one (key.reg) seems OK, only if you could verify what DEB039CC-B704-4F53-B43E-9DD4432FA2E9 is (it might be Terminal Services mirror display driver (another one besides TSDDD); I have nLited away mine ) For example, 23A77BF7-ED96-40EC-AF06-9B1F4867732A is well known VgaSave driver for safe mode and/or booting. When I said search, I meant search in your registry (or go directly to the key it points to - HLKM\System\CurrentControlSet\Control\Video\{DEB039CC- B704-4F53-B43E-9DD4432FA2E9}\0000). Most probably, this has nothing to do with your issue, but it wouldn't hurt to check if it's a leftover.

GL

This post has been edited by GrofLuigi: 26 September 2010 - 03:35 PM

[Sp0iLedBrAt]

This link http://forum.noteboo...tml#post3463520 probably verifies that it is related to graphics (other hits on google warn of a possible virus )

Anyway, the video card is Mobile Intel 915GM/GMS, 910 GML Express Chipset Family and it's no use looking for a newer driver; I've done it more than once (even with trial versions of device driver finders), and the earliest version on the link you suggested is 940GML. A daRn shame.

These entries are in the registry, found in ControlSet, ControlSet001 and ControlSet002 (no need to export them all)

 HKLM_SYSTEM_ControlSet001_Control_Video_DEB039CC-B704-4F53-B43E-9DD4432FA2E9.reg (1.27K)
Number of downloads: 2
 HKLM_SYSTEM_ControlSet001_Services_RDPCDD_Video.reg (360bytes)
Number of downloads: 2

[GrofLuigi]

OK, everything is well with RDPCDD, it's a built-in Windows component.

And unfortunately you're right about the driver...

I'm out of ideas (actually, I'm not, but I think they might have lesser chances of helping you with this issue). If you're not tired of this and want to proceed, let me know. (I'm not).

GL

[Sp0iLedBrAt]

Well, this spoiled brat IS feeling kinda spiteful and wants to see the end of this unpleasant issue for the sake of posterity, but has also begun preparations for a new nLited install (this time through USB), which is maybe even overdue.

It's just that I can't shake the felling that one of the possible reasons could also be KB2286198.exe...

This post has been edited by Sp0iLedBrAt: 27 September 2010 - 03:59 PM