Desktop disappears at specific time

[simonhume]

Hi,

I've come across a strange problem, at 16:07 everyday for the last
couple of weeks my desktop background image disappears just leaving
the coloured desktop.

I know two other people are having the same problem (and have heard
others in my company are also experiencing it), one happens at 16:13
but his system clock is 6 minutes ahead of mine so is actually at
approximately the same time, I haven't checked the exact time of the
2nd machine but it is again at approximately the same time (if not
exact).

It's not a major issue in its self but I am intreagued to find out
what is causing it, has anyone else had a similar problem? Does anyone
know what causes it or how to fix it?

I'm not hugely experienced at tracking down this sort of problem but I
thought I would try running filemon this afternoon on my machine, are
there any other programs / logging tools you can suggest I try?

The machine is clean, anti-virus is upto date and have run a thorough
search, have also run ad-aware and spy-bot scans which also came up
clean.

I am running XP Pro sp2 which is fully up to date on a Dell Precision
690, 3.2 GHz Xeon processor and 2 GB of RAM.

 

[Guest]

Check your event viewer (Start...Run...type in "eventvwr.msc" (without the
quotes) and press Enter). Check all the logs (Application, Security, System,
etc) for anything happening around that time.

- John

 

[simonhume]

Hi,

I've come across a strange problem, at 16:07 everyday for the last
couple of weeks my desktop background image disappears just leaving
the coloured desktop.

I know two other people are having the same problem (and have heard
others in my company are also experiencing it), one happens at 16:13
but his system clock is 6 minutes ahead of mine so is actually at
approximately the same time, I haven't checked the exact time of the
2nd machine but it is again at approximately the same time (if not
exact).

It's not a major issue in its self but I am intreagued to find out
what is causing it, has anyone else had a similar problem? Does anyone
know what causes it or how to fix it?

I'm not hugely experienced at tracking down this sort of problem but I
thought I would try running filemon this afternoon on my machine, are
there any other programs / logging tools you can suggest I try?

The machine is clean, anti-virus is upto date and have run a thorough
search, have also run ad-aware and spy-bot scans which also came up
clean.

I am running XP Pro sp2 which is fully up to date on a Dell Precision
690, 3.2 GHz Xeon processor and 2 GB of RAM.

Desktop dissapearance occured at 16:09:50.

Although I doubt it mattered any I checked my system against Greenwich
time and it's correct (at least within a second)

The entrys which ring alarms for me are:

31227 16:09:50.3495007 Explorer.EXE 3796 RegOpenKey HKCU\Control Panel
\Desktop SUCCESS Desired Access: Query Value
31228 16:09:50.3495448 Explorer.EXE 3796 RegQueryValue HKCU\Control
Panel\Desktop\Wallpaper SUCCESS Type: REG_SZ, Length: 116, Data: C:
\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\shwall.bmp
31229 16:09:50.3495677 Explorer.EXE 3796 RegQueryValue HKCU\Control
Panel\Desktop\Pattern NAME NOT FOUND Length: 144
31230 16:09:50.3495811 Explorer.EXE 3796 RegQueryValue HKCU\Control
Panel\Desktop\PaintDesktopVersion SUCCESS Type: REG_DWORD, Length: 4,
Data: 0

None of the other people have Stardocks Wincustomise installed, so
doubt it has anything to do with that.

I'll have to find out somehow what's triggering it.

 

[simonhume]

Check your event viewer (Start...Run...type in "eventvwr.msc" (without the
quotes) and press Enter). Check all the logs (Application, Security, System,
etc) for anything happening around that time.

- John

Thank you,

Under "System" in event viewer at 16:03 (6 minutes before so most
likely not relevant) I have a tcpip warning, event id 4226, TCP/IP has
reached the security limit imposed on the number of concurrent TCP
connect attempts.

There are no other entries near that time in any of the other sections
of event viewer.

Thanks again,
Simon

 

[simonhume]

Thank you,

Under "System" in event viewer at 16:03 (6 minutes before so most
likely not relevant) I have a tcpip warning, event id 4226, TCP/IP has
reached the security limit imposed on the number of concurrent TCP
connect attempts.

There are no other entries near that time in any of the other sections
of event viewer.

Thanks again,
Simon

Having run through, disabling this and that (very scientific) I
believe the background image disappearing is caused by VNC and is not
a Windows bug as I origionally suspected, although I have no idea why
it would affect some machines and not others.

Simon.