Taskbar Icons Disappearing

[SP Goodman]

Just installed XP w/SP2 from scratch.

Right after installing this week's Windows Critical Updates (6 of em), the
icons on the right side of the taskbar reduced in number drastically.

Before:
Fix-It 5, Messenger, HP 6800 printer, TabletWorks driver, Spybot S&D
Protection, MS Anti-Spyware, Volume Control. (I tell ya it was like the
stickers on the front of a race car)

After:
Fix-It 5, Messenger, TabletWorks driver - though the Messenger comes and
goes.

Beforehand the Hide Icons on the above were working. Now you can't even add
a Volume Control to the taskbar, and it was checked off to appear already
anyhow.

The most ominous is of course the Spybot and MSAS icons going missing. I
still get the Spybot protector messages, but not the MSAS. I'm on the verge
of doing a full data backup, saying the heck with the work genning this PC,
and doing another scratch install.

I uninstalled and removed the folders for both Spybot and MSAS, rebooted,
and reinstalled both apps. The icons reappeared until next bootup, at which
point it's back to the "After" above.

A number of items on this newsgroup and others have made me wonder if some
kind of attack isn't in progress, taking as much protection software offline
as possible, before hitting with all it's got. Thus my questions first,
lest repeating the scratch install is just a waste of time. Help! Thanks.

Stephen Goodman
* Cartoons about DVDs and Stuff
* http://www.medialinenews.com
* http://www.earthlight.net/HiddenTrack
* http://www.earthlight.net/Gallery

 

[S.Sengupta]

Try:-
http://www.kellys-korner-xp.com/taskbarplus!.htm

regards,
ssg MS-MVP

 

[SP Goodman]

Try:-
http://www.kellys-korner-xp.com/taskbarplus!.htm

Didn't solve the problem, alas! I'm still going back remembering the order
of things that caused the fix to occur, beyond uninstalling, removing and
reinstalling both MSAS and Spybot and an attempted System Restore to the
state right after initial install on the 11th (which said it failed but
somehow did *something* given the 'results') - and then when I ran CCleaner
and found a lot of junk left behind thanks to Sun's Java not flushing its
buffers, removing it, things began to improve.

I have to wonder about how it was that the volume control and the two
anti-Spyware resident apps (MSAS, Spybot) seemed to have been partially
removed from processing during this problem stage; I'd still for some reason
get the Spybot prompts, but the resident protection from MSAS was completely
disabled from things like ActiveX launches. And the ignored attempts to put
the Volume Control on the taskbar were weird.

I attempted to use MSAS to report the above conditions but it failed to
report it, citing a timeout to a microsoft address that when tested via
trace responded fine. I had the distinct impression that a method of some
kind was at work software-wise, such that preventative measures in the
taskbar were attemptedly disabled in a manner that wasn't too precise. This
all was also accompanied by a slowness of operation - browser, window, you
name it - that gave one the impression that something was "having a ride" on
the OS, spy/ad/malware-style. Multiple scans with multiple packages up
until CCleaner revealed nothing.

A look at the Event Viewer showed some interesting alerts as follows:

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 63
Date: 4/11/2005
Time: 02:53:23 AM
User: NT AUTHORITY\SYSTEM
Computer: ELUK1
Description:
A provider, HiPerfCooker_v1, has been registered in the WMI namespace,
Root\WMI, to use the LocalSystem account. This account is privileged and
the provider may cause a security violation if it does not correctly
impersonate user requests.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 63
Date: 4/11/2005
Time: 02:53:25 AM
User: NT AUTHORITY\SYSTEM
Computer: ELUK1
Description:
A provider, CmdTriggerConsumer, has been registered in the WMI namespace,
Root\cimv2, to use the LocalSystem account. This account is privileged and
the provider may cause a security violation if it does not correctly
impersonate user requests.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 4/11/2005
Time: 02:56:03 AM
User: NT AUTHORITY\SYSTEM
Computer: ELUK1
Description:
A provider, Rsop Planning Mode Provider, has been registered in the WMI
namespace, root\RSOP, but did not specify the HostingModel property. This
provider will be run using the LocalSystem account. This account is
privileged and the provider may cause a security violation if it does not
correctly impersonate user requests. Ensure that provider has been reviewed
for security behavior and update the HostingModel property of the provider
registration to an account with the least privileges possible for the
required functionality.

Despite my status as an Old Techie I wasn't up until 3am installing and
upgrading XP, but had indeed done this before going to bed at 12, and have
to wonder what it was caused the above events to occur, and if the above
tells you anything more. On the 12th all this trouble began.

A relationship of patterns began to further present itself when, by the
evening of the 12th, my wife's PC (also XP and on the router-network here)
began to develop a problem hiding icons, where no matter what one did
settings-wise the hiding wouldn't happen - and within a short period the
same inability to show icons for MSAS and Spybot manifested itself. I'm
going to attempt the same series of things on her PC and see what happens.
Let me know what you think!

 

[SP Goodman]

Rebooted after all this foolishness, back where I was again! Only
Tabletworks, Fix-it/AV and Messenger, though still with the weird message
about how .NET had logged me out because I'd logged in from a different
location (immediately followed by Inbox access that more than indicated that
I had indeed logged in!).

Logged out, went back in as me again. ALL ICONS RETURN. This DOES sound
like a Shell error, but I can't figure out why I feel like I'm the first
person who's ever experienced this...!