weird graphical changes

[Guest]

I have a weird problem. When I start any MS Office program (Word, Excel,
etc.) the picture/banner thing that comes up as that program is loading has
totally changed. Instead of being nice and fancy, it's really simple and
boring now. Please take a look at the screenshots I have taken because this
is hard to describe. Another change is the white square background behind
the words in the menu bar at the top of some programs. MSN Messenger and
Windows Media Player are the ones I noticed were affected so far. Again,
take a look at the screenshots if you don't understand what I mean. I don't
know what caused this but it started right around the time I installed a gif
editor and a gif animator program. I have uninstalled both of those and no
change, and also uninstalled and reinstalled MS Office. This is rather
annoying and I have no idea how to fix this so if someone could tell me how
that would be great. Thanks.

Screenshots here:
http://pg.photos.yahoo.com/ph/imp16...p://pg.photos.yahoo.com/ph/imp16155/my_photos

 

[George Hester]

Do NOT post links to unknowable sites. Post direct links to the gif or jpg.
Even then that is not always a guarantee that you are not trying to put
malware on our machines but just ry it. Post the direct link to the images.
Or include the image here if it is not too big.

--

George Hester
_________________________________

I have a weird problem. When I start any MS Office program (Word, Excel,
etc.) the picture/banner thing that comes up as that program is loading has
totally changed. Instead of being nice and fancy, it's really simple and
boring now. Please take a look at the screenshots I have taken because this
is hard to describe. Another change is the white square background behind
the words in the menu bar at the top of some programs. MSN Messenger and
Windows Media Player are the ones I noticed were affected so far. Again,
take a look at the screenshots if you don't understand what I mean. I don't
know what caused this but it started right around the time I installed a gif
editor and a gif animator program. I have uninstalled both of those and no
change, and also uninstalled and reinstalled MS Office. This is rather
annoying and I have no idea how to fix this so if someone could tell me how
that would be great. Thanks.

Screenshots here:

http://pg.photos.yahoo.com/ph/imp16155/album?.dir=74e2&.src=ph&store=&prodid
=&.done=http%3a//pg.photos.yahoo.com/ph/imp16155/my_photos

 

[Malke]

I have a weird problem. When I start any MS Office program (Word,
Excel, etc.) the picture/banner thing that comes up as that program is
loading has
totally changed. Instead of being nice and fancy, it's really simple
and
boring now. Please take a look at the screenshots I have taken
because this
is hard to describe. Another change is the white square background
behind
the words in the menu bar at the top of some programs. MSN Messenger
and
Windows Media Player are the ones I noticed were affected so far.
Again,
take a look at the screenshots if you don't understand what I mean. I
don't know what caused this but it started right around the time I
installed a gif
editor and a gif animator program. I have uninstalled both of those
and no
change, and also uninstalled and reinstalled MS Office. This is
rather annoying and I have no idea how to fix this so if someone could
tell me how
that would be great. Thanks.

Screenshots here:

http://pg.photos.yahoo.com/ph/imp16...p://pg.photos.yahoo.com/ph/imp16155/my_photos

It is a bit hard to tell from your photos, but it looks rather like you
are getting incomplete theming throughout. I would try setting your
theme to Windows XP from the Display applet and see if that helps.
Otherwise, try some of the suggestions on MVP Kelly Theriot's page
here:

http://www.kellys-korner-xp.com/xp_abc.htm

Click on "T" and scroll down to the numerous entries for "Themes".

Malke

 

[Guest]

Sorry, I didn't know what to do with the pictures since I can't directly just
post them in the thread. You didn't answer my question.

http://us.f3.yahoofs.com/users/42856634z7d645314/74e2/__sr_/d35d.jpg?phlzpQDBbFGt8izY

http://us.f3.yahoofs.com/users/42856634z7d645314/74e2/__sr_/9ffb.jpg?phC0pQDB6LSvLxU2

http://us.f3.yahoofs.com/users/42856634z7d645314/74e2/__sr_/54c3.jpg?phR0pQDBIQlanmjK

 

[Guest]

Thanks for replying. Unfortunately, none of that worked.

 

[Malke]

Thanks for replying. Unfortunately, none of that worked.

"Malke" wrote:

Then I'm sorry, but I don't know what has caused your problem. You might
want to post the question in one of the MS Office groups in case people
have seen that behavior before. Here's a list of all the MS newsgroups:

http://aumha.org/nntp.htm

Malke

 

[So Yu Know Knew Bees]

**WARNING**

IDIOT-JERK with a fraudulent MVP badge out on keyboard again:

Then I'm sorry, but I don't know what has caused your
problem. You might want to post the question in one of the
MS Office groups in case people have seen that behavior
before. Here's a list of all the MS newsgroups:

http://aumha.org/nntp.htm

Malke

This jerk posts so much because everyone in his physical
geographical area *knows* he's an idiot and a jerk.

He likes to hear his keyboard rattle... Even if he has nothing
relevant to say.

(Notice how he *thinks* the best place to find a list of M$
Public NG's is on another jerk's website.)

 

[Bob I]

Perhaps it's time for your meds?

So Yu Know Knew Bees wrote:

<<mindless prattle snipped>>

 

[Guest]

This is wonderful, thanks for hijacking my thread. Now does anyone else have
anything useful to say?

 

[George Hester]

OK I don't really trust anyone when links are provided that I am not sure
where I'll end up. But someone else took the initiative so I decided it was
safe enough for me.

The picture/banner thing you mention is what is called a "Splashscreen."

So your Splashscreen has gone haywire. I have seen this in Microsoft Office
before. A Repair of Office should fix that. Do this like you were going to
uninstall the application in Add\Remove but choose Repair instead with your
Microsoft Office CD inserted in your drive.

This issue is usually caused by COM applications. In the program from Tools
you should be able to get to where COM applications are starting. I would
remove any and all you have there. Adobe is one good suspect.

The other thing to check is whether you have any BHOs loading. Use this app
to check but let us know first before you do anything about what you find
there. Here is the application to run:

http://www.spywareinfo.com/downloads/bhod/

Finally get HijackThis and tell us anything it says which looks odd to you:

http://www.spywareinfo.com/~merijn/downloads.html

--

George Hester
_________________________________

I have a weird problem. When I start any MS Office program (Word, Excel,
etc.) the picture/banner thing that comes up as that program is loading has
totally changed. Instead of being nice and fancy, it's really simple and
boring now. Please take a look at the screenshots I have taken because this
is hard to describe. Another change is the white square background behind
the words in the menu bar at the top of some programs. MSN Messenger and
Windows Media Player are the ones I noticed were affected so far. Again,
take a look at the screenshots if you don't understand what I mean. I don't
know what caused this but it started right around the time I installed a gif
editor and a gif animator program. I have uninstalled both of those and no
change, and also uninstalled and reinstalled MS Office. This is rather
annoying and I have no idea how to fix this so if someone could tell me how
that would be great. Thanks.

Screenshots here:

http://pg.photos.yahoo.com/ph/imp16155/album?.dir=74e2&.src=ph&store=&prodid
=&.done=http%3a//pg.photos.yahoo.com/ph/imp16155/my_photos

 

[Guest]

Ok, I unistalled Adobe 7.0 and repaired MS Office and that didn't fix it. By
the way, I really can't get rid of Adobe. I need it to open a lot of
documents for my classes. I ran BHODemon and here is what it found:

imGiant.dll - {00000062-2E5F-4AF7-986E-5B64E0951A96}
NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

Here is a list of things HijackThis found that look unfamiliar to me, are
stuff I don't have/need anymore, or are stuff I know I have but I don't know
if they are bad or not.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.gateway.net
O2 - BHO: imGiantObj Class - {00000062-2E5F-4AF7-986E-5B64E0951A96} -
C:\WINNT\imGiant.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [shicoxp] C:\WINNT\shicoxp.exe
O4 - HKLM\..\Run: [caxchg] C:\WINNT\caxchg.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common
Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry
Cleaner\RegClean.exe"
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM
Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

That registry cleaner thing looks especially suspicious to me becuase it
came as a popup one time and I didn't realize that it was a popup, so I
installed it. Then I realized it was some sort of spyware/malware or
whatever and uninstalled it. Ok, there's that. Take a look at it and let me
know what to do next. Thanks.

 

[George Hester]

Your issue is the Norton. You need to get that out of that's integration
with Office. That's your problem. As for the Giant BHO I do not know what
that is...let's try Google:

Just as I thought. You have a nasty hijacker:

http://www.webhelper4u.com/tnewswritigs/imgiant_buddy.html

You have a number of things starting at Boot in the HKLM\...\Run keys. You
should keep these to a minimum if any at all. Norton goes there so if you
want Norton you'll have to accept those. I wouldn't but you probably paid
for it.

So we need to look at:

1) GWMDMMSG.exe - that looks OK that is a Gateway thingamabobber

2) The next one is probably alright too

3) shicoxp.exe - You want this out:

http://www.greatis.com/appdata/d/s/shicoxp.exe.htm

4) caxchg.exe - This one too get it out.

http://www.mytechsupport.ca/support/single_post.asp?method=reply&REPLY_ID=27
225

5) SM1BG.EXE - this seems fine

6) You are starting Real Player every time you start. This will happen
silently even if you stop it from the Options in the Program. You cannot
get rid of TKBell. That is there to stay. That is why I ended use of Real
Player at version 8.

7) WHY are you running regcleaner at each boot? First off that program is
destructive and no longer supported. Having it load at every boot is really
asking for trouble.

8) You have AOL Instant Messanger loading at evry boot. That's OK I guess.

Alright that's about it. You need to get rid of the BHO imGiant.dll; you
need to remove the integration of Norton with Microsoft Office- ask them do
NOT allow them to convince you otherwise; and you need to get rid of the
other malware (incl regcleaner.exe) you have in the system I told you above
what they were.

But to bring your Spalshscreen back to normal the removal of Norton
integration with Office should do that..

--

George Hester
_________________________________

Ok, I unistalled Adobe 7.0 and repaired MS Office and that didn't fix it. By
the way, I really can't get rid of Adobe. I need it to open a lot of
documents for my classes. I ran BHODemon and here is what it found:

imGiant.dll - {00000062-2E5F-4AF7-986E-5B64E0951A96}
NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

Here is a list of things HijackThis found that look unfamiliar to me, are
stuff I don't have/need anymore, or are stuff I know I have but I don't know
if they are bad or not.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sb/*http://www.yahoo.co
m/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.gateway.net
O2 - BHO: imGiantObj Class - {00000062-2E5F-4AF7-986E-5B64E0951A96} -
C:\WINNT\imGiant.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [shicoxp] C:\WINNT\shicoxp.exe
O4 - HKLM\..\Run: [caxchg] C:\WINNT\caxchg.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common
Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry
Cleaner\RegClean.exe"
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM
Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

That registry cleaner thing looks especially suspicious to me becuase it
came as a popup one time and I didn't realize that it was a popup, so I
installed it. Then I realized it was some sort of spyware/malware or
whatever and uninstalled it. Ok, there's that. Take a look at it and let me
know what to do next. Thanks.

 

[George Hester]

Oh you can put Adobe back in. You probably just have the ActiveX not Adobe
Acrobat. In either case that wasn't your problem. It's the Norton.

 

[Guest]

Ok, I got rid of the imGiant BHO. Was the NavShExt.dll BHO bad? Or is that
a part of Norton antivirus? I tried getting rid of shicoxp.exe and
caxchg.exe w/ HijackThis but that didn't work so I just manually went into
the WINNT folder where they were located and deleted them. They still come
up when I do a scan w/ HijackThis even though they aren't there anymore. I
also uninstalled Real player because I don't really like it and I hardly ever
use it. As you said, I was also unable to get rid of TKBell. I followed the
path name for where it is located (C:\Program Files\Common
Files\Real\Update_OB\realsched.exe) and it's not there. As for RegCleaner, I
accidentally installed that last year because I wan't paying attention and
didn't realize it was a popup ad. That was around the time I was having
trouble installing SP2. Even though I don't see it anywhere and I try
getting rid of it w/ HijackThis, it still comes up when I scan w/ HijackThis.
I also don't need the Steam one (O4 - HKCU\..\Run: [Steam] C:\Program
Files\Valve\Steam\Steam.exe -silent) which is part of a Half-life 2 trial
version I once had but got rid of. HijackThis did not get rid of that like I
told it to. Last of all, I opened up Norton, went into Options, Misc., then
disabled Office Plug-in. The splashscreen is still the same. Also don't
forget the other weird change, the white background around the menu bar text
in windows (see screenshots). I have noticed this in Windows Media Player,
MSN Messenger, and TI Connect (graphing calculator software) so far. Thank
you for your help so far and let me know what else I can do to try and fix
this.

Oh you can put Adobe back in. You probably just have the ActiveX not Adobe
Acrobat. In either case that wasn't your problem. It's the Norton.

--

George Hester
_________________________________

Ok, I unistalled Adobe 7.0 and repaired MS Office and that didn't fix it. By
the way, I really can't get rid of Adobe. I need it to open a lot of
documents for my classes. I ran BHODemon and here is what it found:

imGiant.dll - {00000062-2E5F-4AF7-986E-5B64E0951A96}
NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

Here is a list of things HijackThis found that look unfamiliar to me, are
stuff I don't have/need anymore, or are stuff I know I have but I don't know
if they are bad or not.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sb/*http://www.yahoo.co
m/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.gateway.net
O2 - BHO: imGiantObj Class - {00000062-2E5F-4AF7-986E-5B64E0951A96} -
C:\WINNT\imGiant.dll (file missing)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [shicoxp] C:\WINNT\shicoxp.exe
O4 - HKLM\..\Run: [caxchg] C:\WINNT\caxchg.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common
Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry
Cleaner\RegClean.exe"
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM
Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

That registry cleaner thing looks especially suspicious to me becuase it
came as a popup one time and I didn't realize that it was a popup, so I
installed it. Then I realized it was some sort of spyware/malware or
whatever and uninstalled it. Ok, there's that. Take a look at it and let me
know what to do next. Thanks.

 

[Nightowl]

Also don't
forget the other weird change, the white background around the menu bar text
in windows (see screenshots). I have noticed this in Windows Media Player,
MSN Messenger, and TI Connect (graphing calculator software) so far. Thank
you for your help so far and let me know what else I can do to try and fix
this.

Greg, I have this problem with programs such as Notepad and WinZip when
changing to the XP Silver theme. I find I can usually cure it by re-
applying the theme over itself, this way:

Have one of the affected programs open so you can see if this works.
Right-click on Desktop > Properties > Appearance tab. Your Apply button
will be greyed out. Now, under Color Scheme, choose Default (blue). You
don't need to apply it, just wait a few seconds until the picture in the
preview window changes to the blue scheme.

This makes your Apply button "live" again, and now you can choose Silver
in the Color Schemes box and Apply it. This does the trick for me.

Hope this helps.

 

[Guest]

Thanks for the suggestion. Unfortunately, that doesn't work for me.

 

[George Hester]

Greg it is the Norton product. I have seen this before. Only the splash
screen issue not your other stuff. I suspect we clear the Splashscreen
issue we'll get the other stuff fixed by default.

I do not know what to tell you about how to disengage Norton from the Office
products or how to uninstall the Norton. I say that because in truth Norton
cannot be uninstalled. It appears so in Add\Remove but that is not
sufficient. I tried to find an issue with Norton and splashscreens but what
I found was not specific to our issue.

In the Office applications you will find in Tools the ability to remove COM
applications from starting when the office application does. Try to make
sure they are clear from starting anything at all. If that doesn't help my
solution would be to uninstall Norton through Add\Remove and if it asks if
you want to leave anything in the system answer No.

 

[Guest]

Thanks for the suggestion. Unfortunately that doesn't work for me.

 

[Guest]

Ignore that, I didn't realize this topic went on to the second page.

 

[Guest]

Ok, I tried uninstalling Norton completely and doing a repair on MS Office
through the add/remove programs window. This didn't work. So I reinstalled
Norton and made sure the Office plug-in was disabled. Still didn't work. I
looked through all the different options in Word and didn't see anything
about removing COM applications from starting when Office does. This problem
is weird because the splashscreen and msn and all that were fine before when
I had Norton scanning whenever I opened an Office document. The splashscreen
and stuff changed around the time I updated Adobe to 7.0 and was also around
the time I installed a gif editor and a gif animator program, if that means
anything. I can give specific names for the gif editor and animator later if
needed.

One other thing. Those things you said I should remove with HijackThis,
they didn't go away so I manually deleted them but they still show up when I
scan again, even though they aren't there anymore (or at least they don't
appear to be). Do I need to delete registy values for these or something?

Greg