Re: Annoying desktop "reset"
- From: "Goran Ekstrom" <goek!removeantispam!@xxxxxxxxx>
- Date: Tue, 21 Jun 2005 10:24:08 +0200
"cquirke (MVP Windows shell/user)" <cquirkenews@xxxxxxxxxxxxxxx> skrev i
meddelandet news:b70fb1p4psdfgi8ec38nosb6adiduslj5e@xxxxxxxxxx
> On Mon, 20 Jun 2005 19:24:30 +0200, "Goran Ekstrom"
>>"cquirke (MVP Windows shell/user)"
>>> On Sat, 18 Jun 2005 23:34:36 +0200, "Goran Ekstrom"
>
>>>>Why does XP think it is necessary to reload all the desktop icons every
>>>>second time i access something, especially after using Explorer??
>
>>> A window will repaint in response to something changing in it.
>>> ....Explorer.exe) refreshes itself if something changes
>>> the way files might be displayed - such as file associations or
>>> possibly the namespace, like a newly-discovered drive letter.
>
>>> It's disturbing to think that something's "touching" the file
>>> associations, so I'd want to formally exclude malware activity.
>
>>> Are you on a LAN?
>
>>Well, sort of... Home XP computer behind a D-Link ADSL broadband router.
>
> If that's the only computer, then you aren't on a LAN, but always-on
> broadband does imply an ever-present exposure to malware.
>
>>> If so, what's shared?
>
>>Except for windows defaults, a printer. "Client for MS Networks" and "File
>>and Printer sharing" installed under TCP/IP.
>
> No, you misunderstand me to some extent - I really meant, what drive
> letters or folders are shared to the LAN as per File and Print
> Sharing. If you full-share any part of the startup axis, you
> facilitate direct malware integration from anything that sees the
> share. If you bind File and Print Sharing to the Internet, then the
> entire Internet can play that game.
>
> A firewall won't help unless it blicks File and Print Sharing, and a
> NAT router won't help because the addressing methods used by File and
> Print Sharing work at a different level to IP addressing, and won't
> care if the IP address is hidden by the Native Address Translation.
The D-Link external NAT router/firewall appears to do a pretty good job
blocking incoming "attacks", ShieldsUP at
https://image.grc.com/x/ne.dll?bh0bkyd2 only complains about responding to
IDENT port and PINGs.
I know my outgoing traffic is unblocked but are using an up-to-date McAfee
Viruscan to handle viruses coming through e-mail and web pages.
> You say you have File and Print Sharing bound to TCP/IP, and
> presumably this is the same LAN card that connects to the router and
> thus the Internet. That is deeeply distuuurbing. Stop reading this
> and fix that NOW (unbind File and Print Sharing) then come back.
>
> This is particularly scary for another reason; cabling yourself to a
> router and/or broadband would not, in itself, have the effect you
> describe of repaining desktop and Explorer windows. But malware
> activity that this facilitates may well do.
>
> It's like petrol doesn't make smoke, unless it's already on fire.
>
>>> Do you have drive letters mapped to LAN resources, or "web folders"?
>
>>No.
>
> OK
>
>>> Do you have any items on the desktop that are neither files or
>>> folders, nor have shortcut arrows on them?
>
>>Don't think so. What would that be?
>
> Well, look at the desktop. If you see any shoortcut arrows on any
> icons, you know you haven't suppressed these somehow; therefore it's
> meaningful if you see icons that don't have these arrows.
>
> If you do, then rt-click, Properties them to see if they are files.
>
> If they are not files, then they are namespace objects that will
> likely be enumerated in the left pane of Windows Explorer when that
> pane is displaying "Folders".
>
> If something changes the status of such items, or re-discoveres them,
> then that would prompt a repaint of the desktop and folder views,
> which is where we come in.
>
> Common examples of namespace objects (that do not normally have this
> effect) are: My Computer, My Documents, Network Neighborhood, Recycle
> Bin and the non-shortcut desktop icons for Microsoft Outlook and "The
> Internet" (the grandiose name Internet Explorer gives itself)
Ahh, naturally. Well, got the common ones from windows OS on the desktop.
>
>>> Does the problem persist in Safe Mode?
>
> ?
>
>>> Does the problem persist if you suppress all loads in MSConfig?
>
> ?
>
>>> Do you have active desktop enabled?
>
>>No.
>
> Guuuud ;-)
>
>>Seems to be somewhat random, been trying to stress test the explorer but
>>messing around, opening and closing, does nothing. Suddenly, when closing
>>the Control Panel, a re-draw appears.
>
> Simply displaying Control Panel casues the OS to find and run code
> within each .CPL file, even before you "open" any of these. This is a
> potential malware crises lying around waiting to happen; don't expect
> MS to patch it as it is "by design". That effect would kick in as
> soon as you see the icon though, not when the window is closed, unless
> something hooks the "close window" event and acts on that.
>
> You need to:
> - disconnect off all networks (broadband, WiFi, IR, the works)
> - formally exclude malware
I only got commercial, from known companies, applications installed. Rarely,
if ever, do i install "fun apps" found in more questionable places.
Virusscan and Ad-Aware says system is clean.
> - kill File and Print Sharing
> - turn on the firewall
> - exclude commercial malware
> - reconnect and ensure you're patched up to date
>
>
>
>>--------------- ----- ---- --- -- - - -
> If you leave the door open long enough, the
> wrong dogs will come home - Duane Arnold
>>--------------- ----- ---- --- -- - - -
.
- References:
- Annoying desktop "reset"
- From: Goran Ekstrom
- Re: Annoying desktop "reset"
- From: cquirke (MVP Windows shell/user)
- Re: Annoying desktop "reset"
- From: Goran Ekstrom
- Re: Annoying desktop "reset"
- From: cquirke (MVP Windows shell/user)
- Annoying desktop "reset"
- Prev by Date: Re: Annoying desktop "reset"
- Next by Date: inactive title bar and font size
- Previous by thread: Re: Annoying desktop "reset"
- Next by thread: Default Beep Event Missing
- Index(es):
Relevant Pages
|
