Dell Inspiron 4000 Pointing Stick

[slim]

Hi,

I have a rather annoying problem with the pointing stick on the keyboard of Dell inspiron 4000 series.

The initial problem is that the mouse cursor wanders around the screen when the user types on the keyboard. After some investigation work, I am sure the poiniting stick is the cause of the problem. As the user has never used or has any intention of using the pointing stick, I thought I would disable it.

Here is the real problem, I disabled the pointing stick in the software settings and restarted the computer. It had done the job, but every couple of days of so, I have to go through this whole thing again because the settings have changed back (almost as if some sort of system restore has kicked in).

Has anyone else had a similar problem like this or suggestions.

Slim

[Sylvander]

“almost as if some sort of system restore has kicked in”

I think you cannot be far off the reality there.
It’s as if there’s a default setting and it resets to that at startup or in a special situation.
The new configuration setting is presumably stored in the registry.
If your PC hits trouble and is unable to boot it will automatically use the previous registry that successfully booted and that could restore the previous arrangement, particularly if the new configuration setting caused it to fail to boot.

Do you use “User Profiles” or “Passwords”?
If you do then each pass-worded user gets a copy of the default configuration settings which can then be varied to suit their personal preferences.
Each user has his own set of keys [hive] in the Registry which are a variation of the default set.
So one user would have the new arrangement and the others wouldn’t.
You could register yourself as different users [you with different identities] and have a different configuration suited to each identities needs.
Do you see how this could relate to your problem?
If you made the change whilst in one identity and then forgot which one and logged into another identity, you’d wonder where your new configuration arrangement had gone.

[mjc]

First which version of Windows is on the Dell?

Second, in safe mode, check device manager and see how many times the pointer is installed...

[david eaton]

Not certain about Dell laptops, but an oldish IBM Stinkpad I have has a BIOS setting for the internal "nipple mouse". Worth a quick check in the BIOS to see if there is something similar that needs to be disabled.

David

[slim]

Thanks for you replies.

Firstly, the laptop is running windows 2000 professional and has been working fine since it was reinstalled about 6 months ago.

I have already actually checked the device manager, there was only one pointer installed and I went through the process of removing/reinstalling all the latest drivers/software for the pointing devices. I even set all the senisitivity settings of the tough stick to the lowest settings.

I am not sure whether there is a virus involved (but the computer is behind a corporate firewall and all incoming traffic is virus checked). But I ran a full virus scan anyway but it came back with nothing. I also will check to see if the computer has been hijacked, but with all the rubbish the user has put(downloaded) on the computer, it is going to take a while.

If windows 2000 gets shutdown incorrectly, does it revert back to the last good settings (hence loosing current settings)?

Thanks in advance for your help

Slim

[david eaton]

Originally posted by slim
Thanks for you replies.

I also will check to see if the computer has been hijacked, but with all the rubbish the user has put(downloaded) on the computer, it is going to take a while.
help

Well, if rubbish has been downloaded to the machine, the firewall will not have stopped junkware being downloaded with it. I would suggest going to MJC's sig, and downloading a trojan/malware scanner such as Spybot. Hijack This! could also prove useful.

David

[mjc]

Also I would like to see a set of HijackThis Logs off this machine...since it is a corp machine you can PM me the logs. (links are in my sig)

[slim]

Hi,

Thanks for your help so far, the situation has changed a bit now. The user is now reporting that over the weekend (at home), when they went on the internet they had problems using the keyboard i.e. certain keys would not work. But interestingly enough, when the user uses the computer on our internet connectiion (work), the problem does not occur (suspect our firewall is blocking something).

I have run hijack this and posted the results below.

mjc - I have PM you the results of the spybot scan.

If I cannot find the source of the problem, then I am debating whether to do a backup of data on the laptop and do a fresh install of windows 2000. But I will wait until you guys respond.

Slim



StartupList report, 02/06/2003, 09:32:54
StartupList version: 1.52
Started from : \\ws38\software$\Hijack This\StartupList.EXE
Detected: Windows 2000 SP3 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\System32\ofps.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\Proxy.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\Atiptaxx.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINNT\System32\internat.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINNT\system32\ntvdm.exe
\ws38\software$\Hijack This\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = mobsync.exe /logon
AtiPTA = Atiptaxx.exe
vptray = C:\Program Files\NavNT\vptray.exe
LoadQM = loadqm.exe
TaskMan = C:\WINNT\system32\dllcache\rundll32.exe
SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

internat.exe = internat.exe

--------------------------------------------------

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=(NONE)
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Yahoo!\Companion\ycomp5_0_2_7.dll - {02478D38-C3F9-4efb-9B51-7695ECA05670}
(no name) - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINNT\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/s...irector/sw.cab

[YInstStarter Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\yinsthelper.dll
CODEBASE = http://download.yahoo.com/dl/installs/yinst.cab

[DmiReader Class]
InProcServer32 = C:\WINNT\DOWNLO~1\SYSPRO~1.DLL
CODEBASE = http://support.euro.dell.com/global/...r/PROFILER.CAB

[InstallShield International Setup Player]
InProcServer32 = c:\winnt\DOWNLO~1\isetup.dll
CODEBASE = http://www.installengine.com/engine/isetup.cab

[Update Class]
InProcServer32 = C:\WINNT\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.co...689.4494791667

[YahooYMailTo Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\ymmapi.dll
CODEBASE = http://us.dl1.yimg.com/download.yaho...mmapi_0727.dll

[BrowserProxy4 Class]
InProcServer32 = C:\WINNT\System32\AlxTB.dll
CODEBASE = http://download.alexa.com/clients/AlexaIE65_6.0.1.5.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/s...sh/swflash.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\System32\webcheck.dll
SysTray: stobject.dll

--------------------------------------------------
End of report, 5,581 bytes
Report generated in 0.090 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only