Mouse pointer now has "Hourglass"

Is this still happening? Normally you only get an hour glass when the application currently selected is still running something.

Can you still do other functions on the PC when this is happening? Does the hour glass show no matter what application is currently actively selected?

If you are worried about malware problems, please follow the steps below:

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis:

Downloading, Installing, and Running HijackThis

.

 

Complete the steps I gave you from beginning to end and in the order given.

 

I'm not sure if it is the cause of your problem but I see the below line:

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

This file (which says it is missing) is from Webroot's SpySweeper program. Did you have it installed and then uninstall it? It seems like it is not uninstalled properly.

You may be able to just have HJT fix this O20 line and then reboot and see what happens. Let me know. If still having a problem, post a HJT log from safe mode (we do not normally request safe mode logs but it could be useful here).

 

Let's see if we can locate a process that could be causing this. Below are some of the items that were running in normal boot mode but not while in safe mode. What we will try doing is to use HijackThis's process manager to kill one process at a time. After killing each one check to see if there is any change in the mouse cursor. Note, some of these process may restart because they are services. So if they do restart, just continue to the next item in the list.

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cisvc.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINNT\SYSTEM32\3cmlink.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINNT\system32\PowerDesk8\Matrox.PowerDesk.PDeskNet.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE
C:\WINNT\SYSTEM32\3cshtdwn.exe
C:\WINNT\SYSTEM32\3cmlink.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\QUICKEN2001\QWDLLS.EXE
C:\Program Files\iPod\bin\iPodService.exe

Then exit HJT.

After doing this, you should reboot your PC to get everything back to normal. Then come back and let me know the results.

 

How momentary is the hourglass flash? Perhaps you can run Process Explorer

Unzip it and now run ProcessExplorer and lets configure some options first:
Click View and select Show Lower Pane. And where it says "Lower Pane View" make sure DLL's is checked. Now click on explorer.exe. Now also under the View menu choose "Select columns" and put a check mark on "Image Path". Now click on File and then Save As. And save the process list. Post it back here as an attachment.

Post theprocess list here as an attachment.

But now also with Process Explorer running watch the CPU column and when the hourglass appears see if you can catch which process is becoming active or has an increase in CPU useage. A new process may come and go. Or an existing process may just increase when the hourglass appears and then decrease when the hourglass disappears. You may want to exit/kill all unnecessary processes to make the list of process smaller and easier to observe.

 

I see nothing in the ProcessExplorer log that indicates an obvious problem. Too bad nothing note worthy is observed in CPU useage.

We could try a couple more things but I'm not sure if we will find anything.

First I want to disable this service reported in HijackThis:

O23 - Service: Windows - Unknown owner - C:\WINNT\srvany.exe

Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
On the page that opens, scroll down to Windows... right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

You should see in the C:\WINNT\srvany.exe in the Path to executable box. This will indicate to you that you have the correct service identified to disable.

Let me know the results of disabling the above on the mouse cursor. Note this is just a temporary disable. It can be restarted with a similar procedure. It will also restart on reboot.

Second thing to try is another scanner:

Running Ewido Security Suite

Attach the Ewido log.

 

Yes! That is why I was comparing logs from safe mode and from normal boot mode and why I had you try ending the running processes that were different between the two modes. There could be something else like a driver or a DLL that is loading too.

That can be due to virus scanners, antispyware scanners, firewalls etc configuring themselves at startup. They do take time to intialize.

Is MS Antispyware still installed? If so, I believe this will always be in the taskbar and cannot be removed.

 

Question:
Do you know why the below process is running twice in your first HJT log:

C:\WINNT\SYSTEM32\3cmlink.exe
C:\WINNT\SYSTEM32\3cmlink.exe

This is what it is for: http://www.liutilities.com/products/wintaskspro/processlibrary/3cmlink/