Power Options and focus stealing, the plot thickens!

**IT Len** · January 16th, 2007, 04:40 AM

Hello all,

Posted a couple of weeks ago on a weird "out-of-nowhere" glitch. My dual monitor setup wouldn't go into monitor power down after x minutes of inactivity.

Since then, I've also noticed the following: Browser windows, applications and such have their focus stolen. I notice some internet activity that I can't pin down.

Basic setup is: Windows XP, all updates [which might be the problem...] on an AMD mobo, dual monitors, normal peripherals, ATI x800 video card with most recent catalyst center updates. Use McAfee virusscan 7.1. Active programs that run on startup are Mcafee, HP printer app, desktop sidebar, spamihilator, UPS app, and active sync. No changes to hardware or software other than updates noted below.

I have all "automatic updates" turned off, except for the virus scanner definitions files. I'm behind a wired router. I've scanned for viruses with adaware, Mcafee, spybot, spysweeper, A2. Nothing, and I mean nothing shows up with any of these apps. Repeatedly cleaned with ccleaner, registry is in good shape as far as my diagnostic programs go. Ran hijackthis, no issues found. I watch my internet activity in real time, along with process information, and can find nothing unusual or suspect. Using TweakUI, I've checked that "prevent apps stealing focus" is checked, no help.

This leads me to think that the culprit is one of the following: either one of Mcafee's most recent [forced] updates is stealing the focus, or a recent XP update has changed something. Focus goes somewhere for about ten seconds, then returns. When I turn off Mcafee, or any of the desktop apps, it doesn't fix the issue...leading me to suspect Windows as the poltergeist.

In the cmd window, the internet activity shows only things that I expect.

I've checked each running process one by one, and found nothing that looks nefarious.

I'm guessing that some app is doing something which 1] Checks the internet for updates, 2] thereby preventing the monitors from going into standby, and 3] stealing focus from time to time.

Ideas? TIA, and sorry for the length of this post.

Len.

**NooNoo** · January 16th, 2007, 04:55 AM

Worrying set of symptoms... have you checked for rootkits?

**IT Len** · January 16th, 2007, 05:49 AM

Hi Noo,

Yes, I forgot to mention that I'd also run Black Ice, among other rootkit scanners. Nothing turns up.

One thing I have noticed, though, that while I did a thorough system cleanup, including chkdsk and other normal stuff, this time I went in and removed the prefetch files, rebooting. Window focus is now stable, yet power options still won't apply.

Curiouser and curiouser!

Len

**NooNoo** · January 16th, 2007, 05:54 AM

so have you tried just disabling mcafee and seeing if the symptoms continue?

Power options may be down to whether you have pnp os in the bios set to yes or not.

**IT Len** · January 16th, 2007, 06:43 AM

Regarding the Mcafee shutdown: Yes. Actually shut down anything that starts after a boot, and it did not make any difference.

In bios, I have it set for pnp OS, which is what it's been since build date.

You've made me think about another path to try, though. I wonder, if during the most recent set of XP "critical" updates, something activated internet activity in Media player. I'd set everything there to not check for licenses, updates, etc., but never went back to check, since I rarely use any entertainment type software on this workstation. [Which will now have to wait for the day to end for me to check.]

I intermittently see on my desktop net monitor, a send of 545bytes, receive of 545bytes...it looks like it's a timed thing, but can't figure out what it is!

Thanks for helping me brainstorm, Noo, I appreciate it!

Len

**NooNoo** · January 17th, 2007, 07:12 AM

ok... so things that poll big brother...
Creative Software
Cyberlink software
Antivirus software
Windows Updates
Office Updates
Any by Real
WMP
Windows defender
the list is endless....

Things like upnp, file sharing, ipx, dhcp lease renew, polling printers or servers, roaming profile... heck it may even be a receive then a send...?

**werner2000** · January 18th, 2007, 07:38 PM

the problem is spamihilator, uncheck "automatically search for updates" in the settings and it will no more steal the focus of other windows.. its because the server to check for update is down.

**IT Len** · January 19th, 2007, 01:20 AM

Werner, you nailed it! Interesting that you figured out the problem without me having mentioned Spamihilator as one of the apps I use! And, your first post on WD is one to offer a solution!

I went back through a selective startup, bringing apps and processes back on line, one at a time, and was able to verify that spamihilator was the culprit.

I then attempted several times to go to the .com site for them, and found out what you alluded to! My mistake was that I had not made sure that the ten day update cycle was unchecked. As you note, if it can't update, it will keep trying. This was the cause of the focus stealing and the power options loss.

Thanks again, Noo and Werner, I sincerely appreciate the help! And Werner, thanks for starting a WD account to answer my question!

Len.