Checks on ThelmaLou

When I logged into the ThelmaLou system as the administrator to check it today, I saw the following error message:

applnch.exe - Ordinal Not Found

The ordinal 140 could not be located in the dynamic link library MAPI32.dll OK

When I clicked on OK, I then saw the following:

hkcmd Module

hkcmd Module has encounterd a problem and needs to close. We are sorry for the inconvenience. If you were in the middle of someting, the information you were working on might be lost. For more information about this error, click here. Close

When I clicked on "click here", I saw the following error signature information:

AppName: hkcmd.exe	 AppVer: 3.0.0.1607	 ModName: oleaut32.dll
ModVer: 5.1.2600.3266	 Offset: 000344f1 

The file C:\DOCUME~1\ADMINI~1.MAY\LOCALS~1\Temp\c0f3_appcompat.txt was associated with the error report.

I checked the system with Bazooka Adware and Spyware Scanner, even though it's malware definitions haven't been updated in almost a year; they are 340 days old now. It didn't find any malware.

I then checked the system with Spybot Search & Destroy. It reported Microsoft.WindowsSecurityCenter_disabled. with registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start (is not)W=2, but nothing else, aside from 2 cookies. I eliminated the two cookies, one for DoubleClick and one for ValueClick.

[/security/scans] permanent link

Multiple Hbpoid.exe and Hpbpro.exe Processes Running

When I checked a Windows XP Professional Service Pack 2 system for which I had received a report from the user that it was running very slowly, I found multiple HPBOID.EXE and HPBPRO.EXE processes running. I counted them with tasklist /fi "imagename eq hpboid.exe" | find /c /i "hpboid.exe" and tasklist /fi "imagename eq hpbpro.exe" | find /c /i "hpbpro.exe". I found there were 63 instances of hpboid.exe and 49 instances of hpbpro.exe running. The processes were each taking from 56K to 76K of memory.

At hpboid.exe Windows process - What is it?, I found the hpboid process described as follows:

The process HP Status Server Module belongs to the software HP Status Server or HP Deskjet or HP Status Server Module by Hewlett-Packard Company (www.hp.com).

Description: File hpboid.exe is located in a subfolder of C:\Windows\System32 or sometimes in the folder C:\Windows\System32. Known file sizes on Windows XP are 73728 bytes (96% of all occurrence), 61440 bytes.
The program has no visible window. File hpboid.exe is not a Windows system file.

At have multiple hpboid.exe & hpbpro.exe processes, WHY?, I found others reporting the same problem. Someone posted the following script as a solution for eliminating the processes.

net stop spooler
sleep 5
taskkill /F /IM HPBOID.exe
taskkill /F /IM HPBPRO.exe
sleep 5
net start spooler

The poster suggested the script be saved as kill_hpprocess.cmd and run through the Windows task scheduler. The poster stated he found the script at HPBOID.EXE remove it permanently. The author of the blog article there states the following:

Some HP Printer drivers install a service called HP Status Server based on an executable called hpboid.exe, on terminal service machine it start itself many times and it doesn't remove it whenever user disconnect itself consuming too much resources.

He offers some steps to solve the problem on that webpage. Someone else posted the script there as a way to solve the problem. Another poster suggests the problem can be solved instead following advice from Hewlett-Packard (HP), which is the company responsible for hpboid.exe and hpbpro.exe. He references HP Deskjet 6980 Series Printer - Computer Crashes when Printing Over a Network and Network Task Manager Shows Multiple Instances of hpboid.exe Running

The HP webpage lists the following as solutions to the problem:

Issue

Task Manager shows multiple instances of hpboid.exe running. This consumes all the resources and the computer ultimately crashes. This happens when the printer is printing over a network.

Solution

Choose one of the solutions below.

Solution one

Follow the steps below to resolve this issue.

1. Click Start , and then click Run.
2. In the Run dialog box, type services.msc and click OK.
3. Search for HP status server and right-click it. Click Properties, and then click Stop
4. Click Apply and then click OK.
5. Check whether the issue persists. If the issue persists, repeat the same steps for HP port resolver and stop this service.

Solution two

Search for hpboid.exe and delete the file. Deleting the file will not affect the printing functionality.

I followed the steps HP listed in solution one. I stoped the HP Status Server service. That reduced the number of hpboid.exe processes by only one, however, from 63 to 62. It did not reduce the number of hpbpro.exe processes. I stopped the HP Port Resolver service. That reduced the number of hpbpro.exe processes by one from 49 to 48. Since there were still many instances of each process running, I killed all of the others with the following commands:

taskkill /f /fi "imagename eq hpboid.exe"
taskkill /f /fi "imagename eq hpbpro.exe"


I saw a substantial reduction in the amount of memory being used when I killed all instances of those two processes.

References:

1. hpboid.exe Windows process - What is it?
   file.net - Windows XP file forum
2. have multiple hpboid.exe & hpbpro.exe processes, WHY?
   September 21, 2007
   Experts Exchange
3. HPBOID.EXE remove it permanently
   October 2007
   Vittorio Pavesi
4. HP Deskjet 6980 Series Printer - Computer Crashes when Printing Over a Network and Network Task Manager Shows Multiple Instances of hpboid.exe Running
   Hewlett-Packard Development Company, L.P.

[/os/windows/printers] permanent link

Setting the Time Zone from the Command Line

After moving my Outlook data to another laptop, which was running Windows XP Home edition, I noticed that the timestamp on messages appeared to be hours behind when I thought the messages were likely received. When I sent a message where my own address was on the cc line, I noticed that there was a 3 hour difference between the timestamp on the message in my sent folder and the one I received in my Outlook inbox. I thought the timezone was likely set incorrectly, but when I tried cheking it from the account I was logged in under by clicking on the time in the lower right-hand corner of the screen, I recieved a message that "You do not have the proper privilege to change the System Time." Since I had a lot of applications open, I didn't want to close all of my open files, logoff, logon under an administrator account, change the time zone, log back into my account, and then reopen all of the applications and files I had open previously. There is a way that you can check the time zone and change it from the command line.

I used the runas command to run the following command under an administrator account on the system. In this case the "owner" account was in the administrators group on the system.

C:\>runas /user:owner "RunDLL32 shell32.dll,Control_RunDLL %SystemRoot%\system32\TIMEDATE.cpl"

That command opened the Date and Time Properties window. When I clicked on the Time Zone tab, I found the time zone set to "GMT-8:00 Pacific Time (US & Canada)", whereas it should have been set to "GMT-5:00 Eastern Time (US & Canda)". I could now change the timze zone.

The time zone can also be specified on the command line rather than changing it through the Date and Time Properties window. E.g. the command C:\>runas /user:owner "RunDLL32 shell32.dll,Control_RunDLL %SystemRoot%\system32\TIMEDATE.cpl,,/Z US Eastern Standard Time" would allow one to change the time zone to "(GMT-5:00) Indiana (East)". Of course, you don't need the runas /user:owner, if you are already logged into the system as an administrator.

NOTE: You do not encapsulate the time zone string in quotation (") marks. I have quotation marks around the entire rundll32 command for entering a command with spaces in it to the runas command.

You can see what the values are that you should use on the command line for your specific time zone by running regedit and navigating to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Time Zones\.

In this case, I needed to use RunDLL32 shell32.dll,Control_RunDLL %SystemRoot%\system32\TIMEDATE.cpl,,/Z Eastern Standard Time rather than using "US Eastern Standard Time" to have the time zone be "(GMT-5:00) Eastern Time US & Canada". The value that appears under the Time Zone tab in the Date and Time Properties window is what is listed for the display value under each time zone within the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Time Zones\ registry key.

When I changed the time zone, the time changed also to match the time zone change. I needed to reset it, which I did by opening a command window from the "owner" administrator account using runas /user:owner cmd. I then used the time command to reset the time.

References:

1. JSI Tip 7525. How do I set the Time Zone from the command line?
   A Web Exclusive from FAQ for Windows
   Jerold Schulman
   WindowsITPro

[/os/windows/xp] permanent link