Ghost image on my Windows 8.1.2 laptop's desktop-screen

[jwoegerbauer]

An oddity that drives me nuts. It occured first time a week ago on my Windows 8.1.2 laptop ("Windows Starter" 64-bit edition). It seems to be related to any browser I use, FF, IE and Goggle Chrome, not to any other application.

Description:

Immediately after ending a browser session (FYI: all browsers are "legacy mode" apps) on my "Desktop-screen", not on "Start-screen", this small image appears


This is its original size

in the outmost right-lower corner and then there stays always on top: it's moveable, but not removeable. It lasts there until laptop gets restarted. It also does not respond to mouse clicks.


Wasn't able to get rid off this. Have deinstalled / reinstalled FF and Google Chrome (IE can't be deinstalled), have run almost all wellknown malware / adware remover (especially those 23 listet ). Nothing was found, was to remove (except DrWeb notified me that HOSTS file may be corrupted what forced me to create a new one; was also not the cause). Hours wasted so far.

Since the oddity still persists: Have you also experienced this? If so, can you teach me how to get rid off of this? TIA

[mango]

call ghost busters

[cmangle]

Looks like a reverse image of Steve Jobs!

Ya know Gates stole his idea for a GUI for windows after 3.1!

[Tiny]

Not happening here on Win8.1 64 bit Pro.

I'd be looking at;
1: browser addons
2; browser services
3; background processes that start up when a browser is opened.

See if any remain running when they shouldn't.

Adobe Flash player is one that has caused me some mysteries in the past on XP & Vista. Not on W8 so far.

Tip: in Task manager under the services tab, if you click on the top of status column it sorts them by running & not running for easier diagnostics.

[porkop]

too much cut and pasting, damaged the screen

[lsemmens]

Try updating your video driver. Possibly uninstalling it and re-installing it if it is the latest. I have seen similar, but not for many years.

[Seymour Butts]

Just a couple of ideas.
Have you ever installed anything by IOBit??
Have you tried changing the desktop, if it's desktop related run a system file check.
SFC /SCANNOW Command - Remember to run as Administrator.
I know it's Windows 8 but are you running Gadgets??.
It could also be a bad thumbnail causing the issue.
Clear and reset the thumbnail cache to force Windows to reload the thumbnail picture views into the cache again as needed as you open folders.
The thumbnail cache .db files are located in the hidden system folder location below:
C:\Users\User-Name\AppData\Local\Microsoft\Windows\Explorer
You may want to clear the thumbnail cache if the Windows Explorer thumbnail pictures have become corrupted and not displaying properly, or the thumbnail cache file has become to large and you want to clear some hard disk space.
I've also seen Glary Utilities do similar things

[jwoegerbauer]

Have you tried changing the desktop, if it's desktop related run a system file check.
SFC /SCANNOW Command - Remember to run as Administrator.

No. Since the beginning I'm using System Internals (in between a Microsoft company) tool "Desktops" which allows me to have 4 desktops in use. Forgot to say that the oddity always only is given on the desktop wherein the browser is run, the other desktops are not affected.

To be on the safe side followed your advice. But because my Windows 8 is OEM version, means I don't have an installation CD, can't use "System File Checker" to try to repair a corrupted Windows 8.1

Therefore, to see whether my Windows 8.1 really got currupted, I used Windows 8.1 inbuilt diagnostic/repair tool DISM, because over Dism.exe Windows 8.1 is given access to the resources of the system maintenance and backup packages from the components gates and the WINSXS folder and uses it to repair the messed-up system files.

Dism /Online /Cleanup-Image /ScanHealth -> checks the Components Store for damage

Dism /Online /Cleanup-Image /CheckHealth -> verifies the integrity with respect to the Component Store in the Windows registry

Result: DISM did not recognize any damages. Was happy to get this information(s).

BTW:
If DISM tells you there is something to repair then you - additionally - have to run

Dism /online /cleanup-image /restorehealth

It could also be a bad thumbnail causing the issue.
Clear and reset the thumbnail cache to force Windows to reload the thumbnail picture views into the cache again as needed as you open folders.
The thumbnail cache .db files are located in the hidden system folder location below:
C:\Users\User-Name\AppData\Local\Microsoft\Windows\Explorer
You may want to clear the thumbnail cache if the Windows Explorer thumbnail pictures have become corrupted and not displaying properly, or the thumbnail cache file has become to large and you want to clear some hard disk space.

Although I could not imagine what Windows's thumbnail caches could have to do with the problem described, I cleared the thumbnail caches, as advised. Immediate result: Explorer crashed.
Despite a full shutdown, in the following time multiple Explorer crashes occurred. I simply shouldn't have followed this advice.

And: Didn't fix the problem.

Not happening here on Win8.1 64 bit Pro.

I'd be looking at;
1: browser addons
2; browser services
3; background processes that start up when a browser is opened.

See if any remain running when they shouldn't.

Adobe Flash player is one that has caused me some mysteries in the past on XP & Vista. Not on W8 so far.

Tip: in Task manager under the services tab, if you click on the top of status column it sorts them by running & not running for easier diagnostics.

Those aren't installed, set of processes before / after a browser session is identical: no (new) process / service gets started.

Nevertheless thank you for helping.


Resume: Will have to make more investigations to find the cause, but that is not in a hurry.

[jwoegerbauer]

During my research, I needed a Watchdog program. Have written it myself. Since it may be interesting also you, here is the code:

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::: SYSMON.BAT
::: This bat file must be run as administrator
:::
::: Prerequisites:  SysMon.exe
:::                 psloglist.exe (part of SystemInternals PsTools)
:::
::: Author: (C) 2015 jwoegerbauer
::: Date: 2015-02-01
::: License: GPL v2
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
@ECHO OFF
SETLOCAL enabledelayedexpansion
MODE CON COLS=80 LINES=25
COLOR 1f
CLS
::: Define the app to be investigated with SysMon here 
SET app=firefox.exe
SET apppath="%PROGRAMFILES%\Nightly"
:::
SET killapp=0
SET displaylog=0
SET apptimeout=60
SET additionaltimeout=120
SET mylog="%USERPROFILE%\Desktop\sysmon-events.txt"
SET logexportfilename="%CD%\logexportname.txt"
SET logexportfile="%CD%\sysmon.evtx"
SET sysmon="%PROGRAMFILES(x86)%\Sysmon\Sysmon.exe"
SET psloglist="%PROGRAMFILES(x86)%\PSTools\psloglist.exe"
%sysmon% -u > NUL 2>&1
IF EXIST %mylog% DEL %mylog% > NUL 2>&1
ECHO.
ECHO Starting SysMon ...
%sysmon% -accepteula -i -h  sha256,md5 -n %app% > NUL 2>&1
ECHO.
ECHO Starting %app% ...
IF %killapp%==1 (
ECHO.
ECHO DO NOT CLOSE "%app%" BY YOURSELF !!!
START "" /WAIT %apppath%\%app%
ECHO.
ECHO Waiting %apptimeout% seconds, then terminating %app% ...
PING 127.0.0.1 -n %apptimeout% > NUL 2>&1
ECHO.
ECHO Stopping %app% ...
TASKKILL /F /IM %app% /T > NUL 2>&1
ECHO.
ECHO app %app% stopped.
) ELSE (
ECHO.
ECHO PLEASE CLOSE "%app%" WITHIN %apptimeout% SECONDS BY YOURSELF !!!
START "" %apppath%\%app%
)
ECHO.
ECHO Waiting additional %additionaltimeout% seconds ...
PING 127.0.0.1 -n %additionaltimeout% > NUL 2>&1
ECHO.
ECHO Stopping SysMon ...
%sysmon% -u  > NUL 2>&1
PING 127.0.0.1 -n 20 > NUL 2>&1
FOR /F "tokens=3 delims= " %%G in ('reg query "hklm\system\controlset001\control\nls\language" /v Installlanguage') DO (
IF [%%G] EQU [0407] (
SET locale=German
) ELSE (
SET locale=English
)
)
IF displaylog==1 (
CALL :extractLogAndRunNotepad
) ELSE (
CALL :runEventViewer
)
ENDLOCAL
GOTO :EOF
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:extractLogAndRunNotepad
IF %locale%==German (
SET year=%DATE:~6,4%
SET month=%DATE:~3,2%
SET day=%DATE:~0,2%
) ELSE (
SET year=%DATE:~6,4%
SET month=%DATE:~0,2%
SET day=%DATE:~3,2%
)
ECHO.
ECHO Extracting log created for %app% ...
WEVTUTIL enum-logs | FINDSTR /i "sysmon" > %logexportfilename%
IF EXIST %logexportfilename% (
SET /p logexportsection=<%logexportfilename%
DEL %logexportfilename% > NUL 2>&1
WEVTUTIL export-log %logexportsection% %logexportfile%
IF EXIST %logexportfile%  (
IF %displaylog%==1 (
%psloglist% -accepteula -f we -c  -m 10 %logexportfile% sys > %mylog%
IF EXIST %mylog% START "" NOTEPAD %mylog%
) 
DEL %logexportfile% > NUL 2>&1
) ELSE (
ECHO.
ECHO Failed extracting log for %app%
ECHO.
PAUSE
)
)
GOTO :EOF
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:runEventViewer
IF %locale%==German (
SET logsection="Anwendungs- und Diensteprotokolle/Microsoft/Windows/Sysmon/Operational"
) ELSE (
SET logsection="Applications and Services Logs/Microsoft/Windows/Sysmon/Operational"                        "
)
ECHO.
ECHO Must look yourself in Windows Events under %logsection% for events protocolled by SysMon
PAUSE
ECHO.
ECHO Starting event viewer ...
START "" EVENTVWR
GOTO :EOF
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

[weirdo]

Do you have Comodo on your pc?
check here >

[jwoegerbauer]

Do you have Comodo on your pc?
check here >

Oh man, you are simply best!

Always was convinced the mutilated icon looks in part as the "C" of Comodo (same font). Because I'm using Comodo since years, and the problem for the first time occurred some weeks ago, I've not searched in this direction. My mistake, I must admit.

Problem now solved!

[weirdo]

kein problem
sometimes you just get lucky with the correct wording in a search
"partial icon right bottom corner" was a winner

[lsemmens]

Good one Weirdo!

[th37sk]

Yep, I had it as well.. running Comodo firewall/Win8.1. It's a known bug. The only workaround (to save you pages of reading) is
Firewall --> Settings --> General Settings --> User Interface --> Untick 'show messages from COMODO message center'. Restart. It won't come back.
Cheers