• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 827
  • Last Modified:

XP will not respond to anything?

Hi All,

I am running XP on a Dell laptop and just recently it has stopped responding to any requests i make. I cant open files/folders, run applications or anything. I am able to boot into windows without any problems, nothing else seems to amiss but when i try to click on something i get an hour glass for a few seconds afterwhich it dissapears and no further results occur.

I have booted into safe mode where the computer seems to repond as normal, i performed a system restore but on reboot still same problem.

I have not made any software or hardware changes to this laptop so i dont know whats triggered this behaviour.

I have also tried last known good config but same result.

Any ideas?
  • 9
  • 8
  • 7
  • +6
1 Solution
Tony GimenezInternshipCommented:
Reboot into safe mode and download HijackThis from http://download.hijackthis.eu/hijackthis_199.zip and run it from your desktop.

When HijackThis starts up select where it says Do a system scan and save a logfile.

Copy and paste the logfile here and we will tell you what to check and remove.
I'd simply run a virus scan and an Ad-Aware scan before anything. Looks like your problems are there :)

Software Suggestions:

AVG - www.grisoft.com - It's free and very good.

Ad-Aware by Lavasoft - www.lavasoft.com
sounds like malware
Do you have an up to date Antivirus program?
Antispyware? such SpyBot S&D, ewido and AdAware

Boot to safe mode
>Start>Programs Accessories>System Tools>Disk Cleanup - clear all 'Temp' and 'Temporary Internet' files
>Start> Programs> - Right-Click Startup>Explore - remove unneccesary startup programs

dowload & update the following free versions if you dont already have malware protection:
SpyBot - http://www.safer-networking.org/en/download/index.html

AdAware - http://www.lavasoftusa.com/software/adaware/

ewido - http://free.grisoft.com/doc/ewido-anti-spyware-free/lng/us/tpl/v5

Antivirus - AVGFree - http://free.grisoft.com/doc/avg-anti-virus-free/lng/us/tpl/v5  - though I would recommend a paying for a full version.

Personally I prefer:
Antivirus - EZ Antivirus - http://store.digitalriver.com/servlet/ControllerServlet?Action=DisplayPage&Locale=en_US&id=ProductDetailsPage&SiteID=caconsum&productID=35180700&Env=BASE&pgm=1387600

try running some scans in safe mode once they are installed & updated

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

oops...guess i'm laggn a little
Don't paste the hijacklog file like suggested earlier, but follow these instructions:

Paste the log to the following website


Follow the following exactly:

At the bottom of the page you'll see a "ANALYZE" button. Click it and you will have an analysis of your log. Now a new button, "SAVE ANALYSIS" will show up at the bottom. Your analyzed log will be saved to a page on that homepage, of which you can post the URL here.

Also, try creating a new user and loging on as that, possibly things will work then.
nobusbiljart fanCommented:
try running sfc /scannow from the run box in safe mode
ok my turn ,
Dell laptop this can be caused by heat, if your DEL gets extremely hot let it cool down till cold. Have you checked the battery lately if your always using AC or is that dc lol world languages, electricity ok.
Your Laptop may have over heated a bit.

 while in safemode lets check some stuff:
firstly how much disc space do you have left?
go to start all programs accessories system tools disc cleanup and run it
then at start search  using your search assistant in the all files type TEMP you'll find several, one wil be big, empty it. not the actual folder just the contents.
go to control panel administrative tools event viewer and look at the red errors db click it and find the event description and id number.
r/click my computer properties is system restore monitoring you can reduce the size of allocated for the disc by clicking on the settings next to it.
r/click C drive properties defrag analyze the drive first then close it look at the image and see how much red
from start run type cmd press enter then type chkdsk this will run a read only and show if there is problems with your hdd

Then lets take it from there, any event id numbers you can provide.
Regards M

Reboot in safe mode again for checks 1 and 2 below.

1. The first thing would be to check the windows event viewer for any obvious errors.
(Windows) Start menu --> run --> eventvwr

2. Then you should start in normal windows mode with no extra programs.
(Windows) start menu --> run --> msconfig, then clear the check box on the first screen for "Start up items" (every non essential windows programs, to see them all, navigate to the "Startup tab", you can manipulate them in the next step after rebooting).

3. And if it responds in normal windows mode fine after that, go back to the Startup tab of msconfig, and add some more programs in to automatically start with your computer, reboot and test etc...
Hardeep26Author Commented:
Hi All,

Thanks for all the info and sorry about the late reply.

I have booted into safemode and run sfc/scannow, the utility completes but finds nothing. I also downloaded and ran spybot and adaware, as usual they found a bunch of stuff which i removed and as usual the problem remains.

If someone could point to any problems in my Hijack log i'd appreciate it:

Thanks fellas.

{Hijack log removed by rindi, PE Storage}
Use hijackthis to remove the following (all those that are marked as "nasty"):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

I'd also remove the "unknown" ones.
Hardeep26Author Commented:
Hi Rindi,

Thanks for the info. I did remove all the entries you mention including the unknown ones but on reboot the same thing happens. I am unable to run any programs and i cant even open folders. The only thing i'm able to do is click on the start menu (as i say i cant run any programs so this is largely a pointless task).

If anyone has any ideas i would really appreciate it.

If it is malware/viruses, then it is hiding from the hijackthis scan, your log didn't show anything suspicious but then malware can now hide from HJT scans.

Can you run these diagnostic tools and we'll see what their logs will show?
1. Please download Silent Runners.
* Save it to the desktop.
* Run Silent Runner's by doubleclicking the "Silent Runners" icon on your desktop.
* You will see a text file appear on the desktop - it's not done yet, just let it run (it won't appear to be doing anything!)
* Once you receive the prompt "All Done!", double-click on the new text file on the desktop and copy that entire log and upload the logfile created, go here and paste your log, http://www.rafb.net/paste/
then at the bottom left corner click "paste"
Copy the address/url and post it here:

*NOTE* If you receive any warning message about scripts, please choose to allow the script to run.

2. Download and save blacklight to your desktop.
Doubleclick blbeta.exe, accept the agreement, click scan > next.

You'll see a list of all the items it found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (where xxxxxxx represents numbers). The application finds both bad files and legitimate ones such as "wbemtest.exe", so don't choose the rename option yet! Copy and paste the log it generated in your next reply.

3. Download GMER from here:

Unzip it and start GMER.exe
Click the rootkit-tab and click scan.

Once done, click the Copy button.
This will copy the results to clipboard.
Paste the results in your next reply.

If you're having problems with running GMER.exe, try it in safe mode.

Hardeep26Author Commented:
thanks for all the info rpggamergirl. Seeing as this is turning into such an awkward issue i'm upping the points to 300.

I did as you asked and the results are below, just incase this is malware and its too much of a pain to find/remove do you think a reinstall (the one where my personal files are left in place) would do me any good?

Here's the information you asked for;

1. Silent Runners log can be found at http://www.rafb.net/paste/results/nodkPF50.html

2. I was unable to run backlight as it cant be run in safe mode and my laptop is completely unresponsive in normal mode.

3. Gmer log results are as follows:

GMER - http://www.gmer.net
Autostart 2006-08-07 13:18:49
Windows 5.1.2600 Service Pack 2

Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows
SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1
ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit =

NT\CurrentVersion\Winlogon\Notify\igfxcui@DLLName = igfxdev.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
AOL ACS /*AOL Connectivity Service*/@ = "C:\Program Files\Common
Fax /*Fax*/@ = %systemroot%\system32\fxssvc.exe
McDetect.exe /*McAfee WSC Integration*/@ = c:\program
McShield /*McAfee.com McShield*/@ =
McTskshd.exe /*McAfee Task Scheduler*/@ =
MDM /*Machine Debug Manager*/@ = "C:\Program Files\Common
Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
MpfService /*McAfee Personal Firewall Service*/@ =
MskService /*McAfee SpamKiller Server*/@ =
Spooler /*Print Spooler*/@ = %SystemRoot%\system32\spoolsv.exe
UMWdf /*Windows User Mode Driver Framework*/@ =
wltrysvc /*Dell Wireless WLAN Tray Service*/@ =
%SystemRoot%\System32\wltrysvc.exe %SystemRoot%\System32\bcmwltry.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@MCUpdateExec:\PROGRA~1\mcafee.com\agent\mcupdate.exe =
@MCAgentExec:\PROGRA~1\mcafee.com\agent\McAgent.exe =

HKCU\Software\Microsoft\Windows\CurrentVersion\Run@ctfmon.exe =

Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Display Panning CPL
Extension*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property
Page*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous
Versions*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for
SlideShow*/(null) =
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager
Folder*/%SystemRoot%\system32\extmgr.dll = %SystemRoot%\system32\extmgr.dll
@{2F603045-309F-11CF-9774-0020AFD0CFF6} /*Synaptics Control
Panel*/C:\Program Files\Synaptics\SynTP\SynTPCpl.dll = C:\Program
/*DriveLetterAccess*/C:\WINDOWS\System32\DLA\DLASHX_W.DLL = C:\WINDOWS\System32\DLA\DLASHX_W.DLL
@{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} /*iTunes*/C:\Program
Files\iTunes\iTunesMiniPlayer.dll = C:\Program Files\iTunes\iTunesMiniPlayer.dll
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Web
@{00020D75-0000-0000-C000-000000000046} /*Microsoft Office Outlook
Desktop Icon Handler*/C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL =
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Office Outlook
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon
Handler*/C:\Program Files\Microsoft Office\OFFICE11\msohev.dll =
C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell
extension*/C:\Program Files\WinRAR\rarext.dll = C:\Program Files\WinRAR\rarext.dll
/*{506F4668-F13E-4AA1-BB04-B43203AB3CC0}*/C:\Program Files\Microsoft Office\Visio11\VISSHE.DLL =
C:\Program Files\Microsoft Office\Visio11\VISSHE.DLL
/*{D66DC78C-4F61-447F-942B-3FB6980118CF}*/C:\Program Files\Microsoft Office\Visio11\VISSHE.DLL =
C:\Program Files\Microsoft Office\Visio11\VISSHE.DLL
@{49BF5420-FA7F-11cf-8011-00A0C90A8F78} /*Mobile
Device*/C:\PROGRA~1\MI3AA1~1\Wcesview.dll = C:\PROGRA~1\MI3AA1~1\Wcesview.dll

= C:\Program Files\WinRAR\rarext.dll

= c:\progra~1\mcafee.com\vso\mcvsshl.dll

= C:\Program Files\WinRAR\rarext.dll

= C:\Program Files\WinRAR\rarext.dll

= c:\progra~1\mcafee.com\vso\mcvsshl.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Program Files\Adobe\Acrobat
7.0\ActiveX\AcroIEHelper.dll = C:\Program Files\Adobe\Acrobat
= c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
@{53707962-6F74-2D53-2644-206D7942484F}C:\Program Files\Spybot - Search
& Destroy\SDHelper.dll = C:\Program Files\Spybot - Search & 

HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\WINDOWS\System32\logon.scr

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Start Pageabout:blank = about:blank
@Local Page%SystemRoot%\system32\blank.htm =

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pageabout:blank = about:blank
@Local PageC:\WINDOWS\system32\blank.htm =

HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = C:\Program
Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\system32\itss.dll
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\system32\itss.dll
ms-itss@CLSID = C:\Program Files\Common Files\Microsoft
Shared\Information Retrieval\MSITSS.DLL
mso-offdap11@CLSID =
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll

HKLM\Software\Classes\PROTOCOLS\Handler\wia@CLSID =

---- EOF - GMER 1.0.10 ----

Have you tried creating a new user and then logging in as that new user? Sometimes a user profile can get corrupt...
Hardeep26  what model is your del Laptop?
I can then give the recovery manual.
Or any guides specific to your DEL.
For example here you put the product type Inspiron or Latitude or Dimension
then the model like 5100 or 6000 then hit go.
Here you now have a few topics, .
one is start the support wizard step by guide
>>1. Silent Runners log can be found at http://www.rafb.net/paste/results/nodkPF50.html<<

I'm very sorry to be late in checking the Silent Runners log, it's not there on the site anymore, can I ask you to upload it at EE-Stuff.com  please? they will keep it there indefinitely or until Netminder removes them I guess.

Gmer's log looks okay.
try scandisk/defrag from safemode

still issues???
try winXP nondestructive repair install
Thanks for the Silent Runners log.(I will delete it though)
I couldn't find anything suspicious in the log.
I've heard of a new Dell laptop and McAfee having conflict when a certain application is installed(not sure which app in your case)

You can try uninstalling McAfee and all its components as a last resort I guess if nothing else helps and see if it fixes the problem.
I came across this and may relate to your problem as well from windows updates.
You may experience problems in Windows Explorer or in the Windows shell after you install security update MS06-015
After you install security update 908531 (security bulletin MS06-015), you may experience one or more of the following problems:• You cannot access special folders such as "My Documents" or "My Pictures."  
• Microsoft Office applications stop responding when you try to save or to open Office files in the "My Documents" folder.
• Office files that are located in the "My Documents" folder cannot be opened.
• If you open a file by clicking Open on the File menu, the application stops responding.
• When you type an address in the Address box in Microsoft Internet Explorer and you then press ENTER or you click Go, nothing happens.
• When you right-click a file and then click Send To, nothing happens.
• When you expand a folder in Windows Explorer, nothing happens.
• Some third-party applications stop responding when you open or save data in the “My Documents” folder.
Hardeep26Author Commented:
hi guys,

I just uninstalled mcaffe and tried the fix for the issue merete mentions, that particular registry value was already there and with a value of 1.

Unless anyone can think of anything else i think its reformat time.

yes agree can you back up ok?

Hardeep26 as you own a DEL computer ( what model number please) these come with an OEM version of xp and you can repair it re-install is not a good idea you'll have to delete the partition and re-create it install new.
Otherwise you may find you'll get to the very last of the install and then problems like endless rebooting start.
Your DEL should have a recovery partition and you have You set the bios to boot from cd then choose the recovery by pressing f11.

Btw do you have xpsp2 installed? if so uninstall this from add remove programs if was an upgrade version and not a slipstreamed sp1/2 cd.
That maybe the problem these upgrade to xpsp2 seem to cause lots of problems.
If you have xps1 then please upgrade to sp2 as the support for sp1 ends October 10th this year.
order free sp2 cd here

With your model number I can give you the exact steps to repair your model.
WindowsReinstall.com - OEM Computers
Recovery of DEL
choose the operating system xp home or pro recovery above the word DEL is the link here I 'll show you
Now you choose old hd re-install etc
xp pro

xp Home.
Hardeep26 dont format yet...its premature

try the non-destructive repair install
you will have to reinstall all of the WinUpdates but all of files and programs will still be intact.
my experience with Dell's is that they give you a regular full versionn OEM cd  that works like every other,,, you should be able to do the repair install.

just set your BIOS to boot to CD, insert it,  reboot, then follow these nstructions

Hardeep26Author Commented:
thanks jas i think im gonna have to do as you say.

Although i did find a little more info on this problem. it seems when i try to open or run anything the explorer.exe service jumps to 99%. This is what makes the system unresponsive..

I seem to remember explorer.exe can be also be caused by spyware (as well as being a geniune windows service). does anyone have any thoughts on this?

nobusbiljart fanCommented:
nobusbiljart fanCommented:
did you run any malware scanners? if not, i suggest running ALL these - updated :
     adaware :      http://www.lavasoftusa.com/
     Spybot :        http://www.download.com/3000-8022-10122137.html
http://housecall.trendmicro.com/                                                               online scan for trojans
http://www.spychecker.com/program/hijackthis.html                                   download
http://www.hijackthis.de/index.php?langselect=english                                check the log
Hardeep26Author Commented:
hi all,

i looked for the xp cd from dell but it seems they have supplied is application and utility cd's.

I have a few other dell computers and i checked all the stuff for them and the same thing applies. i have blue and green cds marked applications already installed on you computer.

any ideas?
nobusbiljart fanCommented:
dell does not give out xp cd's, they install recovery partitions on the disk, available with a control sequence, such as CTRL +F11 during boot - check the ma
nobusbiljart fanCommented:
check the manual for it - try to run the scans.
Hardeep26Author Commented:
also when i try to install xp from a xp setup cd i already own i recive the following blue screen error:

a problem has been detected and windows has been shut down to prevent damage to your computer.

technical information;
*** stop: 0x0000007e (0xc0000005, 0xf85480bf, 0xf8994208, 9xf8993f08)

***pci.sys - address f95480bf base at f8541000, datestramp 9b7d855c

as i say have no oem setup cd from dell so what are my options?


nobusbiljart fanCommented:
Look here :


i suggest to test the ram (always a good start); use memtest from :    www.memtest.org/      
you can also do a disk test :  
what is the model # of your Dell??

I am looking at Dell 'Operating System' cd.  It is a reddish-brown color, says 'Operating System' in bold letters then 'Windows XP' below it.   If you have the preinstalled software cd's then you really 'should have gotten the 'Operating System' cd too.
Also it is an OEM cd and the cd key on the side of your box will only work with the Dell OEM 'Operating Ststem' cd. Did you look under everything for it?? 2 discs in one sleeve maybe??
...and no I will not mail you this one

Hardeep26Author Commented:
hi everyone,

just wanted to report back on this issue. It seem there is some kind of defect for that specific profile as i created a new one using the admin account in safe mode and this new profile works fine in normal mode.

Does anyone know how i can retrieve my files from that other profile though?

Also i ran dells diognostics sw and it found an ide start failure (1000-0146). Any ideas?
nobusbiljart fanCommented:
>>   ide start failure   <<  this points to a disk or disk controller problem, so i suggest testing the disk.
If you get errors, replace the drive.
To recover your files, just look for the old profile in C:\Documents and Settings\Old Profile's User Name. Your files should be inside there.
Comment from rindi
Date: 08/07/2006 06:05AM PDT

Have you tried creating a new user and then logging in as that new user? Sometimes a user profile can get corrupt...

 Comment from Hardeep26
Date: 08/13/2006 02:48PM PDT
      Author Comment       

hi everyone,

just wanted to report back on this issue. It seem there is some kind of defect for that specific profile as i created a new one using the admin account in safe mode and this new profile works fine in normal mode.

Does anyone know how i can retrieve my files from that other profile though?

Also i ran dells diognostics sw and it found an ide start failure (1000-0146). Any ideas?
 Comment from rindi
Date: 08/14/2006 02:13AM PDT

To recover your files, just look for the old profile in C:\Documents and Settings\Old Profile's User Name. Your files should be inside there.

It looks like you win this round rindi
Hardeep26Author Commented:
Hi Rindi,

Although i have tried what you suggested i am unable to access any of my music files which reside in folders on the desktop.
Do you get an error message when you try accessing them? Can you see the files? You will probably have to take ownership of the folder by logging on as administrator, then right clicking the folders, selecting "Security", click the "Advanced" button, then the "ownership" tab. Now add the new user as owner and you should be able to access the files.
nobusbiljart fanCommented:
did you test the disk?
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

  • 9
  • 8
  • 7
  • +6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now