Solved

Taskbar Won't Load

Posted on 2006-11-01
11
517 Views
Last Modified: 2012-06-27
A friend has dropped his laptop on my desk with the comments "it wont load"
Its history is unknown as his son as been playing with it.

It is a new Acer Aspire 5102WLMi running XP Home Edition. It can only be a couple of weeks old and has very little installed.

It boots up fine and jumps straight to the desktop (no password & 1 user account)

However the taskbar never loads completely, it is visible with the start button and time but nothing else.
When the mouse pointer is hovered over it, it simply shows the hourglass. Clicking L or R buttons, the start button on the keyboard all yield nothing

The desktop icons are present but also do nothing, as does the desktop.

Typing in the title of this question into google shows some newsgroup results but I am unable to view them because of the company webblocker.

Trying to boot in safe mode crashes the computer with a large block of white text on black background all saying:

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS\system32\DRIVERS\***.sys         where *** are all different filenames e.g. ultra.sys, disk.sys, agp440.sys etc etc

I have let the diskchecker do its job without finding anything.

I cant enter MSCONFIG as I cant access the Run box, though when I first booted it up, it opened automatically, after a couple of reboots, it doesnt.

From what I understand it is some kind of problem loading drivers???

Thanks.
0
Comment
Question by:ShiftCo
  • 6
  • 3
  • 2
11 Comments
 
LVL 9

Expert Comment

by:DjDezmond
ID: 17848484
try opening the task manager... Ctrl + Shift + Esc (Do this AS SOON as you can see the desktop)

Look in the processes list for anything using lots of CPU and end that process. It sounds like you have the same problem a few of my mates are having... scvhost.exe (or svchost.exe) will be running at %100. Apparently this is down to an exploitation attempt.

If it is this same problem, then rest assured his son has done nothing to provoke it. It is quite common and has only the outside web-world to blame!

There is a patch you can install from microsoft that close the loophole (ill try to find it and post it later)...

For now, please refer to the following link for more information:

http://help.lockergnome.com/windows/scvhost-exe-spikes-cpu-100-malfunction-afterward-ftopict525922.html

Assuming this problem IS the same as the one I have seen...

0
 

Author Comment

by:ShiftCo
ID: 17848507
Nope, Taskmanager will open up if i'm quick but no, system idle is still at the top almost all the time with svchost moving up to 2nd place for about a second every 10 - 15 seconds of so.

And I cant read the link you have just posted until I get home - bl**dy webblocker!

J
0
 

Author Comment

by:ShiftCo
ID: 17848526
In the task manager window under the performance tab, the CPU graph windows do n=both show 4 peaks of 50% useage at all times flowing along, so you are onto something, do I just have a smaller version of the problem???
0
 
LVL 28

Expert Comment

by:burrcm
ID: 17848699
I have had a couple of Acers do that. Bung the recovery disk in and start again. I think it is an issue with their image setup.

Chris B
0
 

Author Comment

by:ShiftCo
ID: 17848853
But what caused it to start doing it?
What if it does it straight again afterwards?
I'm happy to use the recovery disk to start again, but only once there is an overall solution.
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 28

Expert Comment

by:burrcm
ID: 17848914
<<But what caused it to start doing it?>> Absolutely no idea, but it seems to happen with some regularity on new machines. Weird. If it is drivers, you should be able to tap it into safe mode (F8), then perhaps try an sfc /scannow. I never bothered. New, no go, trash it and start again. Works for me. One thing for sure, Acer are not running the install disks, just a hi speed image load and shipping. And adding a lot of extra rubbish that do XP no good at all.

Chris B
0
 
LVL 9

Accepted Solution

by:
DjDezmond earned 500 total points
ID: 17849229
It would probably benifit you to look further into the problem before you rebuild it, so that if it does happen again, you'll know what is going on. But its up to you, it may just be easier to rebuild it and hope for the best (there are obviously issues with this manufacturer).

If you do want to diagnose it...

As you've already taken everything out of the startup list, the only problems remaining are with windows services. This is why i instantly thought svchost.exe. Even if it isn't riding up to 100%, ending the process(s) should restore the machine back to a normal state. Another step would be to unplug network connections so its just a stand alone PC.

You should still be able to get into safe mode... whilst booting into safe mode, its normal to see a screen full of white text. this is for troubleshooting so you can see what drivers are currently being loaded, so if it crashes then you can see where it has crashed. NOTE. it will always take a long time to load "MUP.sys", i know alot of people that think it has crashed, but if you leave it it should load into windows.

Once in safemode, the PC should run smoothly as its designed to run on the minimum amount of drivers and services (so theres a good chance the service thats causing the problem will be turned off). check the event logs for anything that may provide you with any information as to what is causing the problem, and scan the PC with anti-virus and anti-spyware software.

There is a windows service called sVChost.exe... and a trojan called sCVhost.exe. There easy to mix up... So if you see the latter in the process list, it is the same problem ive seen, and you will indefinately need to scan for virus's.

When booted normally, you can use the following program to properly explore all running processes. It will explain in good detail what each process is doing, so you can easily see if anything suspicious is going on:
   http://www.neuber.com/taskmanager/
0
 

Author Comment

by:ShiftCo
ID: 17851117
OK, you are correct, if I leave it long enough (about 7 or 8 minutes) it finally boots in Safe mode.
The last line of text that it sticks on is:
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS\system32\DRIVERS\agpCPQ.sys        

And, yes, it does run smoothly, so whatever has caused the problem is now not running.

In the event log there were a few errors so I decided to do another reboot and then re-examine the event log.

However, upon reboot, it informs me that the boot.ini file is missing or corrupt and that the

windows.root>\system32\hal.dll file is missing or corrupt and that I should re-install the file.

So I need to repair XP etc.

Wierd! I'm pretty sure I didn't mess with anything but googling the problem sounds like its common as well.

Conclusion: I will get the recovery CD, repair XP and then reboot and examine the event log.

I can't download the neuber software until I get home anyway.

Thanks for your help so far...
0
 
LVL 9

Expert Comment

by:DjDezmond
ID: 17851326
Can you get into any kind of GUI? does safe mode still work? If you can, look for the Boot.ini (root of C) and open it. Ensure the following line is at the bottom...

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /KERNEL=NTOSKRNL.EXE /HAL=HAL.DLL

You may notice a line similar... if thats the case, then just make sure "/KERNEL=NTOSKRNL.EXE /HAL=HAL.DLL" is stuck on the end.

Reboot again (if any changes have been made), if it still doesn't work, then we need to reinstall the HAL type.

You can reapply the HAL type from safe mode (Well you just need a command prompt)... as long as the I386 folder is on the local drive (unless you can stick your XP cd in and use the I386 folder from there)...

There are several different HAL types, depending on your CPU type (Uniprocessor, MultiProcessor etc.), a cpu with HT (Hyper-Threading) technology is classed as a MultiProcessor.

It might be worth making a backup of the existing files just in case something goes wrong... so before you do anything...
goto command prompt... type the following two lines:

Rename C:\Windows\System32\Hal.dll  C:\Windows\System32\Hal.dllBACKUP
Rename C:\Windows\System32\NTOSKRNL.exe C:\Windows\System32\NTOSKRNL.exeBACKUP

Now, for a multiprocessor...
type the following from a command prompt:

Expand <I386Folder>\Halmacpi.dl_ c:\Windows\System32\Hal.Dll
Expand <I386Folder>\NTKRNLMP.ex_ c:\Windows\System32\NTOSKRNL.exe

For a uniprocessor (If you are unsure, do this one)...

Expand <I386Folder>\Halacpi.dl_ c:\Windows\System32\Hal.Dll
Expand <I386Folder>\NTOSKRNL.ex_ c:\Windows\System32\NTOSKRNL.exe

As long as the boot.ini contians the above mentioned line, all you need to do is reboot... :)
0
 

Author Comment

by:ShiftCo
ID: 17851989
Nope, can't access anything, whatever I do, it comes back to the same messsage.

The guy is going to bring in the recovery CDs etc tomorrow

After that, i'll try your steps, cheers!

J
0
 

Author Comment

by:ShiftCo
ID: 17896751
Well, it locked down completely and would not respond to anything. I could not access a ommand line, nor enter safe, or any other mode for that matter.
I booted from the CD and restored Windows because the guy needed the computer and wasnt bothered about discovering the exact problem.
So, inconclusive!
I'm awarding points to DjDezmond as you the were most helpful, and the points you have made will be useful i he brings it back in.
Thanks!
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Most of the time we are in fix when all of sudden our systems behave weirdly.  Such problems cost time and effort... so it's best to take some preventive actions so that we can avoid such issues or overcome such problems more easily. Preventive M…
If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article (http://rdsrc.us/u3GP7A) first and run the tool TDSSKiller (http://rdsrc.us/GDBBs4) to get rid of the infection. Once done, and if the …
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now