• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1689
  • Last Modified:

Microsoft, XP, SP2, Adobe Acrobat Reader, hang, blue screen

When I open a pdf document (explorer click) or run acrord32.exe, the process running acrobat hangs. When I termilnate the non-responsive process, I get a momentary blue screen of death, followed by a reboot.

If I run in safe mode, I can view pdf's just fine.

I have tried (not necessarily in this order):
-going to a restore point days before the problem appeared
-di9sconnecting the network and turning off the virus checker (zone alarm)
-removing the NVIDEO GeForce Go5200 driver - problem continued
- sfc /scannow - it asks me for an SP2 CD, and I don't have one and microsoft web site won't give me one (it won't download to firefox, and IE gets told I already have SP2)
- removing all Adobe Acrobat software (left Premier and photoshop SE), then re-installing just the latest reader. Same problem.
- run a file system check on my only partition (C:) from safe mode. As a result of that, now when the system starts it says it can't access the volume, then boots up just fine, but PDF problem still exists.

Additional note: on the reboot after the blue screen, it asks permission for me to send a report, which i do. However, I subsequently get a web page served to me that says the report was corrupted.

....I get the feeling that sfc /scannow might solve some of this if I could get it to work.

...Obviously, I really don't want to do a full reinstall. My warranty has lapsed (so if I couldn't get it reinstalled on this laptop, I would be screwed big time), and I have an enormous amount of software on here.

Here is the event output from the file system scanner and a couple events before it started, in case it is of any interest.
8/12/2007      6:02:47 AM      Winlogon      Information      None      1001      N/A      LAPTOP-JRM      Checking file system on C:
The type of the file system is NTFS.
Volume label is MAIN XP.
Cleaning up minor inconsistencies on the drive.
Cleaning up 15 unused index entries from index $SII of file 0x9.
Cleaning up 15 unused index entries from index $SDH of file 0x9.
Cleaning up 15 unused security descriptors.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.

  75208297 KB total disk space.
  57748464 KB in 444877 files.
    260936 KB in 40133 indexes.
         0 KB in bad sectors.
    568485 KB in use by the system.
     65536 KB occupied by the log file.
  16630412 KB available on disk.

      4096 bytes in each allocation unit.
  18802074 total allocation units on disk.
   4157603 allocation units available on disk.

Internal Info:
10 9d 07 00 9d 66 07 00 72 69 0b 00 00 00 00 00  .....f..ri......
4f e9 06 00 01 00 00 00 fe 03 00 00 00 00 00 00  O...............
f0 f7 9c 6a 00 00 00 00 30 75 15 3d 05 00 00 00  ...j....0u.=....
60 5a 6a 6e 00 00 00 00 90 a3 ea e2 35 00 00 00  `Zjn........5...
90 60 86 d7 01 00 00 00 80 18 90 e0 3d 00 00 00  .`..........=...
99 9e 36 00 00 00 00 00 a8 38 07 00 cd c9 06 00  ..6......8......
00 00 00 00 00 c0 af c4 0d 00 00 00 c5 9c 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.

8/11/2007      10:33:41 PM      Userenv      Warning      None      1517      NT AUTHORITY\SYSTEM      LAPTOP-JRM      Windows saved user LAPTOP-JRM\Administrator registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

 This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.
8/11/2007      10:33:41 PM      Userenv      Warning      None      1524      LAPTOP-JRM\Administrator      LAPTOP-JRM      Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.  
  • 5
  • 3
  • 2
3 Solutions
If it runs fine in safe mode, I would try narrowing down on a program that starts when Windows comes up (because startup programs are ignore during safe mode), using the MS Configuration Utility:  In Windows 98/ME/XP, you can choose which programs are run at startup by using the Microsoft Configuration utility:  click on the Start button, choose Run, type in MSCONFIG (doesn't need to be all capitals), click OK.  Choose the Startup tab, deselect programs to run at startup by removing the check mark.  In Windows 9x/ME, you may need to disable just about everything except Explorer, ScanRegistry and SysTray.  In Windows XP, just click on the button for Disable All. Reboot and see if the problem goes away.  If it does then re-enable the startup programs one (or a few) at a time, reboot, and when the problem occurs again, there is your culprit.

In Windows XP: If the problem continues to come up with all startup programs disabled, then it is probably a driver or service.  You can click on the Services tab in MSCONFIG, click on the button for Hide All Microsoft Services, leaving only third-party services displayed, then try turning them off in the same way you did for startup programs.  Finally, if third-party services are eliminated from being the cause of the problem, you could try narrowing down on Microsoft services in the same way.
But it sounds to me also that you might have memory or hard drive problems.  For memory testing:

Windows Memory Diagnostic

The Windows Memory Diagnostic tests the Random Access Memory (RAM) on your computer for errors. The diagnostic includes a comprehensive set of memory tests. If you are experiencing problems while running Windows, you can use the diagnostic to determine whether the problems are caused by failing hardware, such as RAM or the memory system of your motherboard. Windows Memory Diagnostic is designed to be easy and fast. On most configurations, you can download the diagnostic, read the documentation, run the test and complete the first test pass in less than 30 minutes.

Your hard disk may be on the verge of failing. I would suggest running a disk diagnostic utility. Most disk vendors have these for free.



IBM and Hitachi




Western Digital
gustnadoAuthor Commented:
I ran Dell diagnostics before my poosting (forgot to mention). They didn't find any problems.

However, MSCONFIG gives me the following error (when running from an administrator account):
  An Access Denied error was returned while attempting to change a service. You may need to log on using an Administrator account to make the specified changes. Is this was a result of not being able to stop TrueVector?

Now, on boot, I get:
  Since Windows was activated on this computer, the hardware eon the computer has changed significantly. Due to these changes, Windows must be reactivated within 3 days. Do you want to reactivate Windows now?

Is this likely to be for real or is it a sign of a trojan?

The only services running now are DCOM Server Process Launcher, RPC, and TrueVector Internet Monitor (ZoneAlarm).

The PDF problem is still here, even after running MSCONFIG.

Cloud Class® Course: MCSA MCSE Windows Server 2012

This course teaches how to install and configure Windows Server 2012 R2.  It is the first step on your path to becoming a Microsoft Certified Solutions Expert (MCSE).

gustnadoAuthor Commented:
Okay, I slipstreamed an SP2 and did an sfc /scannow.

The program ran about an hour. It did not put out any messages other than the progress bar, and silently ended when it was done. It left no traces in the event log.

Sadly, it did not change the problem at all.

I also ran spybot and it found no malware (and ZojneAlarm has been running all the time).

Any more ideas that don't involve reinstalling XP forcing me to reinstall my zillion apps (if I can find the disks, files and keys)?
Marc ZCommented:
What Antivirus program are you running, just ZA?  It might be a virus, but it might also be your hard drive is going bad and XP thinks you changed it when you scanned and fixed it. Although I thought the reactivation usually kicked in on more then just one item.

Run another one like www.avast.com or nod32 or Grisoft's AVG.  At least run one other scanner through your system.

If you want to stop TrueVector, you must do that in the ZA Program, find the main tab where it says to Load ZA on Startup, or Protect the ZA program and turn it off there and then restart.
gustnadoAuthor Commented:
I normally run just ZA. Yesterday I also ran a spybot scan. I will run another scanner as long as it doesn't install anything other than a scanner.

Would an XP repair install do any more than the sfc /scannow already did?

Also, there remains the clue that  Lee suggested regarding safe mode. Unfortunately, all this takes a bunch of time.

When I solve this or give up, I'll assign points.

Thanks all.
Marc ZCommented:
Yes, it does take some time.  We won't rush you.

 Keep in mind, ZA may have an antivirus, but Spybot is just a malware scanner.   Avast would be another Antivirus,  which you could uninstall after running a full scan.  I've used that one for years.  
But here is their standalone scanner for certain virus, if you really can't install a program.

Here are three online scanners you could try,

A repair reinstall would be a good first step before a full reinstall, but if your hard drive is failing, it won't help too much.

Lee does have some valid points on Safe Mode.  It's definitely worth pursuing.  You might also want to make sure the two Adobe programs you left installed are up to date as much as possible.
gustnadoAuthor Commented:
Would a repair install fix anything that sfc /scannow would not?


Marc ZCommented:
From http://support.microsoft.com/kb/310747/en-us
System File Checker gives an administrator the ability to scan all protected files to verify their versions. If System File Checker discovers that a protected file has been overwritten, it retrieves the correct version of the file from the cache folder (%Systemroot%\System32\Dllcache) or the Windows installation source files, and then replaces the incorrect file. System File Checker also checks and repopulates the cache folder. You must be logged on as an administrator or as a member of the Administrators group to run System File Checker. If the cache folder becomes damaged or unusable, you can use the sfc /scannow, the sfc /scanonce, or the sfc /scanboot commands to repair its contents.

the sfc /scannow Scans all protected system files immediately and replaces incorrect versions with correct Microsoft versions. This command may require access to the Windows installation source files.

And I would assume a repair/reinstall would actually take you back to the Original Install files.  I can't confirm if it would overwrite newer files or not.

From what  I have read, the sfc is supposed to keep the important system files up to date, even with the Windows Updates.

Hmm, you already mentioned this but  I typed it so I'll leave it.
Now before we go too much further, I have read that if you use the the Event Viewer, you should be able to see if sfc actually changed any files.
Go to Start->Run and enter eventvwr.msc and take a look at the System for any lines like
"Windows File Protection scan found that the system file c:\windows\system32\setupapi.dll has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.1106." And let's have a look at any that it might have tried to fix.

The more I reread your issue, I think Lee might be right with the hard drive error.  I know you ran the Dell Diagnostic, but I would really push you more toward a specialist item like the Harddrive diagnostic of the manufacture of your hard drive as Lee pointed you to.  Have you considered that or ran it yet? Especially if you have run a scan disk or checkdisc repeatedly and you get that error.  If you got that error only once, I wouldn't be too concerned but more than twice and my first thought would be "hard drive failure coming."
gustnadoAuthor Commented:
The disk error went away. I suspect it was an artifact of running the partition repair.

I do not see how a hard drive error could cause the type of failure I am getting, as I have tried many variations, presumably moving software physically around on the disk in the process. I think I may "go for broke" and do a repair install with my slipstream CD>

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

  • 5
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now