WD hangs on xpsp3res.dll after update

XP Pro
IE7
Firefox 3.0.6
Avast!
Outpost

System is unresponsive and requires a 3 finger salute to restart.
Problem is repeatable.

On Tue, 10 Feb 2009 19:34:22 -0500, Anonymous Bob wrote:

> XP Pro

Got SP3 yet?

> IE7

Has it been updated yet (incl. Root Certificates)?

> Firefox 3.0.6
> Avast!

Do you scan frequently with updated VDF?

> Outpost

Absolutely useless as far as Intenet security is concerned. The build-in
application is *impessively* better!

> System is unresponsive and requires a 3 finger salute to restart.
> Problem is repeatable.

Try this:
1.Clear the (IE) temporary Internet files and the history cache.
Click 'Start' and then click 'Run'... then type (or copy/paste)
"inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
button.
In Internet Properties panel 'General' tab, under 'Browsing history', click
'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
all...' button then place a checkmark into the box beside 'Also delete
files and settings stored by add-ons', Click 'Yes' and exit the Internet
Properties panel by clicking the 'OK' button.

2.Clean HDD
Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
(w/out quotation marks into the box, then click the 'OK' button. Select
your drive
(presumably WinXP (C and click OK.

3.Download/execute:
Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
--and--
SuperAntispyware - Free
http://www.superantispyware.com/dow...ANTISPYWAREFREE

Note:
Both free versions of MBAM and SAS are on-demand scanners and offer no
'real-time' protection. Keep them installed and use them as
'second-opinion' scanner which is purposely (by design) recommended by
their respective authors.

4.Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/e...ools/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/...php?showforum=7
http://www.5starsupport.com/ipboard...hp?showforum=18
http://www.theeldergeek.com/forum/i...f6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

5.Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html

Additional references:
How to use Reset Internet Explorer Settings (RIES)
http://support.microsoft.com/kb/923737
Read: "What you must know"
Applies to: Windows Internet Explorer 7 for Windows XP and
Windows Internet Explorer 7 in Windows Vista

Good luck

"Kayman" <kayhkay-nospam-@operamail.com> wrote in message
news:1qt4txifr6p97.l7fh5wxf5cb6$.dlg@40tude.net...
> On Tue, 10 Feb 2009 19:34:22 -0500, Anonymous Bob wrote:
>
> > XP Pro
>
> Got SP3 yet?

Oh yes.

>
> > IE7
>
> Has it been updated yet (incl. Root Certificates)?
>

Oh yes.

> > Firefox 3.0.6
> > Avast!
>
> Do you scan frequently with updated VDF?

Oh yes.

>
> > Outpost
>
> Absolutely useless as far as Intenet security is concerned. The build-in
> application is *impessively* better!

That may be a matter of opinion and you can't beat the logging in Outpost.

>
> > System is unresponsive and requires a 3 finger salute to restart.
> > Problem is repeatable.

I generally run W2K but I keep XP updated on at least a monthly basis. I do
very little browsing from XP.

Give me a bit of time to respond to the rest of your post. ;-)
....and thank you.


>
> Try this:
> 1.Clear the (IE) temporary Internet files and the history cache.
> Click 'Start' and then click 'Run'... then type (or copy/paste)
> "inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
> button.
> In Internet Properties panel 'General' tab, under 'Browsing history',
click
> 'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
> all...' button then place a checkmark into the box beside 'Also delete
> files and settings stored by add-ons', Click 'Yes' and exit the Internet
> Properties panel by clicking the 'OK' button.
>
> 2.Clean HDD
> Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
> (w/out quotation marks into the box, then click the 'OK' button. Select
> your drive
> (presumably WinXP (C and click OK.
>
> 3.Download/execute:
> Malwarebytes© Corporation - Anti-Malware
> http://www.malwarebytes.org/mbam/program/mbam-setup.exe
> --and--
> SuperAntispyware - Free
>
http://www.superantispyware.com/dow...ANTISPYWAREFREE
>
> Note:
> Both free versions of MBAM and SAS are on-demand scanners and offer no
> 'real-time' protection. Keep them installed and use them as
> 'second-opinion' scanner which is purposely (by design) recommended by
> their respective authors.
>
> 4.Download and execute HiJack This! (HJT)
> http://www.trendsecure.com/portal/e...ools/hijackthis
>
> Please, do not post HJT logs to this newsgroup.
> Fora where you can get expert advice for HiJack This! (HJT) logs.
>
> http://www.thespykiller.co.uk/index.php?board=3.0
> http://www.spywarewarrior.com/viewforum.php?f=5
> http://forums.tomcoyote.org/index.php?showforum=27
> http://www.bleepingcomputer.com/forums/forum22.html
> http://www.malwarebytes.org/forums/...php?showforum=7
> http://www.5starsupport.com/ipboard...hp?showforum=18
>
http://www.theeldergeek.com/forum/i...f6&showforum=29
>
> NOTE:
> Registration is required in any of the above mentioned fora before posting
> a HJT log and read the 'stickies' (instructions/guidelines) for the
> respective HJT forum.
>
> 5.Routinely practice Safe-Hex.
> http://www.claymania.com/safe-hex.html
>
> Additional references:
> How to use Reset Internet Explorer Settings (RIES)
> http://support.microsoft.com/kb/923737
> Read: "What you must know"
> Applies to: Windows Internet Explorer 7 for Windows XP and
> Windows Internet Explorer 7 in Windows Vista
>
> Good luck

"Kayman" <kayhkay-nospam-@operamail.com> wrote in message
news:1qt4txifr6p97.l7fh5wxf5cb6$.dlg@40tude.net...
[snip]
> Try this:
> 1.Clear the (IE) temporary Internet files and the history cache.
> Click 'Start' and then click 'Run'... then type (or copy/paste)
> "inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
> button.
> In Internet Properties panel 'General' tab, under 'Browsing history',
click
> 'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
> all...' button then place a checkmark into the box beside 'Also delete
> files and settings stored by add-ons', Click 'Yes' and exit the Internet
> Properties panel by clicking the 'OK' button.
>
> 2.Clean HDD
> Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
> (w/out quotation marks into the box, then click the 'OK' button. Select
> your drive
> (presumably WinXP (C and click OK.
>
> 3.Download/execute:
> Malwarebytes© Corporation - Anti-Malware
> http://www.malwarebytes.org/mbam/program/mbam-setup.exe
> --and--
> SuperAntispyware - Free
>
http://www.superantispyware.com/dow...ANTISPYWAREFREE

Avast!, Malwarebytes, and SAS found nothing.

Removed and re-installed WD...same result.

> 4.Download and execute HiJack This! (HJT)
> http://www.trendsecure.com/portal/e...ools/hijackthis
>
> Please, do not post HJT logs to this newsgroup.
> Fora where you can get expert advice for HiJack This! (HJT) logs.
>
> http://www.thespykiller.co.uk/index.php?board=3.0
> http://www.spywarewarrior.com/viewforum.php?f=5
> http://forums.tomcoyote.org/index.php?showforum=27
> http://www.bleepingcomputer.com/forums/forum22.html
> http://www.malwarebytes.org/forums/...php?showforum=7
> http://www.5starsupport.com/ipboard...hp?showforum=18
>
http://www.theeldergeek.com/forum/i...f6&showforum=29
>
> NOTE:
> Registration is required in any of the above mentioned fora before posting
> a HJT log and read the 'stickies' (instructions/guidelines) for the
> respective HJT forum.
>
> 5.Routinely practice Safe-Hex.
> http://www.claymania.com/safe-hex.html

I'm a bit of a nut about it. :-)

> Additional references:
> How to use Reset Internet Explorer Settings (RIES)
> http://support.microsoft.com/kb/923737
> Read: "What you must know"
> Applies to: Windows Internet Explorer 7 for Windows XP and
> Windows Internet Explorer 7 in Windows Vista

I only use IE7 for WindowsUpdate and have it locked down so tighly that I
have to click "OK" three times for that to run.

>
> Good luck

Something got stepped on badly during the update. WD lost its scan history.
As for HJT, I have a bit of an "unusual" system. I use Treewalk DNS and have
a virtual NIC bridged for running PCLOS under XP.

On Wed, 11 Feb 2009 00:28:10 -0500, Anonymous Bob wrote:

<snip>

> Something got stepped on badly during the update. WD lost its scan history.
> As for HJT, I have a bit of an "unusual" system. I use Treewalk DNS and have
> a virtual NIC bridged for running PCLOS under XP.

Sorry, I am out of suggestions

You may wish to repeat uninstalling/installing WD.
Have a look at this:
Description of the Windows Installer CleanUp Utility
http://support.microsoft.com/kb/290301

Hell A B,

I don't know if this will work but it probably is worth a try.

I'm not sure about this--but it looks promising--

I think you may have to work at excluding it from the scan, as an interim
measure. Tools, Options, general settings, scroll down to Advance Options
settings, and hit the add button. ( If I remeber right, you have to include
the full path)

For the benefit of the community reading this post, please rate the pÂşst.

I hope this post is helpful.

Let us know how it works Âşut.

Еиçеl
--


"Anonymous Bob" wrote:

> XP Pro
> IE7
> Firefox 3.0.6
> Avast!
> Outpost
>
> System is unresponsive and requires a 3 finger salute to restart.
> Problem is repeatable.
>
>
>

"Engel" <Engel@discussions.microsoft.com> wrote in message
news:9AD3C9E3-4B56-43EE-A5EF-BA7004E5F643@microsoft.com...
> Hell A B,
>
> I don't know if this will work but it probably is worth a try.
>
> I'm not sure about this--but it looks promising--
>
> I think you may have to work at excluding it from the scan, as an interim
> measure. Tools, Options, general settings, scroll down to Advance Options
> settings, and hit the add button. ( If I remeber right, you have to
include
> the full path)

Thanks.
I excluded it from the scan but now it hangs on xpob2res.dll...!!!...???

Thanks. I renamed it to xpsp3res.old and ran WU. It didn't replace the file,
but I'm going to play with that approach some more.

"Anonymous Bob" <no.how@no.way> wrote in message
news:OuIc57LjJHA.1212@TK2MSFTNGPRV04.privatenews.microsoft.com...
> Thanks. I renamed it to xpsp3res.old and ran WU. It didn't replace the
file,
> but I'm going to play with that approach some more.

I removed one of yesterday's updates from the control panel and immediately
was notified that updates were ready to download. Xpsp3res.dll had been
re-created. Downloaded and installed the update and restarted, then ran WD.
It hung on xpsp3res.dll again.

I think we have a bug, but since I have to restart the system on every hang,
I have no idea how I could report anything meaningful.

Well - I looked to see if I had an xpsp3res.dll file on this machine, and
didn't. Probably not surprising since it is Windows 7 upgraded from Vista,
and a clean install of Vista, I think.

I'll go look at an XPSP3res.dll file and look at the permission settings on
it--If the file itself is not corrupt, presumably this is a permissions
issue, and we should compare notes on those.

I have a system on which a product using similar scanning technology to
Defender is hanging on wmplayer.exe which is entirely legit and working
fine. I think I've fixed this one, and it was a permissions issue--I'll
have to double check--it's in the office, and I've been home all week
"supervising" roofing work.


"Anonymous Bob" <no.how@no.way> wrote in message
news:O0gbfXMjJHA.1188@TK2MSFTNGPRV03.privatenews.microsoft.com...
>
> "Anonymous Bob" <no.how@no.way> wrote in message
> news:OuIc57LjJHA.1212@TK2MSFTNGPRV04.privatenews.microsoft.com...
>> Thanks. I renamed it to xpsp3res.old and ran WU. It didn't replace the
> file,
>> but I'm going to play with that approach some more.
>
> I removed one of yesterday's updates from the control panel and
> immediately
> was notified that updates were ready to download. Xpsp3res.dll had been
> re-created. Downloaded and installed the update and restarted, then ran
> WD.
> It hung on xpsp3res.dll again.
>
> I think we have a bug, but since I have to restart the system on every
> hang,
> I have no idea how I could report anything meaningful.
>
>


--