Explorer and Internet Explorer Still Sick

[Carl M. Thomas]

Two weeks ago I posted about a serious problem that showed up on my machine
(XP-SP2 Suddenly Goes South: posted 10/8/2004 @ 2:17 AM). Since that time,
I managed to uninstall SP2 (took three tried before it would even come close
to a complete uninstall. It kept hanging partway through). I have also
managed to fix some of the other problems that showed up while I was working
on getting it off.

I then wanted to get a stable system before trying to install it again, but
all the System Restore Points prior to the appearance of the problem were
gone. The files were there, but they didn't show up in the System Restore
dialog box.

The problem with Explorer and Internet Explorer persists. When launching
either one, I get an Application Error dialog box about the instruction at
0xAAAABBBB. When I click OK to Terminate (ha!), I get an Error dialog box
for a Runtime error 216 at the same instruction. Click OK and I get another
Application Error for the instruction at 0xCCCCDDDD; OK gives another
Runtime Error 216 box for that instruction. Click OK gives another
Application Error for the instruction at 0xEEEEFFFF; OK gives the Runtime
error 216 for that instruction too.

The result of clicking the last OK depends on whether it's Explorer or IE
that I'm trying to launch. If Explorer, it may start to launch and then go
away (taking all the icons and TaskBar with it, but they come back). If I
try again, it may stay open, unless there's another one open when it will go
away again. If it's IE, it will open nicely and stay open (no termination
like the App Error box promised - that's why the "ha!"). I used the format
above for the instruction addresses above because the BBBB on the first box
is the same for both apps as is the DDDD and FFFF for the next two boxes. I
figured the first four numbers in each address are the selectors for the 32
bit addresses (represented by AAAA, CCCC, EEEE)and bound to change with each
launch, the commen sets being the offsets in the address space of the apps.
I think that tells me they are both calling the same something else in their
launch phase, but I haven't been able to figure out what.

I have tried getting a debugger to open their code by clicking Cancel in the
Application Error dialog box, but even though the debugger opens, no
assembly code appears, neither for the CLR debugger nor the Whidbey one.

Booting into Safe Mode clears up the problem! If I strip out all services
and startups and boot normally using MSCONFIG, it shows up again. I tried
using MMC to be selective about services, but it won't launch either.
Claims it couldn't open a new document. I've also run SFC /scannow but it
doesn't seem to find any problems.

I've run Ad-aware, HijackThis, SpyBot, the new CWShredder, and SmartKiller
in both Normal and Safe mode and have done a thorough NAV virus scan with
up-to-date definitions. No problems reported, although CWShredder found a
hidden DLL which it squashed; made no difference. I tried to do a disk
surface test with Norton Disk Doctor, but it, like NPROTECT, wouldn't
launch. They did open in the debugger and the call stack showed them both
bombing out in the same Symantec support file. I figured I'd work that
later.

I have tried replacing all the OS DLLs that these two apps show in their
executable, but it made no difference.

Does this info trigger new insights or does anyone know of other tests I can
try? I'm not desparate enough to start completely from scratch. It would
take weeks to reinstall everything. It's been suggested that I reinstall
SP2 and that would fix things. Since that's where it started, I seriously
doubt it would fix the problem.

I'd sure appreciate some help on this.

Carl

 

[Guest]

At command prompt type

sfc /scannow

Make sure you have your XP CD ready

sfc scans all protected system files and replaces
incorrect versions with correct Microsoft versions.

 

[Carl M. Thomas]

Yes, that's what it's advertised to do, but it plodded it's way through
whatever it does and then exited nicely. No obvious attempt to replace
anything from either the CD or the I386 folder and no messages. Nice try,
though; thanks

Carl

 

[Guest]

How old is your system memory?? your RAM modules?
There might be a chance some of them are going bad.
It certainly sounds like some system files are corrupt, and or some type of
corruption, with all the errors your getting. You might be reduced to a
clean install, sorry.

 

[Carl M. Thomas]

Ran compreshensive system memory tests with two separate programs - memory
is less than two years old and clean.

Somewhere out there is a piece of software that lets you track calls from
apps to system files. The Call Stack in the Whidbey debug mode hasn't been
extremely helpful so far. Since both Explorer and Internet Explorer report
the same three errors on startup, I need to find out what they call early
ibn the game. But they eventually proceed anyway, so while this is an major
annoyance (although Explorer will allow only a single instance of itself to
run), it's not fatal. Maybe I or somebody else will come up with a good
idea (other than a clean install - reinstalling GB of software is not
attractive). But I' guess I should start burning CDs for data files and
images :-(

Carl

 

[Carl M. Thomas]

Just thought of this - does anybody know if SP2 replaces ALL system files or
ANY? Maybe if I reinstall, it will overwrite the bad file(s).

Carl

 

[Carl M. Thomas]

OK, sports fans or anybody still paying attention to this. . . the problem
appears to be solved.

I found that the Call Stack in the Whidbey debugger showed a problem in
SDHelper.dll for IE6 and in user32.dll for Explorer. No commonality there.
But I tried to uninstall SpybotSD 1.1 which I had installed - with marginal
success. The errors still occurred, but now from different addresses
betweeen the two where they were the same before. As a test, I downloaded
the new SpybotSD 1.3 and lo the problem went away. It found some CWSearch
bookmarks that the earlier version (and CWShredder and Ad-Aware and
HiJackThis and SmartKiller) missed that must have lost a DLL that was found
and removed on an earlier CWShredder sweep, but were calling it anyway. Now
they're gone and both Explorer and IE6 work fine. I did get a system
hardware shutdown, however. So far, the reboot is holding just fine, so I
suspect I should have rebooted after the removal - a word to the wise.
Hopefully, all's well that ends well. The new Spybot looks and works
better, in spite of some online comments to the contrary.

Carl