Explorer / IE Delay - Very unusual

[Microsoft]

My problem in short is this:
Whenever I open a window that requires explorer (IE or a a normal folder)
the first instance opens instantly the second suffers a 30 second delay.
This patern continues; so the 3rd would open fast and the 4th have the
delay, in other words every other time explorer is accessed there is a
delay.
When I try and open 3 windows in quick succesion if the previous attempt was
a delayed one then the first opens quickly and then the 2nd and 3rd both
open after 30 seconds.

Some of the things I have tried.
I granted my self full permission on the whole of the system drive. This
appeared to solve the issue, only for it to return after a reboot (Although
I'm not entirly sure exactly how or when it came back, too elated at having
fixed it)

I then presumed it was something that was being run at the same time as IE
so off to the registry sure enough there was an entry in:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
for a button belonging to the dreaded Messenger a program I always remove,
again I removed this entry and all was well until I restarted.

It could still be a Messenger problem I suppose maybe it is attempting to
start the none existing program from somewhere else?

I have Sophos antivirus which uses Intercheck (on access checking which I
have disabled to no avail.)

I have run the following tests all to no avail:
Sophos antivirus All files test
SpyBot
Ad-Aware
All of the above are up to date.
Full hard disk check and surface scan of System HDD and also the 2nd HDD
(where the pagefile is housed)


I have the following set-up:
WinXP Pro workstation SPK2 and up to date with all the latest MS patches.
This is a domain member on a Windows 2003 system.


The following processes are running on my machine:
U:\>pulist
Process
Idle
System
smss.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
svchost.exe
SWEEPSRV.SYS
winvnc.exe
alg.exe
explorer.exe
NclTray.exe
SERVIC~1.EXE
WINWORD.EXE
msimn.exe
cmd.exe
taskmgr.exe
pulist.exe


Any assistance would be greatly appreciated.

Andy Boast

 

[David Candy]

If you have Pro type

tasklist /svc

 

[Microsoft]

David
For what purpose do I need to run tasklist /svc? I have already supplied a
list of running tasks.


If you have Pro type

tasklist /svc

 

[Microsoft]

Tasklist /svc produces the foillowing:

System Idle Process 0 N/A
System 4 N/A
smss.exe 636 N/A
csrss.exe 712 N/A
winlogon.exe 736 N/A
services.exe 780 Eventlog, PlugPlay
lsass.exe 792 Netlogon, PolicyAgent, ProtectedStorage,
SamSs
svchost.exe 968 DcomLaunch, TermService
svchost.exe 1044 RpcSs
svchost.exe 1128 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
dmserver, ERSvc, EventSystem, helpsvc,
Irmon, lanmanworkstation, Netman, Nla,
RasMan, Schedule, seclogon, SENS,
SharedAccess, ShellHWDetection, srservice,
TapiSrv, Themes, TrkWks, W32Time, winmgmt,
wuauserv, WZCSVC
svchost.exe 1180 Dnscache
svchost.exe 1280 LmHosts, RemoteRegistry, SSDPSRV, WebClient
spoolsv.exe 1544 Spooler
svchost.exe 128 stisvc
SWEEPSRV.SYS 236 SWEEPSRV.SYS
winvnc.exe 360 winvnc
alg.exe 1200 ALG
explorer.exe 1952 N/A
NclTray.exe 1740 N/A
SERVIC~1.EXE 380 N/A
WINWORD.EXE 3636 N/A
OUTLOOK.EXE 2156 N/A
msimn.exe 2000 N/A
cmd.exe 3508 N/A
tasklist.exe 2616 N/A
wmiprvse.exe 3416 N/A

Hope this helps


Andy Boast



If you have Pro type

tasklist /svc

--
----------------------------------------------------------
War on the Pachyderms Terrorists
http://www.counterpunch.org/wilson09012004.html

My problem in short is this:
Whenever I open a window that requires explorer (IE or a a normal folder)
the first instance opens instantly the second suffers a 30 second delay.
This patern continues; so the 3rd would open fast and the 4th have the
delay, in other words every other time explorer is accessed there is a
delay.
When I try and open 3 windows in quick succesion if the previous attempt
was
a delayed one then the first opens quickly and then the 2nd and 3rd both
open after 30 seconds.

Some of the things I have tried.
I granted my self full permission on the whole of the system drive. This
appeared to solve the issue, only for it to return after a reboot
(Although
I'm not entirly sure exactly how or when it came back, too elated at
having
fixed it)

I then presumed it was something that was being run at the same time as IE
so off to the registry sure enough there was an entry in:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
for a button belonging to the dreaded Messenger a program I always remove,
again I removed this entry and all was well until I restarted.

It could still be a Messenger problem I suppose maybe it is attempting to
start the none existing program from somewhere else?

I have Sophos antivirus which uses Intercheck (on access checking which I
have disabled to no avail.)

I have run the following tests all to no avail:
Sophos antivirus All files test
SpyBot
Ad-Aware
All of the above are up to date.
Full hard disk check and surface scan of System HDD and also the 2nd HDD
(where the pagefile is housed)


I have the following set-up:
WinXP Pro workstation SPK2 and up to date with all the latest MS patches.
This is a domain member on a Windows 2003 system.


The following processes are running on my machine:
U:\>pulist
Process
Idle
System
smss.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
svchost.exe
SWEEPSRV.SYS
winvnc.exe
alg.exe
explorer.exe
NclTray.exe
SERVIC~1.EXE
WINWORD.EXE
msimn.exe
cmd.exe
taskmgr.exe
pulist.exe


Any assistance would be greatly appreciated.

Andy Boast

 

[David Candy]

Why Tasklist, because it lists the services.

Get filemon/regmon from www.sysinternals.com and monitor explorer and see if it is doing anything during that 30 secs delay.

--
----------------------------------------------------------
War on the Pachyderms Terrorists
http://www.counterpunch.org/wilson09012004.html

Tasklist /svc produces the foillowing:

System Idle Process 0 N/A
System 4 N/A
smss.exe 636 N/A
csrss.exe 712 N/A
winlogon.exe 736 N/A
services.exe 780 Eventlog, PlugPlay
lsass.exe 792 Netlogon, PolicyAgent, ProtectedStorage,
SamSs
svchost.exe 968 DcomLaunch, TermService
svchost.exe 1044 RpcSs
svchost.exe 1128 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
dmserver, ERSvc, EventSystem, helpsvc,
Irmon, lanmanworkstation, Netman, Nla,
RasMan, Schedule, seclogon, SENS,
SharedAccess, ShellHWDetection, srservice,
TapiSrv, Themes, TrkWks, W32Time, winmgmt,
wuauserv, WZCSVC
svchost.exe 1180 Dnscache
svchost.exe 1280 LmHosts, RemoteRegistry, SSDPSRV, WebClient
spoolsv.exe 1544 Spooler
svchost.exe 128 stisvc
SWEEPSRV.SYS 236 SWEEPSRV.SYS
winvnc.exe 360 winvnc
alg.exe 1200 ALG
explorer.exe 1952 N/A
NclTray.exe 1740 N/A
SERVIC~1.EXE 380 N/A
WINWORD.EXE 3636 N/A
OUTLOOK.EXE 2156 N/A
msimn.exe 2000 N/A
cmd.exe 3508 N/A
tasklist.exe 2616 N/A
wmiprvse.exe 3416 N/A

Hope this helps


Andy Boast



If you have Pro type

tasklist /svc

--
----------------------------------------------------------
War on the Pachyderms Terrorists
http://www.counterpunch.org/wilson09012004.html

My problem in short is this:
Whenever I open a window that requires explorer (IE or a a normal folder)
the first instance opens instantly the second suffers a 30 second delay.
This patern continues; so the 3rd would open fast and the 4th have the
delay, in other words every other time explorer is accessed there is a
delay.
When I try and open 3 windows in quick succesion if the previous attempt
was
a delayed one then the first opens quickly and then the 2nd and 3rd both
open after 30 seconds.

Some of the things I have tried.
I granted my self full permission on the whole of the system drive. This
appeared to solve the issue, only for it to return after a reboot
(Although
I'm not entirly sure exactly how or when it came back, too elated at
having
fixed it)

I then presumed it was something that was being run at the same time as IE
so off to the registry sure enough there was an entry in:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
for a button belonging to the dreaded Messenger a program I always remove,
again I removed this entry and all was well until I restarted.

It could still be a Messenger problem I suppose maybe it is attempting to
start the none existing program from somewhere else?

I have Sophos antivirus which uses Intercheck (on access checking which I
have disabled to no avail.)

I have run the following tests all to no avail:
Sophos antivirus All files test
SpyBot
Ad-Aware
All of the above are up to date.
Full hard disk check and surface scan of System HDD and also the 2nd HDD
(where the pagefile is housed)


I have the following set-up:
WinXP Pro workstation SPK2 and up to date with all the latest MS patches.
This is a domain member on a Windows 2003 system.


The following processes are running on my machine:
U:\>pulist
Process
Idle
System
smss.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
svchost.exe
SWEEPSRV.SYS
winvnc.exe
alg.exe
explorer.exe
NclTray.exe
SERVIC~1.EXE
WINWORD.EXE
msimn.exe
cmd.exe
taskmgr.exe
pulist.exe


Any assistance would be greatly appreciated.

Andy Boast