WD hangs on xpsp3res.dll after update

[Anonymous Bob]

XP Pro
IE7
Firefox 3.0.6
Avast!
Outpost

System is unresponsive and requires a 3 finger salute to restart.
Problem is repeatable.

 

[Kayman]

XP Pro

Got SP3 yet?

IE7

Has it been updated yet (incl. Root Certificates)?

Firefox 3.0.6
Avast!

Do you scan frequently with updated VDF?

Outpost

Absolutely useless as far as Intenet security is concerned. The build-in
application is *impessively* better!

System is unresponsive and requires a 3 finger salute to restart.
Problem is repeatable.

Try this:
1.Clear the (IE) temporary Internet files and the history cache.
Click 'Start' and then click 'Run'... then type (or copy/paste)
"inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
button.
In Internet Properties panel 'General' tab, under 'Browsing history', click
'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
all...' button then place a checkmark into the box beside 'Also delete
files and settings stored by add-ons', Click 'Yes' and exit the Internet
Properties panel by clicking the 'OK' button.

2.Clean HDD
Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
(w/out quotation marks into the box, then click the 'OK' button. Select
your drive
(presumably WinXP (C and click OK.

3.Download/execute:
Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
--and--
SuperAntispyware - Free
http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

Note:
Both free versions of MBAM and SAS are on-demand scanners and offer no
'real-time' protection. Keep them installed and use them as
'second-opinion' scanner which is purposely (by design) recommended by
their respective authors.

4.Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

5.Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html

Additional references:
How to use Reset Internet Explorer Settings (RIES)
http://support.microsoft.com/kb/923737
Read: "What you must know"
Applies to: Windows Internet Explorer 7 for Windows XP and
Windows Internet Explorer 7 in Windows Vista

Good luck

 

[Anonymous Bob]

Got SP3 yet?

Oh yes.

Has it been updated yet (incl. Root Certificates)?

Oh yes.

Do you scan frequently with updated VDF?

Oh yes.

Absolutely useless as far as Intenet security is concerned. The build-in
application is *impessively* better!

That may be a matter of opinion and you can't beat the logging in Outpost.

I generally run W2K but I keep XP updated on at least a monthly basis. I do
very little browsing from XP.

Give me a bit of time to respond to the rest of your post. ;-)
....and thank you.

 

[Anonymous Bob]

[snip]

Try this:
1.Clear the (IE) temporary Internet files and the history cache.
Click 'Start' and then click 'Run'... then type (or copy/paste)
"inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
button.
In Internet Properties panel 'General' tab, under 'Browsing history', click
'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
all...' button then place a checkmark into the box beside 'Also delete
files and settings stored by add-ons', Click 'Yes' and exit the Internet
Properties panel by clicking the 'OK' button.

2.Clean HDD
Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
(w/out quotation marks into the box, then click the 'OK' button. Select
your drive
(presumably WinXP (C and click OK.

3.Download/execute:
Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
--and--
SuperAntispyware - Free

http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

Avast!, Malwarebytes, and SAS found nothing.

Removed and re-installed WD...same result.

4.Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

5.Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html

I'm a bit of a nut about it.

Additional references:
How to use Reset Internet Explorer Settings (RIES)
http://support.microsoft.com/kb/923737
Read: "What you must know"
Applies to: Windows Internet Explorer 7 for Windows XP and
Windows Internet Explorer 7 in Windows Vista

I only use IE7 for WindowsUpdate and have it locked down so tighly that I
have to click "OK" three times for that to run.

Good luck

Something got stepped on badly during the update. WD lost its scan history.
As for HJT, I have a bit of an "unusual" system. I use Treewalk DNS and have
a virtual NIC bridged for running PCLOS under XP.

 

[Kayman]

On Wed, 11 Feb 2009 00:28:10 -0500, Anonymous Bob wrote:

Something got stepped on badly during the update. WD lost its scan history.
As for HJT, I have a bit of an "unusual" system. I use Treewalk DNS and have
a virtual NIC bridged for running PCLOS under XP.

Sorry, I am out of suggestions

You may wish to repeat uninstalling/installing WD.
Have a look at this:
Description of the Windows Installer CleanUp Utility
http://support.microsoft.com/kb/290301

 

[Engel]

Hell A B,

I don't know if this will work but it probably is worth a try.

I'm not sure about this--but it looks promising--

I think you may have to work at excluding it from the scan, as an interim
measure. Tools, Options, general settings, scroll down to Advance Options
settings, and hit the add button. ( If I remeber right, you have to include
the full path)

For the benefit of the community reading this post, please rate the pºst.

I hope this post is helpful.

Let us know how it works ºut.

Еиçеl

 

[Anonymous Bob]

Hell A B,

I don't know if this will work but it probably is worth a try.

I'm not sure about this--but it looks promising--

I think you may have to work at excluding it from the scan, as an interim
measure. Tools, Options, general settings, scroll down to Advance Options
settings, and hit the add button. ( If I remeber right, you have to include
the full path)

Thanks.
I excluded it from the scan but now it hangs on xpob2res.dll...!!!...???

 

[Anonymous Bob]

Thanks. I renamed it to xpsp3res.old and ran WU. It didn't replace the file,
but I'm going to play with that approach some more.

 

[Anonymous Bob]

Thanks. I renamed it to xpsp3res.old and ran WU. It didn't replace the file,
but I'm going to play with that approach some more.

I removed one of yesterday's updates from the control panel and immediately
was notified that updates were ready to download. Xpsp3res.dll had been
re-created. Downloaded and installed the update and restarted, then ran WD.
It hung on xpsp3res.dll again.

I think we have a bug, but since I have to restart the system on every hang,
I have no idea how I could report anything meaningful.

 

[Bill Sanderson]

Well - I looked to see if I had an xpsp3res.dll file on this machine, and
didn't. Probably not surprising since it is Windows 7 upgraded from Vista,
and a clean install of Vista, I think.

I'll go look at an XPSP3res.dll file and look at the permission settings on
it--If the file itself is not corrupt, presumably this is a permissions
issue, and we should compare notes on those.

I have a system on which a product using similar scanning technology to
Defender is hanging on wmplayer.exe which is entirely legit and working
fine. I think I've fixed this one, and it was a permissions issue--I'll
have to double check--it's in the office, and I've been home all week
"supervising" roofing work.

I removed one of yesterday's updates from the control panel and
immediately
was notified that updates were ready to download. Xpsp3res.dll had been
re-created. Downloaded and installed the update and restarted, then ran
WD.
It hung on xpsp3res.dll again.

I think we have a bug, but since I have to restart the system on every
hang,
I have no idea how I could report anything meaningful.

--

 

[Bill Sanderson]

Thanks.
I excluded it from the scan but now it hangs on xpob2res.dll...!!!...???

Hmm - am I remembering that there's a procedure to reset permissions to the
installation defaults? I'll look for that, too.

 

[Bill Sanderson]

I removed one of yesterday's updates from the control panel and immediately
was notified that updates were ready to download. Xpsp3res.dll had been
re-created. Downloaded and installed the update and restarted, then ran WD.
It hung on xpsp3res.dll again.

I think we have a bug, but since I have to restart the system on every hang,
I have no idea how I could report anything meaningful.

Consider running the script provided in "Method 1" under advanced troubleshooting, in this KB article?

http://support.microsoft.com/kb/949377

 

[Anonymous Bob]

Well - I looked to see if I had an xpsp3res.dll file on this machine, and
didn't. Probably not surprising since it is Windows 7 upgraded from Vista,
and a clean install of Vista, I think.

I'll go look at an XPSP3res.dll file and look at the permission settings on
it--If the file itself is not corrupt, presumably this is a permissions
issue, and we should compare notes on those.

I have a system on which a product using similar scanning technology to
Defender is hanging on wmplayer.exe which is entirely legit and working
fine. I think I've fixed this one, and it was a permissions issue--I'll
have to double check--it's in the office, and I've been home all week
"supervising" roofing work.

Checking Properties | Security on the file all the expected check marks are
there, but they're grayed out except for the Administrator group and that
includes System. Since I'm way over my head here, I can only note that the
same is not true for xpsp2res.dll. If that's to be expected, I have no idea,
but I don't think so.

Thanks and good luck on that "supervising".