XP Home Instability & Odd Behavior

[Don Cohen]

I have run into trouble with my daughter's computer. It is running XP Home,
and used for online chatting and email primarily. I run NAV 2005 and
ZoneAlarm Free on it, and check periodically with AdAware and SpyBot S&D.
It has SP2 installed, and configured to automatically install Critical
Updates. But it's been a few months since I've been up there to check on
it.

Yesterday morning she told me it was starting to get messed up
(non-technical term!). I'm pretty good about trouble-shooting hardware,
software, etc., and have been doing this for about 15 years, but this system
shows an odd combination of problems. Here's a list:

1. Sometimes after a reboot, the desktop icons do not appear.

2. When "1" occurs, if I attempt to open Control Panel, nothing happens

3. When "1" occurs, if I try to access System Properties with the Windows
Key+Break shortcut, I get an error message:
c:\windows\system32\rundll32.exe
The parameter is incorrect

4. The Quick Launch toolbar disappears after every reboot. I tried Doug
Knox's fix (Windows XP doesn't remember user settings) without success.

5. When I re-enable Quick Launch, the desktop icon shows correctly, but all
the others are "generic."

6. When I hit the Start button, the quick access entries at the top are
also "generic."

7. Often, a right-click on the desktop produces no action whatsoever.

8. Often when trying to run a program from the Start Menu, "Explorer"
crashes.

I have rerun SpyBot, NAV2005 and AdAware, found a few cookie files and a
registry entry or two, but this hasn't changed the problem

The biggest suspect: ZoneAlarm. Apparently at some point recently, she
inadvertently took the bait and did a trial upgrade to ZoneAlarm Security
Suite. The trial period ran out (all unbeknownst to me), and I think this
is about when this all started to go down the tubes. One of the first
things I tried to do was uninstall it. My first attempt was unsuccessful
with "Explorer" crashing.

I then booted into Safe Mode in order to uninstall ZASecurity Suite, which
apparently completed uneventfully. But after reboot, the above problems
still recur sporadically.

I don't know if this is residue from ZoneAlarm or not, but something very
funky is going on, and I'm not sure where to go next to try and repair it.
I guess I could try a "Repair" to XP Home via the install CD, but then I'll
have to reinstall SP2 and all the updates. I'd rather find a more
'surgical' repair if one is possible.

Thanks for wading through this, and for any suggestions you might have.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Galen]

In Don Cohen <[email protected]> had this to say:

My reply is at the bottom of your sent message:

I have run into trouble with my daughter's computer. It is running
XP Home, and used for online chatting and email primarily. I run NAV
2005 and ZoneAlarm Free on it, and check periodically with AdAware
and SpyBot S&D. It has SP2 installed, and configured to automatically
install Critical Updates. But it's been a few months since I've been
up there to check on it.

Yesterday morning she told me it was starting to get messed up
(non-technical term!). I'm pretty good about trouble-shooting
hardware, software, etc., and have been doing this for about 15
years, but this system shows an odd combination of problems. Here's
a list:
1. Sometimes after a reboot, the desktop icons do not appear.

2. When "1" occurs, if I attempt to open Control Panel, nothing
happens
3. When "1" occurs, if I try to access System Properties with the
Windows Key+Break shortcut, I get an error message:
c:\windows\system32\rundll32.exe
The parameter is incorrect

4. The Quick Launch toolbar disappears after every reboot. I tried
Doug Knox's fix (Windows XP doesn't remember user settings) without
success.
5. When I re-enable Quick Launch, the desktop icon shows correctly,
but all the others are "generic."

6. When I hit the Start button, the quick access entries at the top
are also "generic."

7. Often, a right-click on the desktop produces no action whatsoever.

8. Often when trying to run a program from the Start Menu, "Explorer"
crashes.

I have rerun SpyBot, NAV2005 and AdAware, found a few cookie files
and a registry entry or two, but this hasn't changed the problem

The biggest suspect: ZoneAlarm. Apparently at some point recently,
she inadvertently took the bait and did a trial upgrade to ZoneAlarm
Security Suite. The trial period ran out (all unbeknownst to me),
and I think this is about when this all started to go down the tubes.
One of the first things I tried to do was uninstall it. My first
attempt was unsuccessful with "Explorer" crashing.

I then booted into Safe Mode in order to uninstall ZASecurity Suite,
which apparently completed uneventfully. But after reboot, the above
problems still recur sporadically.

I don't know if this is residue from ZoneAlarm or not, but something
very funky is going on, and I'm not sure where to go next to try and
repair it. I guess I could try a "Repair" to XP Home via the install
CD, but then I'll have to reinstall SP2 and all the updates. I'd
rather find a more 'surgical' repair if one is possible.

Thanks for wading through this, and for any suggestions you might
have.

As it's XP Home you needn't worry about EFS. Thank you for all the
information, if only every post was as complete but not full of information
not needed. I suspect that you're daughter's profile has, for one reason or
another, become corrupted. It's a fairly mundane fix.

Corrupt Profile:
http://kgiii.info/windows/XP/general/corrupt_profile.html

--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/

"We approached the case, you remember, with an absolutely blank mind,
which is always an advantage. We had formed no theories. We were simply
there to observe and to draw inferences from our observations." -
Sherlock Holmes

 

[Don Cohen]

Galen,

As it's XP Home you needn't worry about EFS. Thank you for all the
information, if only every post was as complete but not full of
information not needed. I suspect that you're daughter's profile has, for
one reason or another, become corrupted. It's a fairly mundane fix.

Corrupt Profile:
http://kgiii.info/windows/XP/general/corrupt_profile.html

Thanks much for the reply and link. It'll probably be Wednesday before I'll
have time to try this out, but I'm hopeful that this will do it. I actually
gave some thought to creating a new User Profile, but didn't follow-up on
it.

I'll repost when I know if this fixes it or not.

Best,

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Rock]

I have run into trouble with my daughter's computer. It is running XP Home,
and used for online chatting and email primarily. I run NAV 2005 and
ZoneAlarm Free on it, and check periodically with AdAware and SpyBot S&D.
It has SP2 installed, and configured to automatically install Critical
Updates. But it's been a few months since I've been up there to check on
it.

Yesterday morning she told me it was starting to get messed up
(non-technical term!). I'm pretty good about trouble-shooting hardware,
software, etc., and have been doing this for about 15 years, but this system
shows an odd combination of problems. Here's a list:

1. Sometimes after a reboot, the desktop icons do not appear.

2. When "1" occurs, if I attempt to open Control Panel, nothing happens

3. When "1" occurs, if I try to access System Properties with the Windows
Key+Break shortcut, I get an error message:
c:\windows\system32\rundll32.exe
The parameter is incorrect

4. The Quick Launch toolbar disappears after every reboot. I tried Doug
Knox's fix (Windows XP doesn't remember user settings) without success.

5. When I re-enable Quick Launch, the desktop icon shows correctly, but all
the others are "generic."

6. When I hit the Start button, the quick access entries at the top are
also "generic."

7. Often, a right-click on the desktop produces no action whatsoever.

8. Often when trying to run a program from the Start Menu, "Explorer"
crashes.

I have rerun SpyBot, NAV2005 and AdAware, found a few cookie files and a
registry entry or two, but this hasn't changed the problem

The biggest suspect: ZoneAlarm. Apparently at some point recently, she
inadvertently took the bait and did a trial upgrade to ZoneAlarm Security
Suite. The trial period ran out (all unbeknownst to me), and I think this
is about when this all started to go down the tubes. One of the first
things I tried to do was uninstall it. My first attempt was unsuccessful
with "Explorer" crashing.

I then booted into Safe Mode in order to uninstall ZASecurity Suite, which
apparently completed uneventfully. But after reboot, the above problems
still recur sporadically.

I don't know if this is residue from ZoneAlarm or not, but something very
funky is going on, and I'm not sure where to go next to try and repair it.
I guess I could try a "Repair" to XP Home via the install CD, but then I'll
have to reinstall SP2 and all the updates. I'd rather find a more
'surgical' repair if one is possible.

Thanks for wading through this, and for any suggestions you might have.

Don it does sound like the system is malware free, but to be sure have
you run all the anti-malware scans in safe mode?

Also if you haven't run HijackThis and if there is any doubt about what
is there post the log to one of the specialty forums for it, not this one.

http://www.spywareinfo.com/forums/
http://forum.aumha.org/viewforum.php?f=30
http://forums.tomcoyote.org/
http://www.wilderssecurity.com/

 

[Galen]

In Don Cohen <[email protected]> had this to say:

My reply is at the bottom of your sent message:

Galen,


Thanks much for the reply and link. It'll probably be Wednesday
before I'll have time to try this out, but I'm hopeful that this will
do it. I actually gave some thought to creating a new User Profile,
but didn't follow-up on it.

I'll repost when I know if this fixes it or not.

Best,

Yes, please do. As Rock's mentioned it's possible that you're infested with
malware. Checking in safe mode with the latest definitions and scanning with
multiple vendor applications is one way to ensure that you're 99% confident
that you're clean. (There's no such thing as 100% certainty, that's a myth,
if the PC is connected to the 'net at all AND if anyone other than yourself
has access and capability of knowing what's installed with each
application.) I'm rather curious as to the results of this and hope that
you're able to figure it out.

--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/

"We approached the case, you remember, with an absolutely blank mind,
which is always an advantage. We had formed no theories. We were simply
there to observe and to draw inferences from our observations." -
Sherlock Holmes

 

[Don Cohen]

A quick reply, Galen:

Yes, please do. As Rock's mentioned it's possible that you're infested
with malware. Checking in safe mode with the latest definitions and
scanning with multiple vendor applications is one way to ensure that
you're 99% confident that you're clean. (There's no such thing as 100%
certainty, that's a myth, if the PC is connected to the 'net at all AND if
anyone other than yourself has access and capability of knowing what's
installed with each application.) I'm rather curious as to the results of
this and hope that you're able to figure it out.

One of the first things I did was boot into Safe Mode, and run SpyBot S&D
1.3, and AdAware SE.

You refer to "Rock's" - I'm not currently seeing a message from him on this
thread, through my Cable-Modem Newsgroup server - odd. I just found it on
Google's Groups, though.

If the User Profile fix doesn't work, I'll explore the other options beyond
what I've already done.

Thanks again, to both of you. Will be back some time tomorrow.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Don Cohen]

Hi Guys,

Yes, please do. As Rock's mentioned it's possible that you're infested
with malware. Checking in safe mode with the latest definitions and
scanning with multiple vendor applications is one way to ensure that
you're 99% confident that you're clean. (There's no such thing as 100%
certainty, that's a myth, if the PC is connected to the 'net at all AND if
anyone other than yourself has access and capability of knowing what's
installed with each application.) I'm rather curious as to the results of
this and hope that you're able to figure it out.

Well, just completed the operation, and so far, so good. I created the 2
new User Accounts, both with Admin privileges. Logged once into what would
be my daughter's New Logon, switched to the other, copied the appropriate
files from the old to the new Logon, and everything seems stable. Quick
Launch remains intact after reboot, all icons are shown correctly, and no
Explorer or other OS crashes.

I went ahead and installed TweakUI to automate Logon to her new account, as
XP defaulted to loading the old one. I also went ahead and deleted the
original problematic logon, and its files, to clean up.

Thanks again for the help. Will repost if problems recur, but hopefully you
were correct, that this was just a Profile corruption.

One follow-up question: a few months ago I installed a Wireless Router
(LinkSys WR54G), having previously used a hub/switch, and so now have a
hardware firewall in place. I'm inclined to not reinstall ZoneAlarm Free,
certainly not Ver.6.x which has quite a few problems according to multiple
posts at ZoneLab's forums. Am I putting this system at risk without a
software firewall? Or should I just enable Windows Firewall?

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[cquirke (MVP Windows shell/user)]

On Mon, 2 Jan 2006 19:48:00 -0500, "Don Cohen"

I have run into trouble with my daughter's computer. It is running XP Home,
and used for online chatting and email primarily. I run NAV 2005 and
ZoneAlarm Free on it, and check periodically with AdAware and SpyBot S&D.
It has SP2 installed, and configured to automatically install Critical
Updates. But it's been a few months since I've been up there to check

Yesterday morning she told me it was starting odd problems:

1. Sometimes after a reboot, the desktop icons do not appear.

Can be shell, can be a user profile thing (e.g. wrong path to
"desktop" location, or a setting to hide desktop icons, is in effect)

2. When "1" occurs, if I attempt to open Control Panel, nothing happens

Could also be shell, settings (such as the right to access Control
Panel is suppressed; unlikely, if it displays so you can attempt to
open it) or a malware intercept effect.

3. When "1" occurs, if I try to access System Properties with the Windows
Key+Break shortcut, I get an error message:
c:\windows\system32\rundll32.exe
The parameter is incorrect

That looks more like malware, possibly via shell integration.

4. The Quick Launch toolbar disappears after every reboot. I tried Doug
Knox's fix (Windows XP doesn't remember user settings) without success.

5. When I re-enable Quick Launch, the desktop icon shows correctly, but all
the others are "generic."

6. When I hit the Start button, the quick access entries at the top are
also "generic."

7. Often, a right-click on the desktop produces no action whatsoever.

8. Often when trying to run a program from the Start Menu, "Explorer"
crashes.

All of the above look like possible shell issues.

1) Formal virus check. Unless you are a Bart CDR fundi, you will
prolly skip this as "too difficult" and rely on some weaker method
(e.g. scanning from Safe Mode) to "exclude" malware.

2) Check ChkDsk/AutoChk and resident antivirus logs to see if
anything relevant (i.e. system code) was "fixed" by these

3) Consider a trial of System Restore rollback to before yesterday

4) Clear temp files, web caches, check file system for errors

5) Download and use NirSoft's Shall Extensions Viewer from
www.nirsoft.net to reversably disable shell integrations, starting
with non-Microsoft items. Apply similar logic via MSConfig.

6) Check hardware - a "static" failure pattern like this, with no
STOP errors or lockups, doesn't sound like RAM - but could be a bad
sector within a relevant code file

Does Safe Mode work OK?
Does it help to disable all browser enhancements in IE?
Do you have active desktop disabled? (recommended)

I have rerun SpyBot, NAV2005 and AdAware, found a few cookie files and a
registry entry or two, but this hasn't changed the problem
OK

The biggest suspect: ZoneAlarm. Apparently at some point recently, she
inadvertently took the bait and did a trial upgrade to ZoneAlarm Security
Suite. The trial period ran out (all unbeknownst to me), and I think this
is about when this all started to go down the tubes. One of the first
things I tried to do was uninstall it. My first attempt was unsuccessful
with "Explorer" crashing.

NirSoft and MSConfig may be able to pinpoint that.

I guess I could try a "Repair" to XP Home via the install CD, but then I'll
have to reinstall SP2 and all the updates. I'd rather find a more
'surgical' repair if one is possible.

Absolutely! "Repair" usually doesn't - see...

http://cquirke.mvps.org/reinst.htm

Is your HD > 137G?
What is your XP installation file set's SP level?
If the CD is older than SP1, do you have SP2 slipstreamed into it?

If HD > 137G, installing (repair or otherwise) the original version of
XP, and to a lesser extend the SP1 version, will be dangerous. That's
because support for > 137G has to be there in the OS from the start,
and this is faulty in SP1 and totally absent before SP1.

---------- ----- ---- --- -- - - - -

Don't pay malware vendors - boycott Sony

 

[Don Cohen]

I appreciate the reply and information, cquirke. You mentioned some tools I
was unaware of, which could prove useful in the future.

See the other messages in this thread - at this point it appears that the
problem was a corrupt User Profile. I created a new one, copied the
appropriate files from the original, and the odd and unstable behavior, so
far, appears to have been resolved. It's only been a very short time, so
I'm not letting my guard down yet, but hopefully this will be the end of it.

Thanks again.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Galen]

In Don Cohen <[email protected]> had this to say:

My reply is at the bottom of your sent message:

Hi Guys,


Well, just completed the operation, and so far, so good. I created
the 2 new User Accounts, both with Admin privileges. Logged once
into what would be my daughter's New Logon, switched to the other,
copied the appropriate files from the old to the new Logon, and
everything seems stable. Quick Launch remains intact after reboot,
all icons are shown correctly, and no Explorer or other OS crashes.

I went ahead and installed TweakUI to automate Logon to her new
account, as XP defaulted to loading the old one. I also went ahead
and deleted the original problematic logon, and its files, to clean
up.
Thanks again for the help. Will repost if problems recur, but
hopefully you were correct, that this was just a Profile corruption.

One follow-up question: a few months ago I installed a Wireless Router
(LinkSys WR54G), having previously used a hub/switch, and so now have
a hardware firewall in place. I'm inclined to not reinstall
ZoneAlarm Free, certainly not Ver.6.x which has quite a few problems
according to multiple posts at ZoneLab's forums. Am I putting this
system at risk without a software firewall? Or should I just enable
Windows Firewall?

With a firewall - hardware - and Windows firewall you should be doing okay.
Windows XP SP2 yes? Make sure to have SP2 installed.

Windows XP Service Pack 2:
http://kgiii.info/windows/XP/general/winxpsp2.html

--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/

"We approached the case, you remember, with an absolutely blank mind,
which is always an advantage. We had formed no theories. We were simply
there to observe and to draw inferences from our observations." -
Sherlock Holmes

 

[Don Cohen]

Hi Galen,

With a firewall - hardware - and Windows firewall you should be doing
okay. Windows XP SP2 yes? Make sure to have SP2 installed.

Absolutely. This was installed a few months after its release. And I have
her system configured to automatically download and install all Critical
Updates.

Thanks again for the help.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Rock]

Don Cohen wrote:

One follow-up question: a few months ago I installed a Wireless Router
(LinkSys WR54G), having previously used a hub/switch, and so now have a
hardware firewall in place. I'm inclined to not reinstall ZoneAlarm Free,
certainly not Ver.6.x which has quite a few problems according to multiple
posts at ZoneLab's forums. Am I putting this system at risk without a
software firewall? Or should I just enable Windows Firewall?

That router is not a hardware firewall. It is a NAT router with some
firewall capabilities. It still doesn't block out bound traffic. It is
a good idea to still run a software firewall that monitors outbound
traffic. The XP SP2 firewall does not, it only monitors inbound as does
the router.

 

[Chuck]

Version 6.1.737 seems to be stable on my system, for what ever that's
worth.

 

[Galen]

In Rock <[email protected]> had this to say:

My reply is at the bottom of your sent message:

Don Cohen wrote:



That router is not a hardware firewall. It is a NAT router with some
firewall capabilities. It still doesn't block out bound traffic. It
is a good idea to still run a software firewall that monitors outbound
traffic. The XP SP2 firewall does not, it only monitors inbound as
does the router.

In conjunction the two tend to do okay on a known clean system. Of course a
known clean system is largely a myth in real-world experiences. <g> Bit of a
Catch-22 there. So, some entertainment...

From the .doc (Changes to Functionality in MS Windows XP SP2) from the
downloads site...

"Action required
None. Windows Firewall will automatically allow all outbound connections,
regardless of the program and the user context."

I'm not so sure I meant to laugh as hard as I did when I read that. I'm
pretty sure that it wasn't meant as a joke. I'm still shaking my head (MVP
or not) at the idea behind that one, the wording makes it seem as if that's
a feature. Ah well...

--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/

"We approached the case, you remember, with an absolutely blank mind,
which is always an advantage. We had formed no theories. We were simply
there to observe and to draw inferences from our observations." -
Sherlock Holmes

 

[Plato]

I have run into trouble with my daughter's computer. It is running XP Home,
and used for online chatting and email primarily. I run NAV 2005 and
ZoneAlarm Free on it, and check periodically with AdAware and SpyBot S&D.
It has SP2 installed, and configured to automatically install Critical
Updates. But it's been a few months since I've been up there to check on
it.

Yesterday morning she told me it was starting to get messed up
(non-technical term!). I'm pretty good about trouble-shooting hardware,

25 new viruses are released every single day. Teens who chat and
download files recommended to them by chat buddies are the first ones to
acquire the new bugs.

 

[Don Cohen]

Rock & Galen,

In conjunction the two tend to do okay on a known clean system. Of course
a known clean system is largely a myth in real-world experiences. <g> Bit
of a Catch-22 there. So, some entertainment...

From the .doc (Changes to Functionality in MS Windows XP SP2) from the
downloads site...

"Action required
None. Windows Firewall will automatically allow all outbound connections,
regardless of the program and the user context."

I'm not so sure I meant to laugh as hard as I did when I read that. I'm
pretty sure that it wasn't meant as a joke. I'm still shaking my head (MVP
or not) at the idea behind that one, the wording makes it seem as if
that's a feature. Ah well...

Yeah, I forgot about the outbound traffic issue; good point. I have ZA Free
5.5.094 running on my system, and it doesn't seem to present any problems.
Guess I'll go ahead and install that on hers. It is somewhat ironic since
I'm still inclined to believe that it was the inadvertent trial upgrade she
made to ZASecurity Suite, and it's subsequent expiration, that led to the
User Profile corruption in the first place. She thought she was doing the
right thing here (despite my telling her to never install anything without
checking with me first!), but as they say, 'the road to hell is paved with
good intentions.'

Thanks for the input.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Don Cohen]

Version 6.1.737 seems to be stable on my system, for what ever that's

worth.

I have 5.5.094 on mine, with no difficulties. I check ZoneLab's forums
periodically, and there's still a lot of moaning/groaning on any 6.x version
the last I checked, so it still seems to be a crap-shoot at this point.
Works fine for some, causes major problems for others.

I'll probably go with 5.5.094 on hers.

Thanks for the input.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Don Cohen]

Hi Plato

25 new viruses are released every single day. Teens who chat and
download files recommended to them by chat buddies are the first ones to
acquire the new bugs.

True. But I've instilled enough into her that other than MP3's, she knows
enough to not just casually accept files, or other downloads. I'm still
convinced that the User Profile corruption here resulted from her
inadvertently accepting the ZoneAlarmSecuritySuite Trial Upgrade, and its
subsequent expiration. But ultimately, who knows. I'll re-iterate this
with her, however.

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]

 

[Plato]

True. But I've instilled enough into her that other than MP3's, she knows
enough to not just casually accept files, or other downloads. I'm still
convinced that the User Profile corruption here resulted from her
inadvertently accepting the ZoneAlarmSecuritySuite Trial Upgrade, and its
subsequent expiration. But ultimately, who knows. I'll re-iterate this
with her, however.

Both my teens used to phark up their pcs always. And always figured I'd
be there to fix it ASAP even tho I warned then what NOT to do. So I let
their pc sit by my desk for a week and work on the house. Didnt' take
long for them to change their bad habits. Now, its' been a real long
time since either one of them got fried.

 

[Don Cohen]

Both my teens used to phark up their pcs always. And always figured I'd

be there to fix it ASAP even tho I warned then what NOT to do. So I let
their pc sit by my desk for a week and work on the house. Didnt' take
long for them to change their bad habits. Now, its' been a real long
time since either one of them got fried.

Very creative!

--
Don
Photo Website at:
http://www.dlcphotography.net

[Remove the "lens cap" for email]