Right Click on Folders Hangs Explorer 4

[quemquiseres]

OK, big problem here, I've tried everything and searched every possible forum but still no dice.
A few days ago I noticed that suddenly everytime i right click on a folder explorer hangs (I have to shut it down and restart it in task manager). Same behaviour if i just highlite a folder (left click) and then press delete on the keyboard. Now the strange thing is that i can right click files and delete them no problem. I've googled around and tried other people's solutions for this but still nothing.

http://www.hardwareanalysis.com/content/topic/7063/

http://ask.metafilter.com/mefi/4463

More info:
1) I can't system restore to a few weeks ago (i've tried 3 different restore points). I says system restore unable to complete after reboot and nothing changes.
2) I don't have Iomega burn or Eraser like other people that have had these symptoms
3) I've ran chkdsk with no probs, same with defrag and even system repair with the XP CD.
4) I've run RegSupreme and done a deep scrub of the registry still to no avail
5) I read somewhere that people were having similar probs because of Norton AV and probs with verisign certificates on Jan 8. I have NAV Pro 2003 and everything's up to date.
6) I've even updated to my latest Nvidia drivers (as some suggested) and still nothing.
Any help would be greatly appreciated as my system runs like a dream except for this recent bug (could it be some arcane registry key that's messing things up?). I'm out of ideas

 

[bcastner]

You did not mention your free disk space, nor the last time you defragmented or did a "Disk Cleanup."
No mentioned using the several recommended registry cleaners on this site.

I am not criticizing you, but do the two steps above, and then check for bad 'Send to' options in your context menus.

Odd things can lead to this behavior. linney noted recently that Zone Alarm can do this: thread779-620596

 

[bcastner]

And be sure to follow this guide:
"Slow performance may occur on a right-click..."

http://support.microsoft.com/default.aspx?scid=kb;en-us;819101

 

[mrainey]

One of the things to try, related to the verisign certificate problem is:


In Internet Explorer

Tools > Internet Options > Advanced

Scroll down to the Security section

Uncheck "Check for publisher's certificate revocation"


This worked for me.

 

[quemquiseres]

Thanks for the quick reply bcastner.
Don't worry, I'm not hypersensitive like many others and I do appreciate your help.
I have plenty of free disk space (around 30 gb),i clean my disk regularly (window washer everyday) and i defragged about a week ago (i'm thinking maybe that's when the problem started). i took a look at the other threads but i don't think they apply to my problem. (i've tried the knowledge base solution just in case and still no dice). The zone alarm thread is different because he actually gets the right click menu to show up. in my case i just get the hourglass (with folders only, files seem ok when i right click)and nothing happens. I have to kill explorer.exe from task manager (also not at 100% like with some other people, but idling) and restart it. Everything else seems to work well so i'm pretty much baffled and so far no one seems to be able to help.
Thanks again

 

[bcastner]

Do me a favor and do steps #2 and #3 in this FAQ: faq608-4650

 

[quemquiseres]

Thanks again bcastner,
I'll do those steps when I get home later (it's my home PC).
I do have NAV 2003 pro updated and did do a full system scan yesterday but will try the online scanners and the spyware removers (it's been awhile since i've run adaware).
I'll let you know later the results.
Thanks for your help, you too mrainey.

 

[linney]

First, try Bcastner's suggestion above with FAQ608-4650, if no luck, here are a few other thoughts.




It is worrying that System Restore is not working for you. As the main reason of that occurring is a problem with your machine at the selected time (your chosen restore point). System Restore will not restore to a point in time where your computer configuration is faulty.

Are there any clues in the Event Viewer?

Try it with any Virus Scanner disabled and see what happens. It may pay you to have a look around the "Knowledge Base" articles at the Symantic site.

http://www.symantec.com/techsupp/

http://www.symantec.com/techsupp/knowledge_base.html

Try Safe Mode (Do you have this problem in Safe Mode?).

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

If they don't work you could try repairing windows itself by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

 

[bcastner]

linney was the one who taught me that System Resoore can take enormous anmounts of disk space, and requires some use when installing new devices, Service Packs, etc.

I will condense linney's previous advice:

. System Restore is only able to resotre to a previous point if there is sufficient disk space;
. System Restore is only able to restore to a Known Good configuration setting
. System Restore does not restore everything; it is not a System "State Save", rather it preserves essentially critical OS files and registry changes.
. System Restore requires user maintenance. You can manually set a restore point. You can manually disable the System Restore prior to deframenting, chkdsk'ing or other drive maintenance; Service Pack installations (which offer usually, not always, their own un-restore option), and major hardware changes.

And you can manually clean unnecessary System Restore points with the Disk Cleanup tool, or just turning off - then on- System Restore on all drives.

 

[quemquiseres]

OK guys,
I've followed the online AV and spyware steps in the FAQ and found 1 trojan (backdoor.beasty) through housecall (thanks a lot NAV). TrendMicro deleted the file but strangely enough none of the associated registry entries were on my system. Adaware and Spybot also removed some spyware on my system but nothing major. Anyway, unfortuntaley the problem remains (except this time i left the hourglass on after right clicking and went for dinner, after I came back the context menu was there, so explorer isn't hanging or crashing, it just takes around 10 minutes to display the menu even though the folder in task manager is "not responding"; btw the "send to" option was there and working).
First some more system info (P4 2.4 512 MB DDR, XP Pro SP1 all patched) Ok now to answer some questions:
1) There is nothing in event viewer except my forced shutdown of explorer
2) i was finally able to restore to jan22 9i had to kill most processes that were apparently preventing it, or maybe the beasty trojan, who knows). Unfortunately the problem was still there. This means I have to start uninstalling all the programs I installed around that time (DVDXCopy Platinum might be the culprit) and go back one at a time or I have some hardware problem (i'll run chkdisk and scannow again and defrag once again just to make sure).
Anyway, I'll do all this tomorrow since it's getting late and i'll post here any progress. Thanks again for your help

 

[bcastner]

Post a Hijack This log here.

 

[bcastner]

I forgot:

http://mjc1.com/mirror/hjt/

 

[quemquiseres]

ok,I've removed NAV and DVDXCopy but the problem still remains. Here is my hijack log, the only thing which seems suspicious (to me at least)is the "O16 - DPF: {66666666-6666-6666-6600-000000000000} -" entry. Any further ideas would be welcome.
Anyone think that SP2 would help at all?

Thanks again


Logfile of HijackThis v1.97.7
Scan saved at 6:53:50 PM, on 2/3/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DC\DcrServ.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\DC\DC.exe
C:\Program Files\Washer\washer.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\ZoneAlarm\zaplus.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Documents and Settings\XXXXX\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 203.XX.XX.XX:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src" (C:\Documents and Settings\henripa\Application Data\Mozilla\Profiles\default\qsu5ov93.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [DriveCrypt Startup] C:\Program Files\DC\DC.exe /WS
O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: ZoneAlarm Plus.lnk = C:\Program Files\ZoneAlarm\zaplus.exe
O8 - Extra context menu item: &Define - C:\WINDOWS\Web\ERS_DEF.HTM
O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: &Search the Web - C:\WINDOWS\Web\ERS_SRC.HTM
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\WINDOWS\Web\ERS_ENC.HTM
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Conceptronic\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: @btrez.dll,-4015 (HKLM)
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: NeoTrace It! (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) -

http://tw.msi.com.tw/autobios/client/iftwclix.cab

O16 - DPF: {66666666-6666-6666-6600-000000000000} -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38017.4529166667

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

[linney]

I'm not a "Hijack This" log specialist, so I'll leave that to the experts.

You might find this article both confusing and interesting.

http://www.betanews.com/print.php3?sid=1048644448

815411 - Heap Algorithm Update for Atypically Large Heap Requests

http://support.microsoft.com/default.aspx?scid=kb;en-us;815411&FR=1&PA=1&SD=HSCH

Most Anti Virus software are just that, anti virus, they are not designed for Trojan or Worm scanning, although they will check for the more common and prevalent Trojans and Worms. A Google check will find you programs that handle these type of infections.

 

[quemquiseres]

Thanks linney,
I checked out the article but unfortunately MS doesn't go into any real detail about which program causes the heap corruption and they don't provide the hotfix so there isn't much I can do. I don't even know if that's my problem, I doubt it since I've had SP1 for a long time and my problem is fairly recent. i guess I should try to defrag again. Any suggestions for really good defrag software?
P.S. I'm still suspicious of that 6666 entry, specially since trendmicro caught the beasty trojan and 666 is the port it listened on and also the devil's number. I'll wait to see if anyone more knowledgeable gives me the green light to delete it. Failing that I guess I'm sh*t out of luck and found some uncommon bug in XP SP1.

 

[bcastner]

Please do steps #1 - #3 in FAQ faq608-4650.

For step #1, use Trend Micro or the Panda online antivirus scan.

 

[quemquiseres]

Ok, i ran through the steps again, this time with panda (I've also installed AVG, updated and scanned) everything is OK, that doesn't seem to be the problem. I'm still going to delete the "O16 - DPF: {66666666-6666-6666-6600-000000000000} -" key since I don't think it needs to be there anyway.
I'm thinking maybe that something isn't quite right after last defrag or maybe some kind of memory error (I have 768 as the max and min on my swap file). This really is bugging me, I'm beggining to think I'll never find what's wrong and will have to delete all my folders in DOS from now on.
Thanks for your help anyway

 

[bcastner]

Go ahead and let hijack remove the entry. I agree with you, it is suspcious.

 

[linney]

To get further information about the error look in your Event viewer.

Look in the System or Application folder. You can get to the Event Viewer via right click My Computer icon and select Manage.

Any errors logged in the Event Viewer can be expanded by double clicking on the error line.

Take any event error I.D. number and search for it on these sites.

http://www.microsoft.com/technet/tr.../prodtechnol/winxppro/support/EE_winxppro.asp

http://www.eventid.net/events.asp

To check your RAM.

http://www.memtest86.com/

http://oca.microsoft.com/en/windiag.asp

To check your drivers.

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

To check conflicting software.

310353 - How to Perform a Clean Boot in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310353&FR=1&PA=1&SD=HSCH

316434 - HOW TO: Perform Advanced Clean-Boot Troubleshooting in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;316434&FR=1&PA=1&SD=HSCH

Did you try Safe Mode with your problem (And what was the result?).

As for Defragging I usually perform that from a 2nd Windows Installation (used for testing and repairing and installed in another partition) over the drive where the main Windows installation runs from. This seems to give a tighter defrag than running it from within my main Windows.

Some people use Disk Keeper with varying results (see a search on this forum for threads about Disk Keeper). You can download it here.

http://www.lyonware.co.uk/Diskeeper-DOWNLOAD.htm

 

[Neroman]

Hi quemquiseres,

Don't know if this thread is dead or not, but as I have the same problem as you do, and can't find anything useful about it anywhere else, I'm grasping for straws here.

Have scanned, checked, defragged, disabled different AV-softwares etc in turns and done just about everything I can think of, but still no luck! Have you figured it out or read/heard anything that can be of any help?

Greatful for any help on this matter.