Explorer Not Responding and F-Secure Logs to Event Viewer

  • Thread starter Thread starter Charles Law
  • Start date Start date
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time ago.

JS

Charles Law said:
Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


JS said:
Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base on
shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are shown.
That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that F-Secure
is my 'slow-down' problem, so I might well ditch it and go with
something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the same
time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I can't
find out what is hanging it.

Charles


You need to find the specific sub-process or application running
under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU usage
(Highest to Lowest).
Then click on the process that's using most or all the CPU % the
highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need to
be expanded to show the detail,
(sub processes), in this case click on the + located to the left
of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers greatly
received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this time;
scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get Task
Manager and I see that Explorer has stopped responding. I end
task, and things come back to life, and thereafter the machine
runs sweetly, albeit most drivers are not loaded and services
are disabled. [Having said that, I just noticed that Explorer
hung again, but I ended the task and it came back to life
again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Charles Law said:
Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
I think I might be homing in. I followed your link, and the one that strikes a chord is the "buggy shell extension".

I have been using ShellEx for the last half-hour to disable all non-Microsoft shell extensions, and it seems to have stopped the hanging. I am now going to re-enable them one by one and see what breaks it. Below is a list of the extensions, for your information, and in case you spot something instantly. The Give4Free looks highly suspicious, so I'm going to Google for that now.

Thanks for sticking with me on this.

Charles

Shell Extensions List


Created by using ShellExView
Extension Name Disabled Type Description Version Product Name Company My Computer Desktop Control Panel Filename CLSID File Created Time CLSID Modified Time Microsoft File Extensions File Attributes File Size
CtMtpContextMenu Class Yes Context Menu CME ContextMenu Shell Extension 1.0.1.0 Creative Media Explorer Creative Technology Ltd No No No C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll {7895F317-A125-42CC-BD3E-5830765CE577} 14/09/2006 16:34:44 14/09/2006 16:39:11 No *, Folder 98,304
RealOne Player Context Menu Class Yes Context Menu RealOne Player Shell Extensions 1.0.0.447 RealOne Player RealNetworks No No No C:\Program Files\Real\RealPlayer\rpshellext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} 15/06/2004 17:23:05 22/07/2004 20:27:20 No .acp, .aif, .aiff, .au, .avi, .cda, .la1, .lar, .lavs, ..lmsff, .lqt, .m1v, .M2V, .m3u, .mnd, .mns, .mp1, .mp2, .mp3, .mpa, ..mpe, .mpeg, .mpg, .mpga, .mps, .mpv, .pls, .r3t, .ra, .ram, .rec, .rjs, ..rjt, .rm, .rmj, .rmm, .rmp, .rms, .rmvb, .rmx, .rp, .rsml, .rt, .rv, ..sdp, .smi, .smil, .ssm, .vpg, .wav, .xpl, pnm, rtsp, SSM A 45,105
MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 1.0.0.1020 Cinema CyberLink Corp. No No No c:\Apps\Powercinema\Video\CLMedia.dll {7F1A7DAC-CF44-453E-A03A-BCA52A80EAE4} 15/06/2004 17:21:27 22/07/2004 20:27:20 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 36,864
HyperTerminal Icon Ext Yes Icon Handler HyperTerminal Applet Library 5.1.2600.0 Microsoft® Windows® Operating System Hilgraeve, Inc. No No No C:\WINDOWS\System32\hticons.dll {88895560-9AA2-1069-930E-00AA0030EBC8} 19/09/2002 20:44:56 19/09/2002 21:37:58 No .ht, htfile A 44,544
RecordNow! SendToExt Yes Drop Handler Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04} 16/01/2004 06:00:00 15/06/2004 17:23:51 No .RecordNowSendToExt A 73,728
Monitor Class Yes Copy Hook Handler BTNCopy Module 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No No No C:\WINDOWS\System32\btncopy.dll {7842554E-6BED-11D2-8CDB-B05550C10000} 16/09/2003 18:51:34 16/02/2005 17:20:51 No Directory A 53,248
RecordNow! ContextMenuExt Yes Context Menu Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356} 16/01/2004 06:00:00 15/06/2004 17:23:51 No Drive A 73,728
Roxio DragToDisc Shell Extension Yes Property Sheet DirectCD Shell Extention DLL 6.2.0.134 Drag-to-Disc Roxio No No No C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll {5E44E225-A408-11CF-B581-008029601108} 09/12/2003 18:24:58 25/07/2004 16:15:32 No Drive A 262,144
My Bluetooth Places Yes Shell Folder BTNeighborhood DLL 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No Yes No C:\WINDOWS\System32\BTNEIG~1.DLL {6af09ec9-b429-11d4-a1fb-0090960218cb} 16/09/2003 19:13:16 12/07/2005 11:44:31 No A 790,611
My Media Yes Shell Folder Roxio AudioCentral Media Manager Shell Extension 1.1.277 AudioCentral Media Manager Roxio, Inc. No Yes No C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll {A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC} 15/07/2003 12:38:28 25/07/2004 16:16:26 No A 1,191,936
Nokia Phone Browser Yes Shell Folder Nokia Phone Browser 5, 0, 2, 33 Nokia Phone Browser Nokia Yes No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll {40950107-FEA6-4d53-A65F-B2DCBA57DD58} 17/04/2004 09:09:40 16/02/2005 18:23:26 No A 361,472
Zen MicroPhoto Media Explorer Yes Shell Folder Creative Shell Extension 5.2.16.0 Zen Media Explorer (MTP) Creative Technology Ltd Yes No No C:\Program Files\Creative\Creative Zen MicroPhoto\SHCTMTP.dll {4AFB2C12-9D16-4478-AEF4-C3FC539961E4} 14/09/2006 16:34:31 14/09/2006 16:39:13 No 704,512
RealSearch Yes Search Handler RealOne Player Search Shell Extension 6.0.9.35 RealOne Player (32-bit) RealNetworks, Inc. No No No C:\Program Files\Real\RealPlayer\rpshellsearch.dll {A06B0DBC-8272-4D72-A366-B8090BBE1871} 15/06/2004 17:23:21 22/07/2004 20:27:20 No A 49,207
AcroIEHlprObj Class Yes Browser Helper Object Adobe Acrobat IE Helper Version 6.0 for ActivieX 6.0.0.2003051500 AcroIEHelper Library Adobe Systems Incorporated No No No C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} 15/05/2003 00:47:54 22/07/2004 20:27:19 No A 50,376
Give4Free Plugin Installer Yes Browser Helper Object Give4Free Plugin 1, 0, 0, 1 Give4Free Plugin Give4Free Plugin No No No C:\Program Files\Give4Free Plugin\ibho.dll {208E7E77-507A-4649-B0C9-D39E9049C7A2} 13/09/2007 17:40:23 13/09/2007 17:40:23 No AH 34,304
Contact View Yes Shell Folder Nokia Phone Browser Contact View 5, 0, 0, 33 Nokia Phone Browser Contact View Nokia No No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll {FBFE7864-D495-41f0-B7DC-4BB601CC295E} 17/04/2004 09:16:20 16/02/2005 18:23:27 No A 339,456



JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
I can rule out Give4Free as I know how it got there. I used Windows
Messenger Remover today. The problem existed long before that, so I will
have to look at the others.

Charles


JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component
of Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note
that I do mean Windows Explorer, as distinct from the Explorer Program
Manager, even though they appear as the same process in Process Explorer.
It is only when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with
any of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top
might give you some help (move the mouse cursor over any spike in
the graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem
is that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I
can see that F-Secure has been madly logging to the
Application Event Log: Event 103 - "One of the scanners could
not scan because the definition database was not available at
this time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding.
I end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
RealSearch
RecordNow
Roxio
Nokia

All of the above bear investigation.

JS

I think I might be homing in. I followed your link, and the one that strikes a chord is the "buggy shell extension".

I have been using ShellEx for the last half-hour to disable all non-Microsoft shell extensions, and it seems to have stopped the hanging. I am now going to re-enable them one by one and see what breaks it. Below is a list of the extensions, for your information, and in case you spot something instantly. The Give4Free looks highly suspicious, so I'm going to Google for that now.

Thanks for sticking with me on this.

Charles

Shell Extensions List


Created by using ShellExView
Extension Name Disabled Type Description Version Product Name Company My Computer Desktop Control Panel Filename CLSID File Created Time CLSID Modified Time Microsoft File Extensions File Attributes File Size
CtMtpContextMenu Class Yes Context Menu CME ContextMenu Shell Extension 1.0.1.0 Creative Media Explorer Creative Technology Ltd No No No C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll {7895F317-A125-42CC-BD3E-5830765CE577} 14/09/2006 16:34:44 14/09/2006 16:39:11 No *, Folder 98,304
RealOne Player Context Menu Class Yes Context Menu RealOne Player Shell Extensions 1.0.0.447 RealOne Player RealNetworks No No No C:\Program Files\Real\RealPlayer\rpshellext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} 15/06/2004 17:23:05 22/07/2004 20:27:20 No .acp, .aif, .aiff, .au, .avi, .cda, .la1, .lar, .lavs, ..lmsff, .lqt, .m1v, .M2V, .m3u, .mnd, .mns, .mp1, .mp2, .mp3, .mpa, ..mpe, .mpeg, .mpg, .mpga, .mps, .mpv, .pls, .r3t, .ra, .ram, .rec, .rjs, ..rjt, .rm, .rmj, .rmm, .rmp, .rms, .rmvb, .rmx, .rp, .rsml, .rt, .rv, ..sdp, .smi, .smil, .ssm, .vpg, .wav, .xpl, pnm, rtsp, SSM A 45,105
MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 1.0.0.1020 Cinema CyberLink Corp. No No No c:\Apps\Powercinema\Video\CLMedia.dll {7F1A7DAC-CF44-453E-A03A-BCA52A80EAE4} 15/06/2004 17:21:27 22/07/2004 20:27:20 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 36,864
HyperTerminal Icon Ext Yes Icon Handler HyperTerminal Applet Library 5.1.2600.0 Microsoft® Windows® Operating System Hilgraeve, Inc. No No No C:\WINDOWS\System32\hticons.dll {88895560-9AA2-1069-930E-00AA0030EBC8} 19/09/2002 20:44:56 19/09/2002 21:37:58 No .ht, htfile A 44,544
RecordNow! SendToExt Yes Drop Handler Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04} 16/01/2004 06:00:00 15/06/2004 17:23:51 No .RecordNowSendToExt A 73,728
Monitor Class Yes Copy Hook Handler BTNCopy Module 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No No No C:\WINDOWS\System32\btncopy.dll {7842554E-6BED-11D2-8CDB-B05550C10000} 16/09/2003 18:51:34 16/02/2005 17:20:51 No Directory A 53,248
RecordNow! ContextMenuExt Yes Context Menu Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356} 16/01/2004 06:00:00 15/06/2004 17:23:51 No Drive A 73,728
Roxio DragToDisc Shell Extension Yes Property Sheet DirectCD Shell Extention DLL 6.2.0.134 Drag-to-Disc Roxio No No No C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll {5E44E225-A408-11CF-B581-008029601108} 09/12/2003 18:24:58 25/07/2004 16:15:32 No Drive A 262,144
My Bluetooth Places Yes Shell Folder BTNeighborhood DLL 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No Yes No C:\WINDOWS\System32\BTNEIG~1.DLL {6af09ec9-b429-11d4-a1fb-0090960218cb} 16/09/2003 19:13:16 12/07/2005 11:44:31 No A 790,611
My Media Yes Shell Folder Roxio AudioCentral Media Manager Shell Extension 1.1.277 AudioCentral Media Manager Roxio, Inc. No Yes No C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll {A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC} 15/07/2003 12:38:28 25/07/2004 16:16:26 No A 1,191,936
Nokia Phone Browser Yes Shell Folder Nokia Phone Browser 5, 0, 2, 33 Nokia Phone Browser Nokia Yes No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll {40950107-FEA6-4d53-A65F-B2DCBA57DD58} 17/04/2004 09:09:40 16/02/2005 18:23:26 No A 361,472
Zen MicroPhoto Media Explorer Yes Shell Folder Creative Shell Extension 5.2.16.0 Zen Media Explorer (MTP) Creative Technology Ltd Yes No No C:\Program Files\Creative\Creative Zen MicroPhoto\SHCTMTP.dll {4AFB2C12-9D16-4478-AEF4-C3FC539961E4} 14/09/2006 16:34:31 14/09/2006 16:39:13 No 704,512
RealSearch Yes Search Handler RealOne Player Search Shell Extension 6.0.9.35 RealOne Player (32-bit) RealNetworks, Inc. No No No C:\Program Files\Real\RealPlayer\rpshellsearch.dll {A06B0DBC-8272-4D72-A366-B8090BBE1871} 15/06/2004 17:23:21 22/07/2004 20:27:20 No A 49,207
AcroIEHlprObj Class Yes Browser Helper Object Adobe Acrobat IE Helper Version 6.0 for ActivieX 6.0.0.2003051500 AcroIEHelper Library Adobe Systems Incorporated No No No C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} 15/05/2003 00:47:54 22/07/2004 20:27:19 No A 50,376
Give4Free Plugin Installer Yes Browser Helper Object Give4Free Plugin 1, 0, 0, 1 Give4Free Plugin Give4Free Plugin No No No C:\Program Files\Give4Free Plugin\ibho.dll {208E7E77-507A-4649-B0C9-D39E9049C7A2} 13/09/2007 17:40:23 13/09/2007 17:40:23 No AH 34,304
Contact View Yes Shell Folder Nokia Phone Browser Contact View 5, 0, 0, 33 Nokia Phone Browser Contact View Nokia No No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll {FBFE7864-D495-41f0-B7DC-4BB601CC295E} 17/04/2004 09:16:20 16/02/2005 18:23:27 No A 339,456



JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
Also take note that Process Explorer is now at version 11.01 (bug fixes for 11.0)

JS

I think I might be homing in. I followed your link, and the one that strikes a chord is the "buggy shell extension".

I have been using ShellEx for the last half-hour to disable all non-Microsoft shell extensions, and it seems to have stopped the hanging. I am now going to re-enable them one by one and see what breaks it. Below is a list of the extensions, for your information, and in case you spot something instantly. The Give4Free looks highly suspicious, so I'm going to Google for that now.

Thanks for sticking with me on this.

Charles

Shell Extensions List


Created by using ShellExView
Extension Name Disabled Type Description Version Product Name Company My Computer Desktop Control Panel Filename CLSID File Created Time CLSID Modified Time Microsoft File Extensions File Attributes File Size
CtMtpContextMenu Class Yes Context Menu CME ContextMenu Shell Extension 1.0.1.0 Creative Media Explorer Creative Technology Ltd No No No C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll {7895F317-A125-42CC-BD3E-5830765CE577} 14/09/2006 16:34:44 14/09/2006 16:39:11 No *, Folder 98,304
RealOne Player Context Menu Class Yes Context Menu RealOne Player Shell Extensions 1.0.0.447 RealOne Player RealNetworks No No No C:\Program Files\Real\RealPlayer\rpshellext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} 15/06/2004 17:23:05 22/07/2004 20:27:20 No .acp, .aif, .aiff, .au, .avi, .cda, .la1, .lar, .lavs, ..lmsff, .lqt, .m1v, .M2V, .m3u, .mnd, .mns, .mp1, .mp2, .mp3, .mpa, ..mpe, .mpeg, .mpg, .mpga, .mps, .mpv, .pls, .r3t, .ra, .ram, .rec, .rjs, ..rjt, .rm, .rmj, .rmm, .rmp, .rms, .rmvb, .rmx, .rp, .rsml, .rt, .rv, ..sdp, .smi, .smil, .ssm, .vpg, .wav, .xpl, pnm, rtsp, SSM A 45,105
MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 1.0.0.1020 Cinema CyberLink Corp. No No No c:\Apps\Powercinema\Video\CLMedia.dll {7F1A7DAC-CF44-453E-A03A-BCA52A80EAE4} 15/06/2004 17:21:27 22/07/2004 20:27:20 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 36,864
HyperTerminal Icon Ext Yes Icon Handler HyperTerminal Applet Library 5.1.2600.0 Microsoft® Windows® Operating System Hilgraeve, Inc. No No No C:\WINDOWS\System32\hticons.dll {88895560-9AA2-1069-930E-00AA0030EBC8} 19/09/2002 20:44:56 19/09/2002 21:37:58 No .ht, htfile A 44,544
RecordNow! SendToExt Yes Drop Handler Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04} 16/01/2004 06:00:00 15/06/2004 17:23:51 No .RecordNowSendToExt A 73,728
Monitor Class Yes Copy Hook Handler BTNCopy Module 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No No No C:\WINDOWS\System32\btncopy.dll {7842554E-6BED-11D2-8CDB-B05550C10000} 16/09/2003 18:51:34 16/02/2005 17:20:51 No Directory A 53,248
RecordNow! ContextMenuExt Yes Context Menu Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356} 16/01/2004 06:00:00 15/06/2004 17:23:51 No Drive A 73,728
Roxio DragToDisc Shell Extension Yes Property Sheet DirectCD Shell Extention DLL 6.2.0.134 Drag-to-Disc Roxio No No No C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll {5E44E225-A408-11CF-B581-008029601108} 09/12/2003 18:24:58 25/07/2004 16:15:32 No Drive A 262,144
My Bluetooth Places Yes Shell Folder BTNeighborhood DLL 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No Yes No C:\WINDOWS\System32\BTNEIG~1.DLL {6af09ec9-b429-11d4-a1fb-0090960218cb} 16/09/2003 19:13:16 12/07/2005 11:44:31 No A 790,611
My Media Yes Shell Folder Roxio AudioCentral Media Manager Shell Extension 1.1.277 AudioCentral Media Manager Roxio, Inc. No Yes No C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll {A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC} 15/07/2003 12:38:28 25/07/2004 16:16:26 No A 1,191,936
Nokia Phone Browser Yes Shell Folder Nokia Phone Browser 5, 0, 2, 33 Nokia Phone Browser Nokia Yes No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll {40950107-FEA6-4d53-A65F-B2DCBA57DD58} 17/04/2004 09:09:40 16/02/2005 18:23:26 No A 361,472
Zen MicroPhoto Media Explorer Yes Shell Folder Creative Shell Extension 5.2.16.0 Zen Media Explorer (MTP) Creative Technology Ltd Yes No No C:\Program Files\Creative\Creative Zen MicroPhoto\SHCTMTP.dll {4AFB2C12-9D16-4478-AEF4-C3FC539961E4} 14/09/2006 16:34:31 14/09/2006 16:39:13 No 704,512
RealSearch Yes Search Handler RealOne Player Search Shell Extension 6.0.9.35 RealOne Player (32-bit) RealNetworks, Inc. No No No C:\Program Files\Real\RealPlayer\rpshellsearch.dll {A06B0DBC-8272-4D72-A366-B8090BBE1871} 15/06/2004 17:23:21 22/07/2004 20:27:20 No A 49,207
AcroIEHlprObj Class Yes Browser Helper Object Adobe Acrobat IE Helper Version 6.0 for ActivieX 6.0.0.2003051500 AcroIEHelper Library Adobe Systems Incorporated No No No C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} 15/05/2003 00:47:54 22/07/2004 20:27:19 No A 50,376
Give4Free Plugin Installer Yes Browser Helper Object Give4Free Plugin 1, 0, 0, 1 Give4Free Plugin Give4Free Plugin No No No C:\Program Files\Give4Free Plugin\ibho.dll {208E7E77-507A-4649-B0C9-D39E9049C7A2} 13/09/2007 17:40:23 13/09/2007 17:40:23 No AH 34,304
Contact View Yes Shell Folder Nokia Phone Browser Contact View 5, 0, 0, 33 Nokia Phone Browser Contact View Nokia No No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll {FBFE7864-D495-41f0-B7DC-4BB601CC295E} 17/04/2004 09:16:20 16/02/2005 18:23:27 No A 339,456



JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
I check periodically for updates, but missed the update to 11.

Charles

Also take note that Process Explorer is now at version 11.01 (bug fixes for 11.0)

JS

I think I might be homing in. I followed your link, and the one that strikes a chord is the "buggy shell extension".

I have been using ShellEx for the last half-hour to disable all non-Microsoft shell extensions, and it seems to have stopped the hanging. I am now going to re-enable them one by one and see what breaks it. Below is a list of the extensions, for your information, and in case you spot something instantly. The Give4Free looks highly suspicious, so I'm going to Google for that now.

Thanks for sticking with me on this.

Charles

Shell Extensions List


Created by using ShellExView
Extension Name Disabled Type Description Version Product Name Company My Computer Desktop Control Panel Filename CLSID File Created Time CLSID Modified Time Microsoft File Extensions File Attributes File Size
CtMtpContextMenu Class Yes Context Menu CME ContextMenu Shell Extension 1.0.1.0 Creative Media Explorer Creative Technology Ltd No No No C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll {7895F317-A125-42CC-BD3E-5830765CE577} 14/09/2006 16:34:44 14/09/2006 16:39:11 No *, Folder 98,304
RealOne Player Context Menu Class Yes Context Menu RealOne Player Shell Extensions 1.0.0.447 RealOne Player RealNetworks No No No C:\Program Files\Real\RealPlayer\rpshellext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} 15/06/2004 17:23:05 22/07/2004 20:27:20 No .acp, .aif, .aiff, .au, .avi, .cda, .la1, .lar, .lavs, ..lmsff, .lqt, .m1v, .M2V, .m3u, .mnd, .mns, .mp1, .mp2, .mp3, .mpa, ..mpe, .mpeg, .mpg, .mpga, .mps, .mpv, .pls, .r3t, .ra, .ram, .rec, .rjs, ..rjt, .rm, .rmj, .rmm, .rmp, .rms, .rmvb, .rmx, .rp, .rsml, .rt, .rv, ..sdp, .smi, .smil, .ssm, .vpg, .wav, .xpl, pnm, rtsp, SSM A 45,105
MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 1.0.0.1020 Cinema CyberLink Corp. No No No c:\Apps\Powercinema\Video\CLMedia.dll {7F1A7DAC-CF44-453E-A03A-BCA52A80EAE4} 15/06/2004 17:21:27 22/07/2004 20:27:20 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 36,864
HyperTerminal Icon Ext Yes Icon Handler HyperTerminal Applet Library 5.1.2600.0 Microsoft® Windows® Operating System Hilgraeve, Inc. No No No C:\WINDOWS\System32\hticons.dll {88895560-9AA2-1069-930E-00AA0030EBC8} 19/09/2002 20:44:56 19/09/2002 21:37:58 No .ht, htfile A 44,544
RecordNow! SendToExt Yes Drop Handler Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04} 16/01/2004 06:00:00 15/06/2004 17:23:51 No .RecordNowSendToExt A 73,728
Monitor Class Yes Copy Hook Handler BTNCopy Module 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No No No C:\WINDOWS\System32\btncopy.dll {7842554E-6BED-11D2-8CDB-B05550C10000} 16/09/2003 18:51:34 16/02/2005 17:20:51 No Directory A 53,248
RecordNow! ContextMenuExt Yes Context Menu Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356} 16/01/2004 06:00:00 15/06/2004 17:23:51 No Drive A 73,728
Roxio DragToDisc Shell Extension Yes Property Sheet DirectCD Shell Extention DLL 6.2.0.134 Drag-to-Disc Roxio No No No C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll {5E44E225-A408-11CF-B581-008029601108} 09/12/2003 18:24:58 25/07/2004 16:15:32 No Drive A 262,144
My Bluetooth Places Yes Shell Folder BTNeighborhood DLL 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No Yes No C:\WINDOWS\System32\BTNEIG~1.DLL {6af09ec9-b429-11d4-a1fb-0090960218cb} 16/09/2003 19:13:16 12/07/2005 11:44:31 No A 790,611
My Media Yes Shell Folder Roxio AudioCentral Media Manager Shell Extension 1.1.277 AudioCentral Media Manager Roxio, Inc. No Yes No C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll {A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC} 15/07/2003 12:38:28 25/07/2004 16:16:26 No A 1,191,936
Nokia Phone Browser Yes Shell Folder Nokia Phone Browser 5, 0, 2, 33 Nokia Phone Browser Nokia Yes No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll {40950107-FEA6-4d53-A65F-B2DCBA57DD58} 17/04/2004 09:09:40 16/02/2005 18:23:26 No A 361,472
Zen MicroPhoto Media Explorer Yes Shell Folder Creative Shell Extension 5.2.16.0 Zen Media Explorer (MTP) Creative Technology Ltd Yes No No C:\Program Files\Creative\Creative Zen MicroPhoto\SHCTMTP.dll {4AFB2C12-9D16-4478-AEF4-C3FC539961E4} 14/09/2006 16:34:31 14/09/2006 16:39:13 No 704,512
RealSearch Yes Search Handler RealOne Player Search Shell Extension 6.0.9.35 RealOne Player (32-bit) RealNetworks, Inc. No No No C:\Program Files\Real\RealPlayer\rpshellsearch.dll {A06B0DBC-8272-4D72-A366-B8090BBE1871} 15/06/2004 17:23:21 22/07/2004 20:27:20 No A 49,207
AcroIEHlprObj Class Yes Browser Helper Object Adobe Acrobat IE Helper Version 6.0 for ActivieX 6.0.0.2003051500 AcroIEHelper Library Adobe Systems Incorporated No No No C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} 15/05/2003 00:47:54 22/07/2004 20:27:19 No A 50,376
Give4Free Plugin Installer Yes Browser Helper Object Give4Free Plugin 1, 0, 0, 1 Give4Free Plugin Give4Free Plugin No No No C:\Program Files\Give4Free Plugin\ibho.dll {208E7E77-507A-4649-B0C9-D39E9049C7A2} 13/09/2007 17:40:23 13/09/2007 17:40:23 No AH 34,304
Contact View Yes Shell Folder Nokia Phone Browser Contact View 5, 0, 0, 33 Nokia Phone Browser Contact View Nokia No No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll {FBFE7864-D495-41f0-B7DC-4BB601CC295E} 17/04/2004 09:16:20 16/02/2005 18:23:27 No A 339,456



JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
I have been suspicious of Roxio in the past, not because it is dangerous in itself, but there have been many reports of its incompatibility with other programs.

I'll check each of these carefully and report back.

Charles

RealSearch
RecordNow
Roxio
Nokia

All of the above bear investigation.

JS

I think I might be homing in. I followed your link, and the one that strikes a chord is the "buggy shell extension".

I have been using ShellEx for the last half-hour to disable all non-Microsoft shell extensions, and it seems to have stopped the hanging. I am now going to re-enable them one by one and see what breaks it. Below is a list of the extensions, for your information, and in case you spot something instantly. The Give4Free looks highly suspicious, so I'm going to Google for that now.

Thanks for sticking with me on this.

Charles

Shell Extensions List


Created by using ShellExView
Extension Name Disabled Type Description Version Product Name Company My Computer Desktop Control Panel Filename CLSID File Created Time CLSID Modified Time Microsoft File Extensions File Attributes File Size
CtMtpContextMenu Class Yes Context Menu CME ContextMenu Shell Extension 1.0.1.0 Creative Media Explorer Creative Technology Ltd No No No C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll {7895F317-A125-42CC-BD3E-5830765CE577} 14/09/2006 16:34:44 14/09/2006 16:39:11 No *, Folder 98,304
RealOne Player Context Menu Class Yes Context Menu RealOne Player Shell Extensions 1.0.0.447 RealOne Player RealNetworks No No No C:\Program Files\Real\RealPlayer\rpshellext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} 15/06/2004 17:23:05 22/07/2004 20:27:20 No .acp, .aif, .aiff, .au, .avi, .cda, .la1, .lar, .lavs, ..lmsff, .lqt, .m1v, .M2V, .m3u, .mnd, .mns, .mp1, .mp2, .mp3, .mpa, ..mpe, .mpeg, .mpg, .mpga, .mps, .mpv, .pls, .r3t, .ra, .ram, .rec, .rjs, ..rjt, .rm, .rmj, .rmm, .rmp, .rms, .rmvb, .rmx, .rp, .rsml, .rt, .rv, ..sdp, .smi, .smil, .ssm, .vpg, .wav, .xpl, pnm, rtsp, SSM A 45,105
MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 1.0.0.1020 Cinema CyberLink Corp. No No No c:\Apps\Powercinema\Video\CLMedia.dll {7F1A7DAC-CF44-453E-A03A-BCA52A80EAE4} 15/06/2004 17:21:27 22/07/2004 20:27:20 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 36,864
HyperTerminal Icon Ext Yes Icon Handler HyperTerminal Applet Library 5.1.2600.0 Microsoft® Windows® Operating System Hilgraeve, Inc. No No No C:\WINDOWS\System32\hticons.dll {88895560-9AA2-1069-930E-00AA0030EBC8} 19/09/2002 20:44:56 19/09/2002 21:37:58 No .ht, htfile A 44,544
RecordNow! SendToExt Yes Drop Handler Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04} 16/01/2004 06:00:00 15/06/2004 17:23:51 No .RecordNowSendToExt A 73,728
Monitor Class Yes Copy Hook Handler BTNCopy Module 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No No No C:\WINDOWS\System32\btncopy.dll {7842554E-6BED-11D2-8CDB-B05550C10000} 16/09/2003 18:51:34 16/02/2005 17:20:51 No Directory A 53,248
RecordNow! ContextMenuExt Yes Context Menu Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356} 16/01/2004 06:00:00 15/06/2004 17:23:51 No Drive A 73,728
Roxio DragToDisc Shell Extension Yes Property Sheet DirectCD Shell Extention DLL 6.2.0.134 Drag-to-Disc Roxio No No No C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll {5E44E225-A408-11CF-B581-008029601108} 09/12/2003 18:24:58 25/07/2004 16:15:32 No Drive A 262,144
My Bluetooth Places Yes Shell Folder BTNeighborhood DLL 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No Yes No C:\WINDOWS\System32\BTNEIG~1.DLL {6af09ec9-b429-11d4-a1fb-0090960218cb} 16/09/2003 19:13:16 12/07/2005 11:44:31 No A 790,611
My Media Yes Shell Folder Roxio AudioCentral Media Manager Shell Extension 1.1.277 AudioCentral Media Manager Roxio, Inc. No Yes No C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll {A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC} 15/07/2003 12:38:28 25/07/2004 16:16:26 No A 1,191,936
Nokia Phone Browser Yes Shell Folder Nokia Phone Browser 5, 0, 2, 33 Nokia Phone Browser Nokia Yes No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll {40950107-FEA6-4d53-A65F-B2DCBA57DD58} 17/04/2004 09:09:40 16/02/2005 18:23:26 No A 361,472
Zen MicroPhoto Media Explorer Yes Shell Folder Creative Shell Extension 5.2.16.0 Zen Media Explorer (MTP) Creative Technology Ltd Yes No No C:\Program Files\Creative\Creative Zen MicroPhoto\SHCTMTP.dll {4AFB2C12-9D16-4478-AEF4-C3FC539961E4} 14/09/2006 16:34:31 14/09/2006 16:39:13 No 704,512
RealSearch Yes Search Handler RealOne Player Search Shell Extension 6.0.9.35 RealOne Player (32-bit) RealNetworks, Inc. No No No C:\Program Files\Real\RealPlayer\rpshellsearch.dll {A06B0DBC-8272-4D72-A366-B8090BBE1871} 15/06/2004 17:23:21 22/07/2004 20:27:20 No A 49,207
AcroIEHlprObj Class Yes Browser Helper Object Adobe Acrobat IE Helper Version 6.0 for ActivieX 6.0.0.2003051500 AcroIEHelper Library Adobe Systems Incorporated No No No C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} 15/05/2003 00:47:54 22/07/2004 20:27:19 No A 50,376
Give4Free Plugin Installer Yes Browser Helper Object Give4Free Plugin 1, 0, 0, 1 Give4Free Plugin Give4Free Plugin No No No C:\Program Files\Give4Free Plugin\ibho.dll {208E7E77-507A-4649-B0C9-D39E9049C7A2} 13/09/2007 17:40:23 13/09/2007 17:40:23 No AH 34,304
Contact View Yes Shell Folder Nokia Phone Browser Contact View 5, 0, 0, 33 Nokia Phone Browser Contact View Nokia No No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll {FBFE7864-D495-41f0-B7DC-4BB601CC295E} 17/04/2004 09:16:20 16/02/2005 18:23:27 No A 339,456



JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
Ok. I am now 99% sure that the problem is Acrobat. Specifically, AcroIEHelper. I enabled everything in turn, separately, and the problem magically re-appeared when I re-enabled the Acrobat BHO. It was version 6.0, and was marked as a system component in the registry, so it was not straight forward to remove, but I have done it now. The problem has gone away.

But then, I had the idea that I would put the latest - V8 - Acrobat Reader on to the machine, and what do you know, the problem is back again. Only now, ShellEx is unable to disable the AcroIEHelper BHO.

What ever the problem is, you would have thought that Adobe would have fixed it by now, but no.

Charles

RealSearch
RecordNow
Roxio
Nokia

All of the above bear investigation.

JS

I think I might be homing in. I followed your link, and the one that strikes a chord is the "buggy shell extension".

I have been using ShellEx for the last half-hour to disable all non-Microsoft shell extensions, and it seems to have stopped the hanging. I am now going to re-enable them one by one and see what breaks it. Below is a list of the extensions, for your information, and in case you spot something instantly. The Give4Free looks highly suspicious, so I'm going to Google for that now.

Thanks for sticking with me on this.

Charles

Shell Extensions List


Created by using ShellExView
Extension Name Disabled Type Description Version Product Name Company My Computer Desktop Control Panel Filename CLSID File Created Time CLSID Modified Time Microsoft File Extensions File Attributes File Size
CtMtpContextMenu Class Yes Context Menu CME ContextMenu Shell Extension 1.0.1.0 Creative Media Explorer Creative Technology Ltd No No No C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll {7895F317-A125-42CC-BD3E-5830765CE577} 14/09/2006 16:34:44 14/09/2006 16:39:11 No *, Folder 98,304
RealOne Player Context Menu Class Yes Context Menu RealOne Player Shell Extensions 1.0.0.447 RealOne Player RealNetworks No No No C:\Program Files\Real\RealPlayer\rpshellext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} 15/06/2004 17:23:05 22/07/2004 20:27:20 No .acp, .aif, .aiff, .au, .avi, .cda, .la1, .lar, .lavs, ..lmsff, .lqt, .m1v, .M2V, .m3u, .mnd, .mns, .mp1, .mp2, .mp3, .mpa, ..mpe, .mpeg, .mpg, .mpga, .mps, .mpv, .pls, .r3t, .ra, .ram, .rec, .rjs, ..rjt, .rm, .rmj, .rmm, .rmp, .rms, .rmvb, .rmx, .rp, .rsml, .rt, .rv, ..sdp, .smi, .smil, .ssm, .vpg, .wav, .xpl, pnm, rtsp, SSM A 45,105
MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 1.0.0.1020 Cinema CyberLink Corp. No No No c:\Apps\Powercinema\Video\CLMedia.dll {7F1A7DAC-CF44-453E-A03A-BCA52A80EAE4} 15/06/2004 17:21:27 22/07/2004 20:27:20 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 36,864
HyperTerminal Icon Ext Yes Icon Handler HyperTerminal Applet Library 5.1.2600.0 Microsoft® Windows® Operating System Hilgraeve, Inc. No No No C:\WINDOWS\System32\hticons.dll {88895560-9AA2-1069-930E-00AA0030EBC8} 19/09/2002 20:44:56 19/09/2002 21:37:58 No .ht, htfile A 44,544
RecordNow! SendToExt Yes Drop Handler Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04} 16/01/2004 06:00:00 15/06/2004 17:23:51 No .RecordNowSendToExt A 73,728
Monitor Class Yes Copy Hook Handler BTNCopy Module 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No No No C:\WINDOWS\System32\btncopy.dll {7842554E-6BED-11D2-8CDB-B05550C10000} 16/09/2003 18:51:34 16/02/2005 17:20:51 No Directory A 53,248
RecordNow! ContextMenuExt Yes Context Menu Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356} 16/01/2004 06:00:00 15/06/2004 17:23:51 No Drive A 73,728
Roxio DragToDisc Shell Extension Yes Property Sheet DirectCD Shell Extention DLL 6.2.0.134 Drag-to-Disc Roxio No No No C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll {5E44E225-A408-11CF-B581-008029601108} 09/12/2003 18:24:58 25/07/2004 16:15:32 No Drive A 262,144
My Bluetooth Places Yes Shell Folder BTNeighborhood DLL 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No Yes No C:\WINDOWS\System32\BTNEIG~1.DLL {6af09ec9-b429-11d4-a1fb-0090960218cb} 16/09/2003 19:13:16 12/07/2005 11:44:31 No A 790,611
My Media Yes Shell Folder Roxio AudioCentral Media Manager Shell Extension 1.1.277 AudioCentral Media Manager Roxio, Inc. No Yes No C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll {A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC} 15/07/2003 12:38:28 25/07/2004 16:16:26 No A 1,191,936
Nokia Phone Browser Yes Shell Folder Nokia Phone Browser 5, 0, 2, 33 Nokia Phone Browser Nokia Yes No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll {40950107-FEA6-4d53-A65F-B2DCBA57DD58} 17/04/2004 09:09:40 16/02/2005 18:23:26 No A 361,472
Zen MicroPhoto Media Explorer Yes Shell Folder Creative Shell Extension 5.2.16.0 Zen Media Explorer (MTP) Creative Technology Ltd Yes No No C:\Program Files\Creative\Creative Zen MicroPhoto\SHCTMTP.dll {4AFB2C12-9D16-4478-AEF4-C3FC539961E4} 14/09/2006 16:34:31 14/09/2006 16:39:13 No 704,512
RealSearch Yes Search Handler RealOne Player Search Shell Extension 6.0.9.35 RealOne Player (32-bit) RealNetworks, Inc. No No No C:\Program Files\Real\RealPlayer\rpshellsearch.dll {A06B0DBC-8272-4D72-A366-B8090BBE1871} 15/06/2004 17:23:21 22/07/2004 20:27:20 No A 49,207
AcroIEHlprObj Class Yes Browser Helper Object Adobe Acrobat IE Helper Version 6.0 for ActivieX 6.0.0.2003051500 AcroIEHelper Library Adobe Systems Incorporated No No No C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} 15/05/2003 00:47:54 22/07/2004 20:27:19 No A 50,376
Give4Free Plugin Installer Yes Browser Helper Object Give4Free Plugin 1, 0, 0, 1 Give4Free Plugin Give4Free Plugin No No No C:\Program Files\Give4Free Plugin\ibho.dll {208E7E77-507A-4649-B0C9-D39E9049C7A2} 13/09/2007 17:40:23 13/09/2007 17:40:23 No AH 34,304
Contact View Yes Shell Folder Nokia Phone Browser Contact View 5, 0, 0, 33 Nokia Phone Browser Contact View Nokia No No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll {FBFE7864-D495-41f0-B7DC-4BB601CC295E} 17/04/2004 09:16:20 16/02/2005 18:23:27 No A 339,456



JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
I have the same BHO installed and have no problems, however there is a utility available from SysInternals called 'AutoRuns' which can be used to disable almost anything.
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

JS
Ok. I am now 99% sure that the problem is Acrobat. Specifically, AcroIEHelper. I enabled everything in turn, separately, and the problem magically re-appeared when I re-enabled the Acrobat BHO. It was version 6.0, and was marked as a system component in the registry, so it was not straight forward to remove, but I have done it now. The problem has gone away.

But then, I had the idea that I would put the latest - V8 - Acrobat Reader on to the machine, and what do you know, the problem is back again. Only now, ShellEx is unable to disable the AcroIEHelper BHO.

What ever the problem is, you would have thought that Adobe would have fixed it by now, but no.

Charles

RealSearch
RecordNow
Roxio
Nokia

All of the above bear investigation.

JS

I think I might be homing in. I followed your link, and the one that strikes a chord is the "buggy shell extension".

I have been using ShellEx for the last half-hour to disable all non-Microsoft shell extensions, and it seems to have stopped the hanging. I am now going to re-enable them one by one and see what breaks it. Below is a list of the extensions, for your information, and in case you spot something instantly. The Give4Free looks highly suspicious, so I'm going to Google for that now.

Thanks for sticking with me on this.

Charles

Shell Extensions List


Created by using ShellExView
Extension Name Disabled Type Description Version Product Name Company My Computer Desktop Control Panel Filename CLSID File Created Time CLSID Modified Time Microsoft File Extensions File Attributes File Size
CtMtpContextMenu Class Yes Context Menu CME ContextMenu Shell Extension 1.0.1.0 Creative Media Explorer Creative Technology Ltd No No No C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll {7895F317-A125-42CC-BD3E-5830765CE577} 14/09/2006 16:34:44 14/09/2006 16:39:11 No *, Folder 98,304
RealOne Player Context Menu Class Yes Context Menu RealOne Player Shell Extensions 1.0.0.447 RealOne Player RealNetworks No No No C:\Program Files\Real\RealPlayer\rpshellext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} 15/06/2004 17:23:05 22/07/2004 20:27:20 No .acp, .aif, .aiff, .au, .avi, .cda, .la1, .lar, .lavs, ..lmsff, .lqt, .m1v, .M2V, .m3u, .mnd, .mns, .mp1, .mp2, .mp3, .mpa, ..mpe, .mpeg, .mpg, .mpga, .mps, .mpv, .pls, .r3t, .ra, .ram, .rec, .rjs, ..rjt, .rm, .rmj, .rmm, .rmp, .rms, .rmvb, .rmx, .rp, .rsml, .rt, .rv, ..sdp, .smi, .smil, .ssm, .vpg, .wav, .xpl, pnm, rtsp, SSM A 45,105
MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 1.0.0.1020 Cinema CyberLink Corp. No No No c:\Apps\Powercinema\Video\CLMedia.dll {7F1A7DAC-CF44-453E-A03A-BCA52A80EAE4} 15/06/2004 17:21:27 22/07/2004 20:27:20 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 36,864
HyperTerminal Icon Ext Yes Icon Handler HyperTerminal Applet Library 5.1.2600.0 Microsoft® Windows® Operating System Hilgraeve, Inc. No No No C:\WINDOWS\System32\hticons.dll {88895560-9AA2-1069-930E-00AA0030EBC8} 19/09/2002 20:44:56 19/09/2002 21:37:58 No .ht, htfile A 44,544
RecordNow! SendToExt Yes Drop Handler Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04} 16/01/2004 06:00:00 15/06/2004 17:23:51 No .RecordNowSendToExt A 73,728
Monitor Class Yes Copy Hook Handler BTNCopy Module 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No No No C:\WINDOWS\System32\btncopy.dll {7842554E-6BED-11D2-8CDB-B05550C10000} 16/09/2003 18:51:34 16/02/2005 17:20:51 No Directory A 53,248
RecordNow! ContextMenuExt Yes Context Menu Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356} 16/01/2004 06:00:00 15/06/2004 17:23:51 No Drive A 73,728
Roxio DragToDisc Shell Extension Yes Property Sheet DirectCD Shell Extention DLL 6.2.0.134 Drag-to-Disc Roxio No No No C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll {5E44E225-A408-11CF-B581-008029601108} 09/12/2003 18:24:58 25/07/2004 16:15:32 No Drive A 262,144
My Bluetooth Places Yes Shell Folder BTNeighborhood DLL 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No Yes No C:\WINDOWS\System32\BTNEIG~1.DLL {6af09ec9-b429-11d4-a1fb-0090960218cb} 16/09/2003 19:13:16 12/07/2005 11:44:31 No A 790,611
My Media Yes Shell Folder Roxio AudioCentral Media Manager Shell Extension 1.1.277 AudioCentral Media Manager Roxio, Inc. No Yes No C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll {A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC} 15/07/2003 12:38:28 25/07/2004 16:16:26 No A 1,191,936
Nokia Phone Browser Yes Shell Folder Nokia Phone Browser 5, 0, 2, 33 Nokia Phone Browser Nokia Yes No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll {40950107-FEA6-4d53-A65F-B2DCBA57DD58} 17/04/2004 09:09:40 16/02/2005 18:23:26 No A 361,472
Zen MicroPhoto Media Explorer Yes Shell Folder Creative Shell Extension 5.2.16.0 Zen Media Explorer (MTP) Creative Technology Ltd Yes No No C:\Program Files\Creative\Creative Zen MicroPhoto\SHCTMTP.dll {4AFB2C12-9D16-4478-AEF4-C3FC539961E4} 14/09/2006 16:34:31 14/09/2006 16:39:13 No 704,512
RealSearch Yes Search Handler RealOne Player Search Shell Extension 6.0.9.35 RealOne Player (32-bit) RealNetworks, Inc. No No No C:\Program Files\Real\RealPlayer\rpshellsearch.dll {A06B0DBC-8272-4D72-A366-B8090BBE1871} 15/06/2004 17:23:21 22/07/2004 20:27:20 No A 49,207
AcroIEHlprObj Class Yes Browser Helper Object Adobe Acrobat IE Helper Version 6.0 for ActivieX 6.0.0.2003051500 AcroIEHelper Library Adobe Systems Incorporated No No No C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} 15/05/2003 00:47:54 22/07/2004 20:27:19 No A 50,376
Give4Free Plugin Installer Yes Browser Helper Object Give4Free Plugin 1, 0, 0, 1 Give4Free Plugin Give4Free Plugin No No No C:\Program Files\Give4Free Plugin\ibho.dll {208E7E77-507A-4649-B0C9-D39E9049C7A2} 13/09/2007 17:40:23 13/09/2007 17:40:23 No AH 34,304
Contact View Yes Shell Folder Nokia Phone Browser Contact View 5, 0, 0, 33 Nokia Phone Browser Contact View Nokia No No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll {FBFE7864-D495-41f0-B7DC-4BB601CC295E} 17/04/2004 09:16:20 16/02/2005 18:23:27 No A 339,456



JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
Yes, I tried that but it still seems to get locked by something, even though it claims to have been disabled.

I also have the same BHO on my main machine, and no problems. I suppose the possibility is that it interacts with something else that is being loaded. If that is the case, I don't see how I can ever track it down, as it could involve checking all combinations of all 15 or so other loaded shell extensions.

I am going to have to admit defeat on this one. It has taken me too long already and although I can make it hang pretty reliably, I suspect that in normal use the owner of the machine might not experience it too often. If it proves to be a continuing problem I will have to have another go, but for now ...

Thanks very much for all your help.

Cheers

Charles

I have the same BHO installed and have no problems, however there is a utility available from SysInternals called 'AutoRuns' which can be used to disable almost anything.
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

JS
Ok. I am now 99% sure that the problem is Acrobat. Specifically, AcroIEHelper. I enabled everything in turn, separately, and the problem magically re-appeared when I re-enabled the Acrobat BHO. It was version 6.0, and was marked as a system component in the registry, so it was not straight forward to remove, but I have done it now. The problem has gone away.

But then, I had the idea that I would put the latest - V8 - Acrobat Reader on to the machine, and what do you know, the problem is back again. Only now, ShellEx is unable to disable the AcroIEHelper BHO.

What ever the problem is, you would have thought that Adobe would have fixed it by now, but no.

Charles

RealSearch
RecordNow
Roxio
Nokia

All of the above bear investigation.

JS

I think I might be homing in. I followed your link, and the one that strikes a chord is the "buggy shell extension".

I have been using ShellEx for the last half-hour to disable all non-Microsoft shell extensions, and it seems to have stopped the hanging. I am now going to re-enable them one by one and see what breaks it. Below is a list of the extensions, for your information, and in case you spot something instantly. The Give4Free looks highly suspicious, so I'm going to Google for that now.

Thanks for sticking with me on this.

Charles

Shell Extensions List


Created by using ShellExView
Extension Name Disabled Type Description Version Product Name Company My Computer Desktop Control Panel Filename CLSID File Created Time CLSID Modified Time Microsoft File Extensions File Attributes File Size
CtMtpContextMenu Class Yes Context Menu CME ContextMenu Shell Extension 1.0.1.0 Creative Media Explorer Creative Technology Ltd No No No C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll {7895F317-A125-42CC-BD3E-5830765CE577} 14/09/2006 16:34:44 14/09/2006 16:39:11 No *, Folder 98,304
RealOne Player Context Menu Class Yes Context Menu RealOne Player Shell Extensions 1.0.0.447 RealOne Player RealNetworks No No No C:\Program Files\Real\RealPlayer\rpshellext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} 15/06/2004 17:23:05 22/07/2004 20:27:20 No .acp, .aif, .aiff, .au, .avi, .cda, .la1, .lar, .lavs, ..lmsff, .lqt, .m1v, .M2V, .m3u, .mnd, .mns, .mp1, .mp2, .mp3, .mpa, ..mpe, .mpeg, .mpg, .mpga, .mps, .mpv, .pls, .r3t, .ra, .ram, .rec, .rjs, ..rjt, .rm, .rmj, .rmm, .rmp, .rms, .rmvb, .rmx, .rp, .rsml, .rt, .rv, ..sdp, .smi, .smil, .ssm, .vpg, .wav, .xpl, pnm, rtsp, SSM A 45,105
MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 1.0.0.1020 Cinema CyberLink Corp. No No No c:\Apps\Powercinema\Video\CLMedia.dll {7F1A7DAC-CF44-453E-A03A-BCA52A80EAE4} 15/06/2004 17:21:27 22/07/2004 20:27:20 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 36,864
HyperTerminal Icon Ext Yes Icon Handler HyperTerminal Applet Library 5.1.2600.0 Microsoft® Windows® Operating System Hilgraeve, Inc. No No No C:\WINDOWS\System32\hticons.dll {88895560-9AA2-1069-930E-00AA0030EBC8} 19/09/2002 20:44:56 19/09/2002 21:37:58 No .ht, htfile A 44,544
RecordNow! SendToExt Yes Drop Handler Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04} 16/01/2004 06:00:00 15/06/2004 17:23:51 No .RecordNowSendToExt A 73,728
Monitor Class Yes Copy Hook Handler BTNCopy Module 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No No No C:\WINDOWS\System32\btncopy.dll {7842554E-6BED-11D2-8CDB-B05550C10000} 16/09/2003 18:51:34 16/02/2005 17:20:51 No Directory A 53,248
RecordNow! ContextMenuExt Yes Context Menu Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356} 16/01/2004 06:00:00 15/06/2004 17:23:51 No Drive A 73,728
Roxio DragToDisc Shell Extension Yes Property Sheet DirectCD Shell Extention DLL 6.2.0.134 Drag-to-Disc Roxio No No No C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll {5E44E225-A408-11CF-B581-008029601108} 09/12/2003 18:24:58 25/07/2004 16:15:32 No Drive A 262,144
My Bluetooth Places Yes Shell Folder BTNeighborhood DLL 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No Yes No C:\WINDOWS\System32\BTNEIG~1.DLL {6af09ec9-b429-11d4-a1fb-0090960218cb} 16/09/2003 19:13:16 12/07/2005 11:44:31 No A 790,611
My Media Yes Shell Folder Roxio AudioCentral Media Manager Shell Extension 1.1.277 AudioCentral Media Manager Roxio, Inc. No Yes No C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll {A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC} 15/07/2003 12:38:28 25/07/2004 16:16:26 No A 1,191,936
Nokia Phone Browser Yes Shell Folder Nokia Phone Browser 5, 0, 2, 33 Nokia Phone Browser Nokia Yes No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll {40950107-FEA6-4d53-A65F-B2DCBA57DD58} 17/04/2004 09:09:40 16/02/2005 18:23:26 No A 361,472
Zen MicroPhoto Media Explorer Yes Shell Folder Creative Shell Extension 5.2.16.0 Zen Media Explorer (MTP) Creative Technology Ltd Yes No No C:\Program Files\Creative\Creative Zen MicroPhoto\SHCTMTP.dll {4AFB2C12-9D16-4478-AEF4-C3FC539961E4} 14/09/2006 16:34:31 14/09/2006 16:39:13 No 704,512
RealSearch Yes Search Handler RealOne Player Search Shell Extension 6.0.9.35 RealOne Player (32-bit) RealNetworks, Inc. No No No C:\Program Files\Real\RealPlayer\rpshellsearch.dll {A06B0DBC-8272-4D72-A366-B8090BBE1871} 15/06/2004 17:23:21 22/07/2004 20:27:20 No A 49,207
AcroIEHlprObj Class Yes Browser Helper Object Adobe Acrobat IE Helper Version 6.0 for ActivieX 6.0.0.2003051500 AcroIEHelper Library Adobe Systems Incorporated No No No C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} 15/05/2003 00:47:54 22/07/2004 20:27:19 No A 50,376
Give4Free Plugin Installer Yes Browser Helper Object Give4Free Plugin 1, 0, 0, 1 Give4Free Plugin Give4Free Plugin No No No C:\Program Files\Give4Free Plugin\ibho.dll {208E7E77-507A-4649-B0C9-D39E9049C7A2} 13/09/2007 17:40:23 13/09/2007 17:40:23 No AH 34,304
Contact View Yes Shell Folder Nokia Phone Browser Contact View 5, 0, 0, 33 Nokia Phone Browser Contact View Nokia No No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll {FBFE7864-D495-41f0-B7DC-4BB601CC295E} 17/04/2004 09:16:20 16/02/2005 18:23:27 No A 339,456



JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
You're welcome.
Take a break, chew it over and try again when you feel ready for another go at it.

JS
Yes, I tried that but it still seems to get locked by something, even though it claims to have been disabled.

I also have the same BHO on my main machine, and no problems. I suppose the possibility is that it interacts with something else that is being loaded. If that is the case, I don't see how I can ever track it down, as it could involve checking all combinations of all 15 or so other loaded shell extensions.

I am going to have to admit defeat on this one. It has taken me too long already and although I can make it hang pretty reliably, I suspect that in normal use the owner of the machine might not experience it too often. If it proves to be a continuing problem I will have to have another go, but for now ...

Thanks very much for all your help.

Cheers

Charles

I have the same BHO installed and have no problems, however there is a utility available from SysInternals called 'AutoRuns' which can be used to disable almost anything.
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

JS
Ok. I am now 99% sure that the problem is Acrobat. Specifically, AcroIEHelper. I enabled everything in turn, separately, and the problem magically re-appeared when I re-enabled the Acrobat BHO. It was version 6.0, and was marked as a system component in the registry, so it was not straight forward to remove, but I have done it now. The problem has gone away.

But then, I had the idea that I would put the latest - V8 - Acrobat Reader on to the machine, and what do you know, the problem is back again. Only now, ShellEx is unable to disable the AcroIEHelper BHO.

What ever the problem is, you would have thought that Adobe would have fixed it by now, but no.

Charles

RealSearch
RecordNow
Roxio
Nokia

All of the above bear investigation.

JS

I think I might be homing in. I followed your link, and the one that strikes a chord is the "buggy shell extension".

I have been using ShellEx for the last half-hour to disable all non-Microsoft shell extensions, and it seems to have stopped the hanging. I am now going to re-enable them one by one and see what breaks it. Below is a list of the extensions, for your information, and in case you spot something instantly. The Give4Free looks highly suspicious, so I'm going to Google for that now.

Thanks for sticking with me on this.

Charles

Shell Extensions List


Created by using ShellExView
Extension Name Disabled Type Description Version Product Name Company My Computer Desktop Control Panel Filename CLSID File Created Time CLSID Modified Time Microsoft File Extensions File Attributes File Size
CtMtpContextMenu Class Yes Context Menu CME ContextMenu Shell Extension 1.0.1.0 Creative Media Explorer Creative Technology Ltd No No No C:\PROGRA~1\Creative\SHARED~1\CtCmeCtx.dll {7895F317-A125-42CC-BD3E-5830765CE577} 14/09/2006 16:34:44 14/09/2006 16:39:11 No *, Folder 98,304
RealOne Player Context Menu Class Yes Context Menu RealOne Player Shell Extensions 1.0.0.447 RealOne Player RealNetworks No No No C:\Program Files\Real\RealPlayer\rpshellext.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} 15/06/2004 17:23:05 22/07/2004 20:27:20 No .acp, .aif, .aiff, .au, .avi, .cda, .la1, .lar, .lavs, ..lmsff, .lqt, .m1v, .M2V, .m3u, .mnd, .mns, .mp1, .mp2, .mp3, .mpa, ..mpe, .mpeg, .mpg, .mpga, .mps, .mpv, .pls, .r3t, .ra, .ram, .rec, .rjs, ..rjt, .rm, .rmj, .rmm, .rmp, .rms, .rmvb, .rmx, .rp, .rsml, .rt, .rv, ..sdp, .smi, .smil, .ssm, .vpg, .wav, .xpl, pnm, rtsp, SSM A 45,105
MPEG2Thumbnail Class Yes Thumbnail CyberLink Thumbnail extractor 1.0.0.1020 Cinema CyberLink Corp. No No No c:\Apps\Powercinema\Video\CLMedia.dll {7F1A7DAC-CF44-453E-A03A-BCA52A80EAE4} 15/06/2004 17:21:27 22/07/2004 20:27:20 No .dat, .M1S, .m1v, .M2V, .mpe, .mpeg, .mpg, .VOB, .VRO A 36,864
HyperTerminal Icon Ext Yes Icon Handler HyperTerminal Applet Library 5.1.2600.0 Microsoft® Windows® Operating System Hilgraeve, Inc. No No No C:\WINDOWS\System32\hticons.dll {88895560-9AA2-1069-930E-00AA0030EBC8} 19/09/2002 20:44:56 19/09/2002 21:37:58 No .ht, htfile A 44,544
RecordNow! SendToExt Yes Drop Handler Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {DEE12703-6333-4D4E-8F34-738C4DCC2E04} 16/01/2004 06:00:00 15/06/2004 17:23:51 No .RecordNowSendToExt A 73,728
Monitor Class Yes Copy Hook Handler BTNCopy Module 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No No No C:\WINDOWS\System32\btncopy.dll {7842554E-6BED-11D2-8CDB-B05550C10000} 16/09/2003 18:51:34 16/02/2005 17:20:51 No Directory A 53,248
RecordNow! ContextMenuExt Yes Context Menu Shell Extensions 6.7.0.0 RecordNow! No No No c:\Apps\RecordNow\shlext.dll {E91B2703-013E-4A99-AD33-2B6FB00AA356} 16/01/2004 06:00:00 15/06/2004 17:23:51 No Drive A 73,728
Roxio DragToDisc Shell Extension Yes Property Sheet DirectCD Shell Extention DLL 6.2.0.134 Drag-to-Disc Roxio No No No C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\shellex.dll {5E44E225-A408-11CF-B581-008029601108} 09/12/2003 18:24:58 25/07/2004 16:15:32 No Drive A 262,144
My Bluetooth Places Yes Shell Folder BTNeighborhood DLL 1.4.2 Build 10 Bluetooth Software 1.4.2 Build 10 WIDCOMM, Inc. No Yes No C:\WINDOWS\System32\BTNEIG~1.DLL {6af09ec9-b429-11d4-a1fb-0090960218cb} 16/09/2003 19:13:16 12/07/2005 11:44:31 No A 790,611
My Media Yes Shell Folder Roxio AudioCentral Media Manager Shell Extension 1.1.277 AudioCentral Media Manager Roxio, Inc. No Yes No C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\MediaSX.dll {A44D5ACC-3411-40DE-9AD3-214FFB2ED7AC} 15/07/2003 12:38:28 25/07/2004 16:16:26 No A 1,191,936
Nokia Phone Browser Yes Shell Folder Nokia Phone Browser 5, 0, 2, 33 Nokia Phone Browser Nokia Yes No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\NokiaPhoneBrowser.dll {40950107-FEA6-4d53-A65F-B2DCBA57DD58} 17/04/2004 09:09:40 16/02/2005 18:23:26 No A 361,472
Zen MicroPhoto Media Explorer Yes Shell Folder Creative Shell Extension 5.2.16.0 Zen Media Explorer (MTP) Creative Technology Ltd Yes No No C:\Program Files\Creative\Creative Zen MicroPhoto\SHCTMTP.dll {4AFB2C12-9D16-4478-AEF4-C3FC539961E4} 14/09/2006 16:34:31 14/09/2006 16:39:13 No 704,512
RealSearch Yes Search Handler RealOne Player Search Shell Extension 6.0.9.35 RealOne Player (32-bit) RealNetworks, Inc. No No No C:\Program Files\Real\RealPlayer\rpshellsearch.dll {A06B0DBC-8272-4D72-A366-B8090BBE1871} 15/06/2004 17:23:21 22/07/2004 20:27:20 No A 49,207
AcroIEHlprObj Class Yes Browser Helper Object Adobe Acrobat IE Helper Version 6.0 for ActivieX 6.0.0.2003051500 AcroIEHelper Library Adobe Systems Incorporated No No No C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} 15/05/2003 00:47:54 22/07/2004 20:27:19 No A 50,376
Give4Free Plugin Installer Yes Browser Helper Object Give4Free Plugin 1, 0, 0, 1 Give4Free Plugin Give4Free Plugin No No No C:\Program Files\Give4Free Plugin\ibho.dll {208E7E77-507A-4649-B0C9-D39E9049C7A2} 13/09/2007 17:40:23 13/09/2007 17:40:23 No AH 34,304
Contact View Yes Shell Folder Nokia Phone Browser Contact View 5, 0, 0, 33 Nokia Phone Browser Contact View Nokia No No No C:\Program Files\Nokia\Nokia PC Suite 6\Components\PhoneBrowserComponents\ContactView.dll {FBFE7864-D495-41f0-B7DC-4BB601CC295E} 17/04/2004 09:16:20 16/02/2005 18:23:27 No A 339,456



JS said:
In my case I do get a delayed response whenever I select the properties
option for an entire hard drive on one of my PCs. In my case a component of
Norton Ghost (LiveState Recovery) slowed things down dramatically.

I googled on the key words you supplied and found this article (Note: I
would not use any registry cleaners as they can cause more problems then
they solve)!
See: http://www.analogduck.com/main/explorer_hangs

JS

Charles Law said:
I can now say that Windows Explorer even hangs when in Safe Mode. Note that
I do mean Windows Explorer, as distinct from the Explorer Program Manager,
even though they appear as the same process in Process Explorer. It is only
when I run Windows Explorer that the problem starts to occur.

How can that be?

Charles


JS said:
None specific, but a number of systems have had problems with IE7, but
since auto-updates is enabled IE7 was most likely installed some time
ago.

JS

Unfortunately I don't have that information as I am trying to fix this
for a friend, and auto-updates are enabled, so they probably wouldn't
know either. Is there a particular issue that you are thinking of?

Charles


Did you recently install IE7 by any chance?

JS

Thanks, but I just picked these two entries at random. There are many
more, and I have no reason to believe that there is a problem with any
of them per se. I was just illustrating the fact that the symbols
vanished when Explorer crashed.

Charles


Well there certainly is not a lack of articles in MS Knowledge Base
on shlwapi.dll
http://support.microsoft.com/search...=1173&query=SHLWAPI.dll&adv=&mode=s&cat=False

There are four hits when search for both DLL files at the same time:
http://support.microsoft.com/search...ROWSEUI.dll+shlwapi.dll&adv=&mode=s&cat=False

JS


One thing I have just noticed is that when Explorer is running
properly, the symbols in the Process Explorer threads list are
shown. That is, there are entries such as

SHLWAPI.dll!Ordinal505+0x37a
BROWSEUI.dll!Ordinal138+0x7af5
...

Once Explorer has crashed, the symbols are missing, so entries look
like

!Ordinal505+0x37a
!Ordinal138+0x7af5
...

The only entries still to have a symbol are

ntdll.dll!RtlQueueWorkItem+0x2b5
ntdll.dll!RtlDowncaseUnicodeString+0x75
...

I don't know if that helps at all.

Charles




Once you have removed 'All traces' of F-Secure then I would take
another look using Process Explorer. The CPU graph at the top might
give you some help (move the mouse cursor over any spike in the
graph for locating what cause the CPU usage spike).

JS

Hard to say. It's not a product I am really familiar with. There
are umpteen things that get loaded at start-up, and I haven't a
clue what they all do. In order to get some response from the
machine I disable them all.

I've got to the point now where I am fairly satisfied that
F-Secure is my 'slow-down' problem, so I might well ditch it and
go with something like AVG.

What is now more worrying is that Explorer hangs regularly, and
although I can restart it I can't go on like this. I need to home
in on what is pulling it down, but this is proving far less
straightforward.

Do you have any techniques that would be useful here?

Thanks.

Charles


Does F-secure have a background task that monitors disk and
process activity and if so could this slow the PC down?
Also do you have any other AV/Spyware software running at the
same time as F-Secure?

JS

Hi JS

Thanks for replying. I have Process Explorer, but one problem is
that with F-Secure enabled the machine runs so slowly that I
cannot run any application, not even Process Explorer.

When I disable F-Secure I can run PE but there is nothing using
much CPU. Idle is around 85-90%. I still get the Explorer hang
though. Each time I can restart it with Task Manager, but I
can't find out what is hanging it.

Charles


You need to find the specific sub-process or application
running under Explorer that's taking all
the CPU resources and slowing down your PC.

To do this try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and
'Show Lower Pane' options.
Then expand the process named 'Explorer' (click on the + sign)
In the column on the left named 'CPU', look for any high CPU
usage.
Next click on the CPU column to sort the processes by %CPU
usage (Highest to Lowest).
Then click on the process that's using most or all the CPU %
the highlight it,
Now that it's highlighted, right click and from the options
listed select: Search Online
This should display what out there on the web about that
process.
You can also double click on any process to open up a more
detailed 'Properties' window.

Note: some entries like Explorer and System/Services may need
to be expanded to show the detail,
(sub processes), in this case click on the + located to the
left of the entry.

Still another tool is What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS

I know this is going to be a long shot, but any pointers
greatly received.

I have a Windows XP Home machine running F-Secure anti-virus.
When it boots it logs in to Windows and then runs so slowly
that it appears to have frozen. If I boot into Safe Mode I can
see that F-Secure has been madly logging to the Application
Event Log: Event 103 - "One of the scanners could not scan
because the definition database was not available at this
time; scanning passed to the next scanner."

I have Googled for this but no helpful hits.

The System Event Log also contains events from F-Secure
Gatekeeper, reporting a problem with TNBUtil.exe (what ever
that is).

I restart in Diagnostic Mode using MSConfig, and all seems to
run smoothly, except that, within a couple of minutes the
machine appears to stop working. I can Ctrl+Alt+Del to get
Task Manager and I see that Explorer has stopped responding. I
end task, and things come back to life, and thereafter the
machine runs sweetly, albeit most drivers are not loaded and
services are disabled. [Having said that, I just noticed that
Explorer hung again, but I ended the task and it came back to
life again]

Can anyone suggest a way to get to the bottom of this?

TIA

Charles
Click to expand...
Click to expand...
Click to expand...
 
I came in here looking for answers but found my answer after the same
problem happened to me when I am re-installing all my programs onto a
new notebook. It was working fine until this morning when I continued
my installation and I started backtracking them.

After uninstalling several suspected programs without success, I
finally zoomed in to CloneDVDMobile. Uninstalled that and my Windows
Explorer is working fine again. Just thought I'd put a note in here
in case it helps anyone else.
 
Hi

Although that program was not in the list of shell extensions, I seem to
remember something similar being installed. As I mentioned in an earlier
post, I have long been suspicious of Roxio products because of widespread
reports and my own experience of incompatibilities with other programs.

The machine has gone back to its owner now, but if the problem reoccurs I
will certainly take a look in this area.

Cheers.

Charles
 
Back
Top