WD hangs on xpsp3res.dll after update

  • Thread starter Thread starter Anonymous Bob
  • Start date Start date
A

Anonymous Bob

XP Pro
IE7
Firefox 3.0.6
Avast!
Outpost

System is unresponsive and requires a 3 finger salute to restart.
Problem is repeatable.
 
XP Pro
Click to expand...

Got SP3 yet?
IE7
Click to expand...

Has it been updated yet (incl. Root Certificates)?
Firefox 3.0.6
Avast!
Click to expand...

Do you scan frequently with updated VDF?
Outpost
Click to expand...

Absolutely useless as far as Intenet security is concerned. The build-in
application is *impessively* better!
System is unresponsive and requires a 3 finger salute to restart.
Problem is repeatable.
Click to expand...

Try this:
1.Clear the (IE) temporary Internet files and the history cache.
Click 'Start' and then click 'Run'... then type (or copy/paste)
"inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
button.
In Internet Properties panel 'General' tab, under 'Browsing history', click
'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
all...' button then place a checkmark into the box beside 'Also delete
files and settings stored by add-ons', Click 'Yes' and exit the Internet
Properties panel by clicking the 'OK' button.

2.Clean HDD
Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
(w/out quotation marks into the box, then click the 'OK' button. Select
your drive
(presumably WinXP (C:) and click OK.

3.Download/execute:
Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
--and--
SuperAntispyware - Free
http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

Note:
Both free versions of MBAM and SAS are on-demand scanners and offer no
'real-time' protection. Keep them installed and use them as
'second-opinion' scanner which is purposely (by design) recommended by
their respective authors.

4.Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

5.Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html

Additional references:
How to use Reset Internet Explorer Settings (RIES)
http://support.microsoft.com/kb/923737
Read: "What you must know"
Applies to: Windows Internet Explorer 7 for Windows XP and
Windows Internet Explorer 7 in Windows Vista

Good luck :)
 
Kayman said:
Got SP3 yet?
Click to expand...

Oh yes.
Has it been updated yet (incl. Root Certificates)?
Click to expand...

Oh yes.
Do you scan frequently with updated VDF?
Click to expand...

Oh yes.
Absolutely useless as far as Intenet security is concerned. The build-in
application is *impessively* better!
Click to expand...

That may be a matter of opinion and you can't beat the logging in Outpost.

I generally run W2K but I keep XP updated on at least a monthly basis. I do
very little browsing from XP.

Give me a bit of time to respond to the rest of your post. ;-)
....and thank you.
 
[snip]
Try this:
1.Clear the (IE) temporary Internet files and the history cache.
Click 'Start' and then click 'Run'... then type (or copy/paste)
"inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
button.
In Internet Properties panel 'General' tab, under 'Browsing history', click
'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
all...' button then place a checkmark into the box beside 'Also delete
files and settings stored by add-ons', Click 'Yes' and exit the Internet
Properties panel by clicking the 'OK' button.

2.Clean HDD
Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
(w/out quotation marks into the box, then click the 'OK' button. Select
your drive
(presumably WinXP (C:) and click OK.

3.Download/execute:
Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
--and--
SuperAntispyware - Free
Click to expand...
http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

Avast!, Malwarebytes, and SAS found nothing.

Removed and re-installed WD...same result.
4.Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

5.Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html
Click to expand...

I'm a bit of a nut about it. :-)
Additional references:
How to use Reset Internet Explorer Settings (RIES)
http://support.microsoft.com/kb/923737
Read: "What you must know"
Applies to: Windows Internet Explorer 7 for Windows XP and
Windows Internet Explorer 7 in Windows Vista
Click to expand...

I only use IE7 for WindowsUpdate and have it locked down so tighly that I
have to click "OK" three times for that to run.
Good luck :)
Click to expand...

Something got stepped on badly during the update. WD lost its scan history.
As for HJT, I have a bit of an "unusual" system. I use Treewalk DNS and have
a virtual NIC bridged for running PCLOS under XP.
 
On Wed, 11 Feb 2009 00:28:10 -0500, Anonymous Bob wrote:

Something got stepped on badly during the update. WD lost its scan history.
As for HJT, I have a bit of an "unusual" system. I use Treewalk DNS and have
a virtual NIC bridged for running PCLOS under XP.
Click to expand...

Sorry, I am out of suggestions :(

You may wish to repeat uninstalling/installing WD.
Have a look at this:
Description of the Windows Installer CleanUp Utility
http://support.microsoft.com/kb/290301
 
Hell A B,

I don't know if this will work but it probably is worth a try.

I'm not sure about this--but it looks promising--

I think you may have to work at excluding it from the scan, as an interim
measure. Tools, Options, general settings, scroll down to Advance Options
settings, and hit the add button. ( If I remeber right, you have to include
the full path)

For the benefit of the community reading this post, please rate the pºst.

I hope this post is helpful.

Let us know how it works ºut.

Еиçеl
 
Engel said:
Hell A B,

I don't know if this will work but it probably is worth a try.

I'm not sure about this--but it looks promising--

I think you may have to work at excluding it from the scan, as an interim
measure. Tools, Options, general settings, scroll down to Advance Options
settings, and hit the add button. ( If I remeber right, you have to include
the full path)
Click to expand...

Thanks.
I excluded it from the scan but now it hangs on xpob2res.dll...!!!...???
 
Thanks. I renamed it to xpsp3res.old and ran WU. It didn't replace the file,
but I'm going to play with that approach some more.
 
Anonymous Bob said:
Thanks. I renamed it to xpsp3res.old and ran WU. It didn't replace the file,
but I'm going to play with that approach some more.
Click to expand...

I removed one of yesterday's updates from the control panel and immediately
was notified that updates were ready to download. Xpsp3res.dll had been
re-created. Downloaded and installed the update and restarted, then ran WD.
It hung on xpsp3res.dll again.

I think we have a bug, but since I have to restart the system on every hang,
I have no idea how I could report anything meaningful.
 
Well - I looked to see if I had an xpsp3res.dll file on this machine, and
didn't. Probably not surprising since it is Windows 7 upgraded from Vista,
and a clean install of Vista, I think.

I'll go look at an XPSP3res.dll file and look at the permission settings on
it--If the file itself is not corrupt, presumably this is a permissions
issue, and we should compare notes on those.

I have a system on which a product using similar scanning technology to
Defender is hanging on wmplayer.exe which is entirely legit and working
fine. I think I've fixed this one, and it was a permissions issue--I'll
have to double check--it's in the office, and I've been home all week
"supervising" roofing work.


Anonymous Bob said:
I removed one of yesterday's updates from the control panel and
immediately
was notified that updates were ready to download. Xpsp3res.dll had been
re-created. Downloaded and installed the update and restarted, then ran
WD.
It hung on xpsp3res.dll again.

I think we have a bug, but since I have to restart the system on every
hang,
I have no idea how I could report anything meaningful.
Click to expand...


--
 
Anonymous Bob said:
Thanks.
I excluded it from the scan but now it hangs on xpob2res.dll...!!!...???
Click to expand...


Hmm - am I remembering that there's a procedure to reset permissions to the
installation defaults? I'll look for that, too.
 
Anonymous Bob said:
I removed one of yesterday's updates from the control panel and immediately
was notified that updates were ready to download. Xpsp3res.dll had been
re-created. Downloaded and installed the update and restarted, then ran WD.
It hung on xpsp3res.dll again.

I think we have a bug, but since I have to restart the system on every hang,
I have no idea how I could report anything meaningful.
Click to expand...

Consider running the script provided in "Method 1" under advanced troubleshooting, in this KB article?

http://support.microsoft.com/kb/949377
 
Bill Sanderson said:
Well - I looked to see if I had an xpsp3res.dll file on this machine, and
didn't. Probably not surprising since it is Windows 7 upgraded from Vista,
and a clean install of Vista, I think.

I'll go look at an XPSP3res.dll file and look at the permission settings on
it--If the file itself is not corrupt, presumably this is a permissions
issue, and we should compare notes on those.

I have a system on which a product using similar scanning technology to
Defender is hanging on wmplayer.exe which is entirely legit and working
fine. I think I've fixed this one, and it was a permissions issue--I'll
have to double check--it's in the office, and I've been home all week
"supervising" roofing work.
Click to expand...

Checking Properties | Security on the file all the expected check marks are
there, but they're grayed out except for the Administrator group and that
includes System. Since I'm way over my head here, I can only note that the
same is not true for xpsp2res.dll. If that's to be expected, I have no idea,
but I don't think so.

Thanks and good luck on that "supervising".
 
Back
Top