Re: Error during every search

From: cquirke (MVP Win9x) (cquirkenews_at_nospam.mvps.org)
Date: 01/04/05 

Date: Tue, 04 Jan 2005 21:01:31 +0200

On Mon, 03 Jan 2005 20:40:23 -0600, dont@agora.rdrop.com (Don Taylor)
><BrennonBortz@discussions.microsoft.com> writes:

>>Every time I search, Explorer causes an error and fails to complete the
>>search. Reinstall is really not an option...

Reinstall should never be the forced option.

>Search uses the Windows Explorer base to run from

Yep.

>But, some find it will work when you boot in safe mode.

Safe Mode does not suppress all integrations into the shell.

>Some claim it is all spyware and viruses but I haven't seen any
>posting that confirmed this for the Windows Explorer problem.

Malware integrates into the system, and commercial malware typically
does so "nicely", i.e. through features offered by the OS for this
purpose, so they can plausibly deny they are malware.

So shell integration, whether it be CLSIDs, BHOs, toorbar trash or
whatever, is very popular.

>carefully and repeatedly checked, no viruses or spyware and my
>windows explorer locks up every time.

Locks up? This is new, and rather different to "does not complete".
Shades of "Miss Odes regrets she is unable to luncheon today".

Most ppl are pretty poor at excluding malware. No surprise; malware
is designed not be found! All too often one reads rubbish like "I
don't have a virus because {some Windows-based av} and/or {some
scanning web site} tells me I'm clean".

>Some claim it is all "bad applications" like Divx or Spy Sweeper
>being installed that is responsible for this

Because the likely nexus is integration of foreign code into the
shell, bad apps and malware can indeed be expected to be common
causes. Other causes include:
  - "slow" drives, e.g. LAN mappings, CDRs, etc. that bog things down
  - corrupted files, such as media files that bog down content lookup
  - malware and av that intrude into file access
  - issues with OS and add-on indexers
  - sick HD retry loops (HD LED on, mouse pointer sticks)
  - networking issues
  - issues related to NTFS

>Some claim it is all "ShellExtensions", little accessory gadgets
>that sort of script extra cute features. The advice for that is
>to install free ShellExView and to try (carefully) disabling these
>features one at a time, if turning one off doesn't do anything then
>turn it back on and try again.

"The problem" as you term it, is actually a failure pattern that can
have many causes. So of course one size doesn't fit all.

ShellExtensionViewer is a hot tip, though; it's the best tool to look
for a wide class of causes that are likely to apply.

>Some claim it is all "corrupted user profiles" that are the
>cause of this but I've never been able to track down a tool that
>would check a user profile to see if it was corrupted.

This is relevant in that several settings, including classes (file
associations, CLSID integrations etc.) can be overlaid with
user-specific settings from that user profile.

>They told me I must "have some corrupted files, repair windows
>back to install state and then reinstall SP2 twice while in Safe

Ugly. If ChkDsk and AutoChk didn't automatically "kill, bury, deny",
you might have some chance of a cleaner fix.

Look at ChkDsk's logs; has it "fixed" any files lately?
Look at the av's logs; did it "clean" any existing code files lately?

>Before I did that someone posted the "switch user" workaround
>that let me get by temporarily.

More on that? Do you have low RAM with small pagefile? If so (e.g.
128M RAM, pagefile < 256M) then set a larger pagefile; say, 512M, and
do NOT use fast user switching (as that increases memory load).

Also; purge web caches, and - in all user accounts - shrink those web
caches to (say) 20M. That will relieve C: of a lot of clutter and
fragmentation. You've defragged, right?

>I just spent another two hours in chat with Microsoft Support ...
>the next guy had me run msconfig, in the startup tab disable all
>items, in the service tab hide all Microsoft services and disable
>all, reboot the machine, tell it not to show or launch the config
>window... If the problem had disappeared after this was done then
>the instructions were to begin enabling these items one at a time
>until the one was found that made this fail.

That's a good approach; you've saved me a lot of typing :-)
IOW:
  - get a baseline that works
  - add back items on a test-to-break basis

>So the next guy had me download a copy of Process Explorer and dump
>out all the dll's that are connected with Windows Explorer and mail
>them to him. Just like the situation with shell extensions, I see
>that all but a couple of these are Microsoft supplied. After he had
>seen the list he asked that I rename some of the non-Microsoft dll's
>and reboot, likely to see if they were responsible. The problem was
>still there and I've restored the original names. Now we seem to be
>back to square one and he's asking again if this happens in Safe
>mode, which we have already repeatedly covered.

Does it happen in Safe Mode?
Does your mouse pointer stick?

>Now we've sent him HijackThis logs, 3 megabytes of ntuser.dat, he
>keeps claiming they DO have a process for figuring this out but
>there just isn't anything that can diagnose what the problem is

>Can you say "clueless groping, hoping for a miracle"?

Yes, but you are flaming the wrong guys. What I see is a list of
heroic attempts to solve a difficult problem. The folks worth flaming
are the folks who built this OS so that:
  - every passing web page can dump trash in the system
  - every "document" or "message" can SE it's way to same effect
  - there's a huge surface of intrusion points
  - there's no maintenance OS to manage these intrusion points

I'd say your problem is 80% likely to be an integration issue, but
there are other causes, especially if the PC is generally slow.

So I'd take a methodical approach, starting with hardware. Check RAM
(even tho that's unlikely to be the problem; bad RAM crashes at full
speed). Check fans; overheating can cause CPU to retreat into thermal
shutdown and thus slow performance. Check HD for physical defects!
This is crucial, because not only will a failing HD cause patchy but
profound slowdown, you'd be at risk of losing data too.

Once the hardware's OK, formally exclude viruses, then exclude
commercial malware. I know a lot of effort has gone into this; if
there's a slip-up, it will most likely be a virus that has eluded
informal attempts to find it.

Then, check some baseline states:
  - Safe Mode
  - MSConfig suppression with ALL networks/devices disconnected
  - MSConfig suppression with ALL networks disconnected
  - MSConfig suppression

One of those should give a "clean" (working) baseline. If not,
revisit earlier tests; bad hardware, file corruption, etc.

Once you have a good baseline, zoom in to what makes this differ from
your desired state (everything plugged in, normal mode).

>So I have repeatedly told them I don't just want to randomly change
>things until we don't notice the problem anymore, I'm going to track
>down the real root cause of this one and we are going to get a fix
>for this.

You've done good work and covered a lot of stuff, but you've
mis-interpreted the results. It's not that everone is too useless to
fix "this problem", it's that this problem *pattern* has multiple
possible causes at many levels of abstraction, so that one person's
fix is irrelevant to another person's case.

>--------------- ----- ---- --- -- - - -
   Tech Support: The guys who follow the
   'Parade of New Products' with a shovel.
>--------------- ----- ---- --- -- - - -

Relevant Pages

  • Re: Error during every search
    ... > Safe Mode does not suppress all integrations into the shell. ... >>posting that confirmed this for the Windows Explorer problem. ... > Malware integrates into the system, ... > Because the likely nexus is integration of foreign code into the ...
    (microsoft.public.windowsxp.general)
  • Re: Virus? - Disable .EXE, .COM, .LNK and group policy.
    ... A common myth is "I don't need to scan for active malware ... external entities that may re-assert the infection. ... Stubbon cases may need more than Safe Mode, ... elaborate on which integration methods remain active in "Safe" mode. ...
    (microsoft.public.security.virus)
  • Re: sp2
    ... Windows Explorer (Recycle bin, folder shortcuts, control panel, ... Malware is badly-written 3rd-party software you didn't know you had, ... shell integrations and file associations were ... Malware can use shell integration, ...
    (microsoft.public.windowsxp.general)
  • Re: Online THREATS
    ... You are scanning for malware while the malware is active. ... so need for recovery does not arise. ... OS in Safe Mode, but that's only malware-safe if two other conditions ... 3rd-party code gets to run (integration by design), ...
    (microsoft.public.security.virus)
  • Re: Homepage keeps resetting itself
    ... > Is there some sort of idiots method, i.e. download an *.exe, run it, ... >>>difficult CWS parasite variants to remove. ... >>>using a malware provider's uninstall, ... >>>All of these removal tools should be run from Safe mode when possible. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
Loading