Forum menu
Fix this laptop?
 

[Closed] Fix this laptop?

Posts: 78497
Full Member
Topic starter
 
[#8238577]

A work colleague brought a friend's laptop to me yesterday for me to have a look at. I've fixed it now, but it was an interesting problem, so I thought you lot might like a punt at diagnosing it.

Symptoms are, every few minutes Explorer shuts down leaving just the desktop (no icons, no task bar). You can restart Explorer from Task Manager (File / Run Task / Explorer), it comes back up normally and is fine for a few minutes before closing again.

If you want to play along, ask me questions and see if you can diagnose the fault. I'll be as honest as I can, but will be a "user" and not volunteer information you don't ask for.

What do we do with it?


 
Posted : 21/12/2016 11:10 am
 IA
Posts: 563
Free Member
 

Anything in the startup items folder in the start menu?

What do we do with it?

Reply, "ooh, tricky, i can have a look - would you fetch me a coffee and a donut?"


 
Posted : 21/12/2016 11:12 am
Posts: 3676
Full Member
 

I'll be as honest as I can, but will be a "user" and not volunteer information you don't ask for.

Hello Mister,

I am calling from your bank. To protect your security please confirm your credit card number, PIN and mother's maiden name.

Thanking you.
[img] [/img]


 
Posted : 21/12/2016 11:17 am
Posts: 739
Free Member
 

If some media players don't get a response from what they are asked to play, they can cause Explorer to restart & you'll loose taskbar etc whilst this happens.

Is it a corrupt media file?


 
Posted : 21/12/2016 11:20 am
Posts: 78497
Full Member
Topic starter
 

Anything in the startup items folder in the start menu?

Nope.

If some media players don't get a response from what they are asked to play, they can cause Explorer to restart & you'll loose taskbar etc whilst this happens.

Is it a corrupt media file?

It's not playing media. It happens continually.


 
Posted : 21/12/2016 11:24 am
 beej
Posts: 4215
Full Member
 

Corruption in the registry? Something wrong with explorer.exe?

What OS, version and build?


 
Posted : 21/12/2016 11:30 am
Posts: 0
Free Member
 

Needs switching off and then back on again.


 
Posted : 21/12/2016 11:31 am
Posts: 9
Free Member
 

Multiple AV programs installed?


 
Posted : 21/12/2016 11:31 am
Posts: 17313
Free Member
 

Did you try turning it off and then on again?

Edit : Bollocks! 30 seconds too slow.


 
Posted : 21/12/2016 11:32 am
Posts: 4699
Full Member
 

have you installed anything like winzip, winrar or a new anti virus program recently?


 
Posted : 21/12/2016 11:36 am
Posts: 0
Free Member
 

What version of windows?
What services & programs are running?
When did it start happening?

I'll go with Malware for the moment, or a corrupt dll..
[code]sfc /scannow[/code] should fix a corrupt dll


 
Posted : 21/12/2016 11:38 am
Posts: 91169
Free Member
 

Anything in the windows event logs?


 
Posted : 21/12/2016 11:41 am
Posts: 0
Free Member
 

PICNIC

Problem In Chair Not In Computer


 
Posted : 21/12/2016 11:42 am
Posts: 10337
Full Member
 

I would be looking in the logs for something not responding

Turn off windows search

Run a disk check

Unplug all peripherals in case it is choking on something external

But, is there some sort of add on like winzip, c cleaner appearing in the right click menu?

Oh, and is the problem every few minutes when it is idle or when you are working?


 
Posted : 21/12/2016 11:45 am
Posts: 78497
Full Member
Topic starter
 

Corruption in the registry? Something wrong with explorer.exe?

Dunno, how would we check that?

What OS, version and build?

Good question. It's Windows 7 Home Pro, x64. Didn't check the build.

Multiple AV programs installed?

Webroot is installed, no other AV.

have you installed anything like winzip, winrar or a new anti virus program recently?

Not to my knowledge. I asked what had changed recently and was told "nothing" in a user-y fashion.

What services & programs are running?
When did it start happening?

Various things, what are you looking for?

I'll go with Malware for the moment.

What do we do about that then?

Anything in the windows event logs?

Another good question. Nope.


 
Posted : 21/12/2016 11:47 am
Posts: 78497
Full Member
Topic starter
 

Turn off windows search

I didn't think to do that, but it's not relevant here.

Run a disk check

Good. Chkdsk finds no problems.

Unplug all peripherals in case it is choking on something external

Only thing attached is keyboard and mouse.

But, is there some sort of add on like winzip, c cleaner appearing in the right click menu?

I can't remember exactly but probably not. Nothing that raised suspicion, anyway.

Oh, and is the problem every few minutes when it is idle or when you are working?

Both.


 
Posted : 21/12/2016 11:49 am
Posts: 4699
Full Member
 

Did your coputer update itself reently? Did windows update run, or did your anti virus software suggest any application should be updated?


 
Posted : 21/12/2016 11:52 am
Posts: 91169
Free Member
 

Does it do it in safe mode too?

Are the intervals very regular?


 
Posted : 21/12/2016 11:52 am
Posts: 91169
Free Member
 

Tried SFC?


 
Posted : 21/12/2016 11:55 am
Posts: 8177
Free Member
 

What brand/model of laptop is it?


 
Posted : 21/12/2016 11:55 am
Posts: 78497
Full Member
Topic starter
 

Did your coputer update itself reently? Did windows update run, or did your anti virus software suggest any application should be updated?

It's not had a Windows Update in a while as far as I can see. The AV hasn't reported anything for a while either.

Does it do it in safe mode too?

No.

Are the intervals very regular?

It seems to be pretty regular, yes. You can't work on it for more than a few minutes without it happening.


 
Posted : 21/12/2016 11:57 am
Posts: 39735
Free Member
 

despite it being suggested twice already . inkeeping with what my it department do when ever you progress through the levels of " i cant fix this heres my supervisor"

have you tried turning it off and back on again ๐Ÿ˜€


 
Posted : 21/12/2016 11:57 am
Posts: 0
Free Member
 

Various things, what are you looking for?

At this point, I would probably do what you are doing and ask for the laptop, there are too many services and processes to check which a glance can quickly see if there are any abnormal things running. ๐Ÿ˜‰

Still interested in the solution though!

Did [code]sfc /scannow[/code] fix a corrupt dll?


 
Posted : 21/12/2016 11:59 am
Posts: 78497
Full Member
Topic starter
 

Tried SFC?

Good. SFC reports no issues.


 
Posted : 21/12/2016 12:00 pm
Posts: 1257
Free Member
 

Are there any local security policies setup? Does it have the same problem with a different user?


 
Posted : 21/12/2016 12:01 pm
Posts: 78497
Full Member
Topic starter
 

What brand/model of laptop is it?

It was an Acer that looked like it'd had a hard life, I don't remember the exact model though.

there are too many services and processes to check which a glance can quickly see if there are any abnormal things running.

Nothing jumped out as being obviously abnormal.


 
Posted : 21/12/2016 12:02 pm
Posts: 0
Free Member
 

I'll go with Malware for the moment.

What do we do about that then?

If it's malware, I would probably download a bootable virus/malware checker and let that run. Sometimes I find it quicker to just re-install the system than spending hours trying to find the problem, some malware can be long-winded to remove.


 
Posted : 21/12/2016 12:02 pm
Posts: 91169
Free Member
 

Does it do it in safe mode too?
No.

So it's not explorer itself at fault, it's a driver or something that happens regularly.

I'd be timing it. If it's very regular then it's some job that's set to happen on a regular basis that is crapping out.

What's in the startup programs list? Post a list? Or just tell me if it's not one of them.


 
Posted : 21/12/2016 12:05 pm
Posts: 78497
Full Member
Topic starter
 

Are there any local security policies setup? Does it have the same problem with a different user?

Ooh, interesting thinking. I didn't check secpol, but I'll say "no." There was only one user account and it didn't occur to me to create another to see, but I'd expect it would still be symptomatic.


 
Posted : 21/12/2016 12:05 pm
Posts: 812
Free Member
 

Is it supplied by Plusnet? (who'll "do you [s]in [/s]proud?") - If so you'll never find out what's wrong with it and the only solution is to move country.

Is there a scheduled task or app trying to shutdown the 'puter?
Is the battery/power supply ok - no flames or billowing smoke?


 
Posted : 21/12/2016 12:06 pm
Posts: 8177
Free Member
 

It was an Acer that looked like it'd had a hard life

Fan exhausts full of crap? Heat bad ๐Ÿ™‚


 
Posted : 21/12/2016 12:06 pm
 beej
Posts: 4215
Full Member
 

Install the latest display drivers.

Has that fixed it?


 
Posted : 21/12/2016 12:06 pm
Posts: 17313
Free Member
 

Have you whacked it really hard with your elbow?

Always worked for the Fonz.


 
Posted : 21/12/2016 12:07 pm
Posts: 812
Free Member
 

... resource exhaustion? (Disk Full).


 
Posted : 21/12/2016 12:08 pm
Posts: 13001
Free Member
 

Have you hoovered the keyboard?


 
Posted : 21/12/2016 12:08 pm
Posts: 78497
Full Member
Topic starter
 

If it's malware, I would probably download a bootable virus/malware checker and let that run.

Malwarebytes was already installed at the advice of the colleague who brought it to me. It found "a couple of things" but I've no idea whether these were problems or false positives.

I'd be timing it. If it's very regular then it's some job that's set to happen on a regular basis that is crapping out.

It's every five minutes.

What's in the startup programs list? Post a list? Or just tell me if it's not one of them.

I did a selective startup via msconfig, disabling all non-MS services. Still symptomatic.


 
Posted : 21/12/2016 12:09 pm
Posts: 0
Free Member
 

run msconfig and disable everything in the startup.

reboot.

working?

if so, enable one at a time until it breaks ๐Ÿ™‚


 
Posted : 21/12/2016 12:14 pm
Posts: 812
Free Member
 

Does it still occur if you disable all network adaptors?
Is there any removable media inserted? SD card, CD etc.


 
Posted : 21/12/2016 12:17 pm
Posts: 78497
Full Member
Topic starter
 

Is there a scheduled task or app trying to shutdown the 'puter?

We have a winner! Though, credit should also go to Molgrips who was on the same lines. I thought that would take a lot longer, curses. (-: Here's the first part of the story:

In Scheduled Tasks there was an oddly named task, "vyi" or something. This task was scheduled to run every five minutes, and executed c:\ch.vbs. ch.vbs is a one-liner script which launches c:\ch.bat. ch.bat is another one-liner, TASKKILLing Explorer.exe.

The next question is... how / why?


 
Posted : 21/12/2016 12:25 pm
Posts: 889
Full Member
 

Petty virus?


 
Posted : 21/12/2016 12:26 pm
Posts: 812
Free Member
 

Nerdgasm. ๐Ÿ˜€


 
Posted : 21/12/2016 12:29 pm
Posts: 28
Free Member
 

Because it was using too many resources ?


 
Posted : 21/12/2016 12:29 pm
Posts: 812
Free Member
 

... was it trying to connect to a network resource that was being a bit tardy in responding?


 
Posted : 21/12/2016 12:31 pm
Posts: 13643
Free Member
 

Trying to get US Netflix lol ๐Ÿ™‚


 
Posted : 21/12/2016 12:31 pm
Posts: 4699
Full Member
 

disgruntled sysadmin that's recently left? Look for another VBS that runs itself, queries AD for comoputers, copies itself to any that are reachable and repeats.


 
Posted : 21/12/2016 12:31 pm
Page 1 / 4