Fix this laptop?

A work colleague brought a friend’s laptop to me yesterday for me to have a look at. I’ve fixed it now, but it was an interesting problem, so I thought you lot might like a punt at diagnosing it.

Symptoms are, every few minutes Explorer shuts down leaving just the desktop (no icons, no task bar). You can restart Explorer from Task Manager (File / Run Task / Explorer), it comes back up normally and is fine for a few minutes before closing again.

If you want to play along, ask me questions and see if you can diagnose the fault. I’ll be as honest as I can, but will be a “user” and not volunteer information you don’t ask for.

What do we do with it?

Anything in the startup items folder in the start menu?

What do we do with it?

Reply, “ooh, tricky, i can have a look – would you fetch me a coffee and a donut?”

I’ll be as honest as I can, but will be a “user” and not volunteer information you don’t ask for.

Hello Mister,

I am calling from your bank. To protect your security please confirm your credit card number, PIN and mother’s maiden name.

Thanking you.

If some media players don’t get a response from what they are asked to play, they can cause Explorer to restart & you’ll loose taskbar etc whilst this happens.

Is it a corrupt media file?

Anything in the startup items folder in the start menu?

Nope.

If some media players don’t get a response from what they are asked to play, they can cause Explorer to restart & you’ll loose taskbar etc whilst this happens.

Is it a corrupt media file?

It’s not playing media. It happens continually.

Corruption in the registry? Something wrong with explorer.exe?

What OS, version and build?

Needs switching off and then back on again.

Multiple AV programs installed?

Did you try turning it off and then on again?

Edit : Bollocks! 30 seconds too slow.

have you installed anything like winzip, winrar or a new anti virus program recently?

What version of windows?
What services & programs are running?
When did it start happening?

I’ll go with Malware for the moment, or a corrupt dll..
sfc /scannow should fix a corrupt dll

Anything in the windows event logs?

PICNIC

Problem In Chair Not In Computer

I would be looking in the logs for something not responding

Turn off windows search

Run a disk check

Unplug all peripherals in case it is choking on something external

But, is there some sort of add on like winzip, c cleaner appearing in the right click menu?

Oh, and is the problem every few minutes when it is idle or when you are working?

Corruption in the registry? Something wrong with explorer.exe?

Dunno, how would we check that?

What OS, version and build?

Good question. It’s Windows 7 Home Pro, x64. Didn’t check the build.

Multiple AV programs installed?

Webroot is installed, no other AV.

have you installed anything like winzip, winrar or a new anti virus program recently?

Not to my knowledge. I asked what had changed recently and was told “nothing” in a user-y fashion.

What services & programs are running?
When did it start happening?

Various things, what are you looking for?

I’ll go with Malware for the moment.

What do we do about that then?

Anything in the windows event logs?

Another good question. Nope.

Turn off windows search

I didn’t think to do that, but it’s not relevant here.

Run a disk check

Good. Chkdsk finds no problems.

Unplug all peripherals in case it is choking on something external

Only thing attached is keyboard and mouse.

But, is there some sort of add on like winzip, c cleaner appearing in the right click menu?

I can’t remember exactly but probably not. Nothing that raised suspicion, anyway.

Oh, and is the problem every few minutes when it is idle or when you are working?

Both.

Did your coputer update itself reently? Did windows update run, or did your anti virus software suggest any application should be updated?

Does it do it in safe mode too?

Are the intervals very regular?

Tried SFC?

What brand/model of laptop is it?

Did your coputer update itself reently? Did windows update run, or did your anti virus software suggest any application should be updated?

It’s not had a Windows Update in a while as far as I can see. The AV hasn’t reported anything for a while either.

Does it do it in safe mode too?

No.

Are the intervals very regular?

It seems to be pretty regular, yes. You can’t work on it for more than a few minutes without it happening.

despite it being suggested twice already . inkeeping with what my it department do when ever you progress through the levels of ” i cant fix this heres my supervisor”

have you tried turning it off and back on again 😀

Various things, what are you looking for?

At this point, I would probably do what you are doing and ask for the laptop, there are too many services and processes to check which a glance can quickly see if there are any abnormal things running. 😉

Still interested in the solution though!

Did sfc /scannow fix a corrupt dll?

Tried SFC?

Good. SFC reports no issues.

Are there any local security policies setup? Does it have the same problem with a different user?

What brand/model of laptop is it?

It was an Acer that looked like it’d had a hard life, I don’t remember the exact model though.

there are too many services and processes to check which a glance can quickly see if there are any abnormal things running.

Nothing jumped out as being obviously abnormal.

I’ll go with Malware for the moment.

What do we do about that then?[/quote]

If it’s malware, I would probably download a bootable virus/malware checker and let that run. Sometimes I find it quicker to just re-install the system than spending hours trying to find the problem, some malware can be long-winded to remove.

Does it do it in safe mode too?
No.

So it’s not explorer itself at fault, it’s a driver or something that happens regularly.

I’d be timing it. If it’s very regular then it’s some job that’s set to happen on a regular basis that is crapping out.

What’s in the startup programs list? Post a list? Or just tell me if it’s not one of them.

Are there any local security policies setup? Does it have the same problem with a different user?

Ooh, interesting thinking. I didn’t check secpol, but I’ll say “no.” There was only one user account and it didn’t occur to me to create another to see, but I’d expect it would still be symptomatic.

Is it supplied by Plusnet? (who’ll “do you in proud?”) – If so you’ll never find out what’s wrong with it and the only solution is to move country.

Is there a scheduled task or app trying to shutdown the ‘puter?
Is the battery/power supply ok – no flames or billowing smoke?

It was an Acer that looked like it’d had a hard life

Fan exhausts full of crap? Heat bad 🙂

Install the latest display drivers.

Has that fixed it?

Have you whacked it really hard with your elbow?

Always worked for the Fonz.

… resource exhaustion? (Disk Full).

Have you hoovered the keyboard?

If it’s malware, I would probably download a bootable virus/malware checker and let that run.

Malwarebytes was already installed at the advice of the colleague who brought it to me. It found “a couple of things” but I’ve no idea whether these were problems or false positives.

I’d be timing it. If it’s very regular then it’s some job that’s set to happen on a regular basis that is crapping out.

It’s every five minutes.

What’s in the startup programs list? Post a list? Or just tell me if it’s not one of them.

I did a selective startup via msconfig, disabling all non-MS services. Still symptomatic.

run msconfig and disable everything in the startup.

reboot.

working?

if so, enable one at a time until it breaks 🙂

Does it still occur if you disable all network adaptors?
Is there any removable media inserted? SD card, CD etc.

Is there a scheduled task or app trying to shutdown the ‘puter?

We have a winner! Though, credit should also go to Molgrips who was on the same lines. I thought that would take a lot longer, curses. (-: Here’s the first part of the story:

In Scheduled Tasks there was an oddly named task, “vyi” or something. This task was scheduled to run every five minutes, and executed c:\ch.vbs. ch.vbs is a one-liner script which launches c:\ch.bat. ch.bat is another one-liner, TASKKILLing Explorer.exe.

The next question is… how / why?

Petty virus?