On Mon, 2 Jan 2006 19:48:00 -0500, "Don Cohen"

>I have run into trouble with my daughter's computer. It is running XP Home,
>and used for online chatting and email primarily. I run NAV 2005 and
>ZoneAlarm Free on it, and check periodically with AdAware and SpyBot S&D.
>It has SP2 installed, and configured to automatically install Critical
>Updates. But it's been a few months since I've been up there to check

>Yesterday morning she told me it was starting odd problems:

>1. Sometimes after a reboot, the desktop icons do not appear.

Can be shell, can be a user profile thing (e.g. wrong path to
"desktop" location, or a setting to hide desktop icons, is in effect)

>2. When "1" occurs, if I attempt to open Control Panel, nothing happens

Could also be shell, settings (such as the right to access Control
Panel is suppressed; unlikely, if it displays so you can attempt to
open it) or a malware intercept effect.

>3. When "1" occurs, if I try to access System Properties with the Windows
>Key+Break shortcut, I get an error message:
> c:\windows\system32\rundll32.exe
> The parameter is incorrect

That looks more like malware, possibly via shell integration.

>4. The Quick Launch toolbar disappears after every reboot. I tried Doug
>Knox's fix (Windows XP doesn't remember user settings) without success.

>5. When I re-enable Quick Launch, the desktop icon shows correctly, but all
>the others are "generic."

>6. When I hit the Start button, the quick access entries at the top are
>also "generic."

>7. Often, a right-click on the desktop produces no action whatsoever.

>8. Often when trying to run a program from the Start Menu, "Explorer"
>crashes.

All of the above look like possible shell issues.

1) Formal virus check. Unless you are a Bart CDR fundi, you will
prolly skip this as "too difficult" and rely on some weaker method
(e.g. scanning from Safe Mode) to "exclude" malware.

2) Check ChkDsk/AutoChk and resident antivirus logs to see if
anything relevant (i.e. system code) was "fixed" by these

3) Consider a trial of System Restore rollback to before yesterday

4) Clear temp files, web caches, check file system for errors

5) Download and use NirSoft's Shall Extensions Viewer from
www.nirsoft.net to reversably disable shell integrations, starting
with non-Microsoft items. Apply similar logic via MSConfig.

6) Check hardware - a "static" failure pattern like this, with no
STOP errors or lockups, doesn't sound like RAM - but could be a bad
sector within a relevant code file

Does Safe Mode work OK?
Does it help to disable all browser enhancements in IE?
Do you have active desktop disabled? (recommended)

>I have rerun SpyBot, NAV2005 and AdAware, found a few cookie files and a
>registry entry or two, but this hasn't changed the problem

OK

>The biggest suspect: ZoneAlarm. Apparently at some point recently, she
>inadvertently took the bait and did a trial upgrade to ZoneAlarm Security
>Suite. The trial period ran out (all unbeknownst to me), and I think this
>is about when this all started to go down the tubes. One of the first
>things I tried to do was uninstall it. My first attempt was unsuccessful
>with "Explorer" crashing.

NirSoft and MSConfig may be able to pinpoint that.

>I guess I could try a "Repair" to XP Home via the install CD, but then I'll
>have to reinstall SP2 and all the updates. I'd rather find a more
>'surgical' repair if one is possible.

Absolutely! "Repair" usually doesn't - see...

http://cquirke.mvps.org/reinst.htm

Is your HD > 137G?
What is your XP installation file set's SP level?
If the CD is older than SP1, do you have SP2 slipstreamed into it?

If HD > 137G, installing (repair or otherwise) the original version of
XP, and to a lesser extend the SP1 version, will be dangerous. That's
because support for > 137G has to be there in the OS from the start,
and this is faulty in SP1 and totally absent before SP1.





>---------- ----- ---- --- -- - - - -
Don't pay malware vendors - boycott Sony
>---------- ----- ---- --- -- - - - -