Start menu stop working

Hey

I've searched around and haven't found any soloutions for my problem.

I got a problem where my start menu stop working, it feels like it's totaly random and if i kill explorer.exe and start it again that helps it, but i would like a permanent help for this.

It's quite a while since i first got it so i don't recall all programs i installed and unistalled :/

You guys have any idea?

 

Hi, zappe.

Event Viewer might provide some details about what might be the cause of your problem.

Instructions About How to Access and Use "Event Viewer ":

• Click Start.
• Right-click My Computer.
• Select "Manage" to open the "Computer Management" window.
  (Event Viewer will be displayed under the "System Tools" directory item.)
• Expand "Event Viewer" and then select "Application ", "Security ", and "System" to view the logs.
• Look for "error" events that occurred around the time your problem occurred. These events will be displayed as icons with either a white X on red background or a black exclamation point on yellow background. In the security section of Event Viewer, events of possible concern are ones that display a padlock icon instead of a key icon.
• Double-click on an individual event to open the "Event Properties" window which shows details about the event.
  • You can use the up/down arrow buttons in the "Event Properties" window to move your focus to other events in the list.
  • Use the button below the up/down arrows to copy the details for an event to your clipboard for pasting elsewhere.
  • Click on the "http://go.microsoft.com/fwlink/events.asp" link in the "Event Properties" window to view more information from Microsoft about the event.

 

Perhaps Windows XP's System File Checker (SFC) will help you resolve your issue.

• Have your Windows XP CD handy because you may be prompted to insert it into your CD drive during this process.
• Click Start > Run...
• Type [FONT= "Courier New"][SIZE= "3"]sfc /scannow[/SIZE][/FONT] in the "Open:" field.
• Click the OK button.

A "Windows File Protection" window will open and display its progress. If SFC runs successfully without any intervention from you, it will take approximately 15-25 minutes to complete. When SFC completes, the "Windows File Protection" window will simply disappear.

To see any changes that may have been made by SFC after it completes:

• Click Start > Run...
• Type [FONT= "Courier New"][SIZE= "3"]eventvwr.msc[/SIZE][/FONT] in the "Open:" field.
• Click the OK button.
• Click the "System" item on the left side of the "Event Viewer" window.

Any changes made by SFC will be displayed (in reverse order) as "Windows File Protection" events between Event ID 64016 (Windows File Protection started) and 64017 (Windows File Protection completed).

Double-click on an event (or right-click on the event and select "Properties ") to view details about the event. You can use the up/down arrow buttons on the right side of the event's "Properties" window to view details about adjacent events without having to close the event's "Properties" window.

If you want to copy event details to your clipboard (for pasting into Notepad or a forum message, for example), use the button immediately below the up/down arrow buttons in the event's "Properties" window.

 

Yeah, i got 6 errors their, though nothing happens when i click the link, it's just ask me if i want to send the information and then i press OK and nothing happens

shall i paste the info here?


testing the SFC now, standby

done now... i got 6 entries.. 2 from tcpip.sys, 2 from uxtheme.dll and 2 from vgx.dll

does that solve it?

 

Yes, the more details you provide, the more likely someone can help your resolve your issue. The specific error information might lead us to a solution more quickly. The filenames you provided (without more details about the exact nature of the errors) doesn't give us much to go on.

Perhaps SFC replaced the necessary missing/corrupted files and your problem is already fixed. If so, please let us know so others with the same or similar problem may benefit.

 

the problem i got my windows in swedish, i'll try to translate it as good as i can

3 like this!
---------------------------
Eventtype: Error
Event source: Application Hang
Eventcategory: (101)
Event-ID: 1002
Date: 2007-03-11
Time: 13:33:25
User: Missing
Computer: ZAPPE
Description:
Stopped program explorer.exe, version 6.0.2900.2180, stopped module hungapp, version 0.0.0.0, stopped address 0x00000000.

Mer information finns i Hjälp- och supportcenter på sidan http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 65 78 70 6c 6f 72 explor
0018: 65 72 2e 65 78 65 20 36 er.exe 6
0020: 2e 30 2e 32 39 30 30 2e .0.2900.
0028: 32 31 38 30 20 69 6e 20 2180 in
0030: 68 75 6e 67 61 70 70 20 hungapp
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00
---------------------------
1 like this
---------------------------
Eventtype: Information
Event source: Winlogon
Eventcategory: None
Event-ID: 1002
Date: 2007-03-11
Time: 13:33:28
User: Missing
Computer: ZAPPE
Description:
Windows-shell closed unexpected and Explorer.exe has rebooted.

Mer information finns i Hjälp- och supportcenter på sidan http://go.microsoft.com/fwlink/events.asp.
-------------------------------
3 like this!
-------------------------------
Eventtype: Error
Event source: Application Hang
Eventcategory: None
Event-ID: 1001
Date: 2007-03-11
Time: 13:33:31
User: Missing
Computer: ZAPPE
Description:
Fel-bucket 127043675.

Mer information finns i Hjälp- och supportcenter på sidan http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 31 32 37 30 34 33 36 37 12704367
0010: 35 0d 0a 5..
--------------------------
Next these errors from the SFC
-----------------------------
Eventtype: Information
Event Source: Windows File Protection
Eventcategory: None
Event-ID: 64020
Date: 2007-03-13
Time: 02:06:56
User: Missing
Computer: ZAPPE
Description:
Under the file search it emerged that the system file c:\windows\system32\drivers\tcpip.sys has an illegal signatur. This file is restored to it's till den original version to maintain system stability. The illegal file version is 5.1.2600.2892.

Mer information finns i Hjälp- och supportcenter på sidan http://go.microsoft.com/fwlink/events.asp.
-----------------------------
Eventtype: Information
Event source: Windows File Protection
Eventcategory: None
Event-ID: 64020
Date: 2007-03-13
Time: 02:06:57
User: Missing
Computer: ZAPPE
Description:
Under the file search it emerged that the system file c:\windows\system32\drivers\tcpip.sys has an illegal signatur. This file is restored to it's till den original version to maintain system stability. The illegal file version is 5.1.2600.2180.

Mer information finns i Hjälp- och supportcenter på sidan http://go.microsoft.com/fwlink/events.asp.
----------------------------------
Eventtype: Information
Event Source: Windows File Protection
Eventcategory: None
Event-ID: 64020
Date: 2007-03-13
Time: 02:07:45
User: Missing
Computer: ZAPPE
Description:
Under the file search it emerged that the system file c:\windows\system32\uxtheme.dll has an illegal signatur. This file is restored to it's till den original version to maintain system stability. The illegal file version is 6.0.2900.2180.

Mer information finns i Hjälp- och supportcenter på sidan http://go.microsoft.com/fwlink/events.asp.
------------------------------------
Eventtype: Information
Event source: Windows File Protection
Eventcategory: None
Event-ID: 64004
Date: 2007-03-13
Time: 02:07:46
User: Missing
Computer: ZAPPE
Description:
It wasn't able to restore the protected system file c:\windows\system32\uxtheme.dll to the till den valid original version. The illegal file version is 6.0.2900.2180 Following error code was returned: 0x800b0100 [There were no signatur in the subject field.
].

Mer information finns i Hjälp- och supportcenter på sidan http://go.microsoft.com/fwlink/events.asp.
----------------------
Eventtype: Information
Event source: Windows File Protection
Eventcategory: None
Event-ID: 64020
Date: 2007-03-13
Time: 02:07:49
User: Missing
Computer: ZAPPE
Description:
Under the file search it emerged that the system file c:\program\delade filer\microsoft shared\vgx\vgx.dll has an illegal signatur. This file is restored to it's till den original version to maintain system stability. The illegal file version is 6.0.2900.3051.

Mer information finns i Hjälp- och supportcenter på sidan http://go.microsoft.com/fwlink/events.asp.
-------------------------------
Eventtype: Information
Event source: Windows File Protection
Eventcategory: None
Event-ID: 64020
Date: 2007-03-13
Time: 02:07:50
User: Missing
Computer: ZAPPE
Description:
Under the file search it emerged that the system file c:\program\delade filer\microsoft shared\vgx\vgx.dll has an illegal signatur. This file is restored to it's till den original version to maintain system stability. The illegal file version is 6.0.2900.2180.

Mer information finns i Hjälp- och supportcenter på sidan http://go.microsoft.com/fwlink/events.asp.
----------------------------

And now it has stopped working again.. and i get no events in the logs :/

What to do?

 

Hi, zappe.

Thanks for posting your error details.

I'm guessing SFC fixed the files described in your Windows File Protection events (tcpip.sys, uxtheme.dll, and vgx.dll).

If you run [FONT= "Courier New"][SIZE= "3"]sfc /scannow[/SIZE][/FONT] again, those events should no longer be listed in your Event Viewer's "System" events for that run. There should be nothing listed in Event Viewer's "System" section between Event ID 64016 (Windows File Protection started) and 64017 (Windows File Protection completed) after you have run SFC again.


Regarding your other Event Viewer error events:

I Googled "Event source: Application Hang" explorer.exe and got about 56 results.

I Googled "Event-ID: 1002" Winlogon and got about 554 results.

I Googled Bucket 12704367 and got only about 25 results (actually only 10 after Google omitted some entries very similar to the 10 already displayed).

EDIT: I Googled Bucket 127043675 (note the additional "5" at the end of the numerical string) and got about 141 results (some including discussions of explorer.exe).

I'm sorry I don't know exactly which of those search results (if any) will help. I suggest reading through some of those and see if anything triggers any ideas in your mind. (Perhaps one of those situations described will closely match your situation.)

NOTE: If you read any EventID.Net pages, you will probably see "Mxxxxxx" links (where the xxxxxx are 6 numerical digits). If you click on those links, you will be told the information "is only available to EventID.Net subscribers ". When I had a paid subscription to EventID.Net, I found those "Mxxxxxx" links often had the same or similar information found in Microsoft "KBxxxxxx" Knowledge Base (KB) articles for FREE (with the same xxxxxx digits as the Mxxxxxx links).

In such situations, search the Microsoft Support Knowledge Base for KBxxxxxx (with the appropriate numerical digits displayed for the "Mxxxxxx" links on EventID.Net).

It's probably best to access Microsoft Knowledge Base (KB) articles with Internet Explorer. I have found other web browsers (such as Firefox) have trouble rendering Microsoft KB web pages properly.


If you discover a solution or you think of any more information that might be helpful for us to help you, please provide details.

 

i runned the SFC again and the uxtheme.dll and vgx.dll where still there though.

I'm going to check out the google links soon.

didn't find much in the google links though.. mostly other problems..

guess i need to reinstall windows..

 

Hi, zappe.

I'm sorry I don't have more specific suggestions (less drastic than reinstalling Windows XP) regarding your issues. Perhaps someone else with more expertise will come along and offer suggestions.

If you consider the reinstallation route, then I suggest you carefully read the entire MS KB315341 article before proceeding.

• MS KB315341 Article: How to perform an in-place upgrade (reinstallation) of Windows XP

In any case, if you solve your problem(s), please provide details about what you did so others with the same or similar problems may benefit.

Good luck!

 

Why not give the Security forum a look at your HJT log? I see reference to files being changed to illegal versions. It's worth a shot.

Also please see.

And also some of these.

 

Seems like a good idea, surferdude.

zappe, to expand on surferdude's suggestion,

1. Please carefully follow all the instructions in this link.
2. Then start a new thread in the "Removing Spyware & Viruses" forum (with a descriptive thread title).
3. Post details about what you did and what you discovered, including what scans you performed and detailed results of those scans.
4. Also include a link back to this thread so the anti-malware experts have some background info about why you are including your HJT log.
5. Then paste your HijackThis (HJT) log in your post for the anti-malware experts to look over.
6. Wait for expert guidance before proceeding further.

CAUTION: Do not have HJT "fix" anything without carefully following expert guidance. You can potentially render your computer unstable or even unbootable.

 

I've done that now!

Thanks for your help so far!

 

Continued here: http://www.windowsbbs.com/showthread.php?t=63177

Charles