Explorer Hangs on Right Click

Help,

My computer all of a sudden is acting up. Some basic actions take a long time and when I right click on image files in explorer to preview them, the system hangs.

Here are the specs to my machine

Dell Dimension 5150
3.4 GHz P4 with 2GB RAM
170 GB hard drive with 23% free space
Running Windows XP Media Center 2002 SP2

I routinely defrag my drive with Executive Software. It currently has 0 fragments.
I run Zone Alarm Pro, AdAware, SpyBot, and F-Prot antivirus, all of these are regularly updated

Could this possibly be related to my rejecting the MS Update to calidate my Windows installation and MS Software? (I do have legal software - I just do not like that this patch will ping MS every other week with my data).

Attached is my Hijack This log

Any help would be greatly appreciated!

 

Additional Information

I did some more research and uncovered a possible cause for this problem. On another BBS someone wrote the following

"Recent Windows XP Updates Cause Freeze on Desktop Right Click ". Microsoft's patch adds a executable file called Verclsid.exe, which validates shell extensions before they are loaded by the Windows Shell or Windows Explorer. HP's Share-to-Web Namespace Daemon (Hpgs2wnd.exe) causes Verclsid.exe to stop responding. Sunbelt Kerio Personal Firewall asks for user approval before allowing Verclsid.exe to do its work. When this occurs, Verclsid's execution stops until the user clicks through Kerio's notification dialog.

I found a program called Version ID check that was blocked by my Zone Alarm firewall. I gave Version ID permission and access and still had the problem. I then shut down Zone Alarm and the right click is now working (after a few quick tests).

I realize that Zone Alarm is not the best firewall. I have plans to switch to a hardware firewall in early 2007. In the meantime, does this help diagnose and fix the problem? It is not a viable solution to shut down my firewall.

 

HiJack This Log

Thanks for looking at this Pete:

Logfile of HijackThis v1.99.1
Scan saved at 5:59:33 PM, on 8/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\FSI\F-Prot\fpavupdm.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\Iomega\REV System Software\RevUDF.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\FSI\F-Prot\F-Sched.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\FSI\F-Prot\F-StopW.EXE
C:\DOCUME~1\CHIPLE~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Iomega\REV System Software\imiconxp.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chip Levinson\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\system32\BhoCitUS.dll
O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: GoogleAFE - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe "
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [Iomega ImIconXP] C:\Program Files\Iomega\REV System Software\imiconxp.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk.disabled
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O9 - Extra button: Citi - {4C730913-3961-439b-83D5-F4E445520422} - C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.dtek.biz
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.4.4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: RevUDFService - Iomega Corp - C:\Program Files\Iomega\REV System Software\RevUDF.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

I will look into your suggestion

Thanks Pete, I will check with a Zone Alarm Forum and let you know what I learn.

 

You can check that pretty easily - it will actually be running as a service and you can disable it even though it will come right back. However, by disabling it, you'll have enough time to determine if this actually is the cause of your problem. You can then google Verclsid.exe and get the Windows Service Patch or KB # associated with this and uninstall it. Microsoft has since updated this patch and the new one won't cause the same "hang ". I had to find this out the hard way on someones machine and I was getting darn close to a repair install untill I started going through Services one by one. Good Luck - hope thats it.

 

Mr. Chip--The latest version of ZoneAlarm Free is 6.5.731.0. I think Pro also has a new version with that number.
The last 2-3 versions of ZA prior to the latest did some strange things. It blocked changes to the HOSTS file and the Homepage even when those setting were "off ".
Perhaps you have discovered another bug.
If you do not have the latest version of ZA, you might try it.

 

ZAP Version

Thank you for your suggestion. I have Zone Alarm Pro 6.5.722.000. I checked and this is the latest version of the Pro software.

 

Can't Find Service to Disable

Rockster2U,

Thanks for the suggestion. I could not find the service listed to disable it. I looked under Services, but it was not listed. I also checked Task Manager to see if it was a process that I could stop, but I did not find it there either.

 

Great Tip

Arie,
Thanks for the great tip. I bookmarked this page. I downloaded and ran the utility. Unfortunately, it did not flag anything as a likely cause for the problem.

I then started to uninstall the MS Security Update that gave me the verclsid.exe in the first place. It gave me a warning that about a dozen other patches may not work properly if I uninstall this patch. So I decided to take the quick and easy route. I renamed verclsid.exe to verclsid.oldexe. Now when I try to preview pictures the preview works instantaneously!!

Am I introducing any risks by disabling verclsid.exe?

Thanks!
Mr. Chip

UPDATE
This fix seemed too good to be true. I am still having problems. Now when I try to change the background on my desktop the screen properties hang and rundll32 grabs 50% of my CPU capacity. I turned verclsid.exe back on by removing the old extension. I still have the problem with changing my desktop.

 

You can uninstall the update and then, as said earlier - Microsoft has since updated this patch and the new one won't cause the same "hang ".

 

Still Have Problems

Rockster2U,

Thanks for the suggestion. I did what you said but am still having the same problems. When I went to reinstall the update it said it was version 2.1.

Could this be at all related to the fact that I have not installed the Windows Validation Tool? I am really stumped on this.

When I right click on the first file in a directory full of jpegs, Explorer takes 50% of my CPU and does nothing for about 60 seconds then gives up.

Any suggestions?

Mr. Chip

 

I ran into this issue on a machine where Security update 908531 had been installed and a right cklick on an open desktop would hang for a few minutes. When I first noticed this I thought it was some kind of malware. This was a machine I built and it was a speed demon with very little mileage on it. The owner didn't think much of it but it bothered me and I kidnapped it for a couple of days and found the problem quite by accident. When I uninstalled the original patch and then re-installed the newer version, all problems disappeared. Here is what Microsoft has to say about this.

As to your Genuine Advantage question. Personally, I would not install the WGA notification. This will cause no harm if its not on your system. As to the WGA verification (a different program), you don't have much choice unless you wish to pass on all but critical updates and even those may require the verification at this point in time. Its tough keeping up with Microsoft on these as they keep changing them, including what they do and how they do it. What started out as a browser plug in is quite different these days.

 

Latest Update

Rockster2U,

Thank you so much for helping me debug this!!

Here is the latest thing I tried. I used the program shexview to see all of the shell extensions on my computer. Then I followed their advice to look at the Context Menu Handlers since they affect what shows up when you right click. I disabled all of them and rebooted my computer. I still have the same problem!

Here is some more data. As you know, I uninstalled and reinstalled 908531 to no avail. When I first right click in Explorer it hangs for about 60 seconds then gives up. If I try to right click again it works immediately. The problem with changing the background image does not repair itself after the first time. Every time I try to change my background image it hangs. This in of itself is not a big deal as I rarely change the image. However, I'm sure it is symptomatic of why my computer slows down on other activities.

At this point should I try the regitry edits MS suggests in the article your referenced? As far as I can tell I do not have the HP Share to Web s/w and I am using Zone Alarm Pro - not the Kerio firewall mentioned.

MORE INFO - I also noticed that after the first time Explorer hangs my antivirus software F-Prot seems to be turned off. The two icons that usually show at the bottom right of the screen go away. After I removed the Context Menu Handler for F-Prot, the Explorer problem no longer affects the F-Prot program. Not sure if this helps...

 

More Info

Rockster2U,

I just remembered that one area where I am feeling the pain is when I use Corel PaintShop Pro X. This program was much better before Corel bought it from JASC and added a bunch of poor code - but that is off topic.

Since this right click problem came up everything that I try to do with my images runs S-L-O-W-L-Y with PSPX. Is this helpful to know?

 

More data...

A new development,

While browsing the web all of a sudded a pop-up error message said that I chose to close Run a DLL as an App. Here is the information:

Error Signature
szAppName : rundll32.exe szAppVer : 5.1.2600.2180 szModName : hungapp
szModVer : 0.0.0.0 offset : 00000000

C:\DOCUME~1\CHIP~1\LOCALS~1\Temp\WERb111.dir00\rundll32.exe.mdmp
C:\DOCUME~1\CHIP~1\LOCALS~1\Temp\WERb111.dir00\appcompat.txt

Is this related?

 

The guy who we really need to jump back in here is Arie - he is the master of the shell and this certainly isn't my area of expertise. Rather than trying to give you mixed signals which may do more harm than good, its best for me to defer to those who are much more knowledgeable with this type of problem. I appreciate your confidence but if it sounds like I'm beating a drum of retreat, I am.