Add or remove programs not populating a list

heckler55 · September 21, 2011

Hi there,

I'm running xp pro (sp3) and add or remove programs wont populate a list, it stays blank with the message "please wait while the list is populating". which it never does. I have had this for a while so i had a complete reinstall done which hasn't fixed the problem. I have done a scan (using a cmd box prompt and install disk) to find any programs/files that might be damaged or missing, and MS has a kB article related to this subject, but only if you are getting a partial population and tried some other opotions i found googling the subject, but still no joy. Any thoughts? i know others have this problem, but no-one has posted a solution that works.

Thanks!

RandyL · September 21, 2011

So you did a complete reinstall and the problem still exists? Does this happen immediately after the reinstall? Is there anything else that is slow to open immediately after the reinstall?

The reason I ask is because this either indicates a hard drive, ram or malware issue.

A failing drive can cause it. A bad drive will slow things down.

Failing or insufficient ram can cause it. SP3 alone needs a lot of ram.

Malware can cause it. Anything using resources will slow things down but some malware will purposely try to prevent you from getting into add/remove.

What programs have you installed?

What antivirus do you have?

What amount of memory do you have?

Any torrent software?

A few timelines and details please.

heckler55 · September 21, 2011

Hi RandyL,

Yep, complete reinstall and problem still exists. I had the reinstall done to try and fix this and an "unable to system restore" issue. A quick rundown of what has been done recently - Complete rebuild after Virus. (system presented with viruses, unable to remove and therefore rebuild required).

- imaged machine

- installed operating system

- Re-installed client provided programs

- Transferred avaliable dada

- Tested ok.

Virus Clean - Ran numerous virus scans and removed all threats

- Removed unnecessary programs and files

- Ran hardware diagnostics

- Completed extensive Pc maintenance

- Tested ok.

So, i have 13.2 GB space on the C: drive. I am running Bitdefender for security and as far other programs go, i'm only running what is on the installation disk plus Firefox, Adobe reader and Bigpond (my i.s.p), No torrent software is used.

I should now have a "clean" computer (the virus removal ect. was done last week) is it possible that there is still malwear lurking?

RandyL · September 21, 2011

How much memory do you have (RAM)? How many different sticks?

What hardware diagnostics did you run?

- imaged machine
- installed operating system
- Re-installed client provided programs
- Transferred avaliable dada

Are you saying you made a complete image of drive C then ran it after reinstalling?

When did you run those virus scans? Before or after the reinstall?

heckler55 · September 22, 2011

Hi,

According to my paperwork, the order of proceedings was as above so it was imaged, then O/S was installed. The virus cleaning was done a week previous to the install (not as my list shows) and they were unable to remove it (or them) and so rebuilt. No mention of virus cleaning AFTER rebuild, although i have run bitdefender since and it found nothing. I have 1GB of RAM with 1 stick. I cant be more specific re:hardware diagnostics as i wasn't present when it was done and its not listed on my paperwork.

RandyL · September 22, 2011

I have seen malware prevent the list from populating. Granted that was some time back. If they made an image of your drive and reimaged after the reinstallation they may have put the malware right back on again. I think I will ask our malware team what they think.

I don't know who worked on your machine or exactly what they did. For instance the imaging, the diagnostics, the malware scans and the method of reinstallation. What I do know is that if they did a complete reinstallation then immediately tried to open the list then it should have populated unless there is a hardware issue such as bad ram or failing drive.

Is everything else working ok?

Do you have the Windows or recovery disks?

I'll await the malware teams opinion on this.

heckler55 · September 22, 2011

Hi RandyL,

This is turning into quite the noggin scratcher isn't it? Everything else works fine and i have the windows installation disk which was used to reinstall and i have used it to run SFC /Scannow in cmd (which found nothing missing or damaged or made any changes).

Thanks again for your time.

Starbuck · September 22, 2011

Hi heckler55

Let's have a good look and either discount or point to malware.

The reports i need will tell us a lot.

Step 1

Download aswMBR and save it to your desktop.

Double click the aswMBR.exe to run it.
The latest version gives you the option of adding the latest Avast definitions:

http://img.photobucket.com/albums/v708/starbuck50/new/03-07-201116-24-19.png
It is recommended at this time to click NO. ( as there is a possibility of crashing the system)
Click the Scan button to start scan.

http://img.photobucket.com/albums/v708/starbuck50/new/asw1.gif

On completion of the scan click Save log and save it to your desktop.

http://img.photobucket.com/albums/v708/starbuck50/new/asw2.gif

Please post this in your reply.

NOTE:

aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it for now.

Step 2

Download OTL to your desktop.
right click on the link and select 'Save Link/Target As'.

if you have problems, try this download link:
OTL
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check

.

http://img.photobucket.com/albums/v708/starbuck50/new/Otllatest.png

netsvcs

msconfig

%SYSTEMDRIVE%\*.*

%systemroot%\system32\Spool\prtprocs\w32x86\*.dll

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\system32\*.exe /lockedfiles

%systemroot%\System32\config\*.sav

%PROGRAMFILES%\*

%USERPROFILE%\..|smtmp;true;true;true /FP

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

hklm\software\clients\startmenuinternet|command /rs

hklm\software\clients\startmenuinternet|command /64 /rs

CREATERESTOREPOINT

right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.

http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
.
Click the Run Scan button.

http://img.photobucket.com/albums/v708/starbuck50/runscan.png
Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

In your next reply, please submit:

aswMBR report

and both reports from OTL

Thanks.

heckler55 · September 23, 2011

Thanks Starbuck,

Run date: 2011-09-23 08:49:26

-----------------------------

08:49:26.937 OS Version: Windows 5.1.2600 Service Pack 3

08:49:26.937 Number of processors: 1 586 0x602

08:49:26.953 ComputerName: PHIL-PC UserName: Phil

08:49:34.843 Initialize success

08:50:39.093 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

08:50:39.093 Disk 0 Vendor: WDC_WD400JB-00ENA0 05.03E05 Size: 38166MB BusType: 3

08:50:41.109 Disk 0 MBR read successfully

08:50:41.109 Disk 0 MBR scan

08:50:41.109 Disk 0 Windows XP default MBR code

08:50:41.109 Disk 0 scanning sectors +78140160

08:50:41.187 Disk 0 scanning C:\WINDOWS\system32\drivers

08:50:52.312 Service scanning

08:50:54.031 Modules scanning

08:51:00.468 Disk 0 trace - called modules:

08:51:00.500 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys

08:51:00.500 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8675eab8]

08:51:00.500 3 CLASSPNP.SYS[f786ffd7] -> nt!IofCallDriver -> \Device\0000005c[0x867bf788]

08:51:00.500 5 ACPI.sys[f77e6620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86762030]

08:51:01.031 Scan finished successfully

08:51:59.312 Disk 0 MBR has been saved successfully to "C:\Program Files\Mozilla Firefox\MBR.dat"

08:51:59.312 The log file has been saved successfully to "C:\Program Files\Mozilla Firefox\aswMBR.txt"

heckler55 · September 23, 2011

and...............OTL Extras logfile created on: 23/09/2011 9:05:28 AM - Run 1

OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\Phil\My Documents\Downloads

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

1023.48 Mb Total Physical Memory | 652.62 Mb Available Physical Memory | 63.76% Memory free

2.40 Gb Paging File | 1.99 Gb Available in Paging File | 82.96% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 37.26 Gb Total Space | 14.40 Gb Free Space | 38.66% Space Free | Partition Type: NTFS

Computer Name: PHIL-PC | User Name: Phil | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management

"80:TCP" = 80:TCP:*:Disabled:Windows Remote Management - Compatibility Mode (HTTP-In)

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe -- (NVIDIA Corporation)

"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer

"C:\Program Files\Telstra\Mobile Broadband Manager\SwiApiMuxX.exe" = C:\Program Files\Telstra\Mobile Broadband Manager\SwiApiMuxX.exe:*:Enabled:SwiApiMuxX -- (Sierra Wireless, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java 6 Update 22

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{55294054-43EC-4BAB-B603-3AC69294DAA5}" = BigPond Media Downloader

"{5AEB2D83-71F1-4C6F-BFA0-54FDEA0E4BBC}" = Telstra Mobile Broadband Manager

"{82AF3E91-57E1-4754-84D0-40A46E2479AB}" = OpenOffice.org 3.3

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 275.33

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 275.33

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.85

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.3.5

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components

"{B6CA7A3C-35FD-401F-9335-FFFD2BCD5FF3}" = BitDefender Internet Security 2011

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"BitDefender" = BitDefender Internet Security 2011

"C-Media Audio Driver" = C-Media WDM Audio Driver

"ie8" = Windows Internet Explorer 8

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Mozilla Firefox 6.0.2 (x86 en-GB)" = Mozilla Firefox 6.0.2 (x86 en-GB)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager

"Picasa 3" = Picasa 3

"Q++ World Clocks Desktop Wallpaper_is1" = Q++ World Clocks Desktop Wallpaper 2.0 (BETA)

"Recuva" = Recuva

"Sherlock Holmes and The Hound of The Baskervilles" = Sherlock Holmes and The Hound of The Baskervilles (remove only)

"Telstra Mobile Broadband Manager" = Telstra Mobile Broadband Manager

"VIA Audio Driver Setup Program" = VIA Audio Driver Setup Program

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 3

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 18/09/2011 9:23:42 PM | Computer Name = PHIL-PC | Source = Application Error | ID = 1000

Description = Faulting application msimn.exe, version 6.0.2900.5512, faulting module

ntdll.dll, version 5.1.2600.6055, fault address 0x00010a19.

Error - 19/09/2011 3:57:36 AM | Computer Name = PHIL-PC | Source = Application Error | ID = 1000

Description = Faulting application telstraucm.exe, version 3.1.909.3, faulting module

unknown, version 0.0.0.0, fault address 0x0188d273.

Error - 20/09/2011 1:59:05 AM | Computer Name = PHIL-PC | Source = Application Error | ID = 1000

Description = Faulting application telstraucm.exe, version 3.1.909.3, faulting module

unknown, version 0.0.0.0, fault address 0xf137871b.

Error - 21/09/2011 1:46:42 AM | Computer Name = PHIL-PC | Source = Application Error | ID = 1000

Description = Faulting application telstraucm.exe, version 3.1.909.3, faulting module

unknown, version 0.0.0.0, fault address 0x01369b59.

Error - 21/09/2011 6:57:28 AM | Computer Name = PHIL-PC | Source = Application Error | ID = 1000

Description = Faulting application telstraucm.exe, version 3.1.909.3, faulting module

telstraucm.exe, version 3.1.909.3, fault address 0x001b73bf.

Error - 21/09/2011 7:27:42 PM | Computer Name = PHIL-PC | Source = Application Error | ID = 1000

Description = Faulting application msimn.exe, version 6.0.2900.5512, faulting module

ntdll.dll, version 5.1.2600.6055, fault address 0x00010a19.

Error - 22/09/2011 10:28:54 AM | Computer Name = PHIL-PC | Source = Application Hang | ID = 1002

Description = Hanging application mbam.exe, version 1.51.0.1118, hang module hungapp,

version 0.0.0.0, hang address 0x00000000.

Error - 22/09/2011 10:29:15 AM | Computer Name = PHIL-PC | Source = Application Hang | ID = 1002

Description = Hanging application mbam.exe, version 1.51.0.1118, hang module hungapp,

version 0.0.0.0, hang address 0x00000000.

[ System Events ]

Error - 22/09/2011 6:43:30 PM | Computer Name = PHIL-PC | Source = Disk | ID = 262151