2

I have two Windows XP SP3 workstations, one of them is recently freshly installed. The workstations are connected to a Windows 2003 server with a cabled local network.

The problem I have is that after a random time (varying from 2 minutes to several hours) the explorer hangs on one of the workstations. Explorer does not hang simultaneously on both systems.

Running Process Monitor does not reveal anything special going on in Explorer, but everything freezes until Explorer is killed.

This problem must be a network and/or 2003 server problem.

What I need is a method to find the cause. The Win2003 logs, including the Kerio firewall log, do not reveal anything special when the Explorer hangs.

I understand there can be a plethora of possible causes: so I would be grateful for a method or a tool to diagnose this problem. I simply do not know where to start.

Problem solved? I have powered down one of the PC's (the one which was to be replaced). Since then the other PC has not given me any trouble. I must assume in some way the first PC made trouble on the network. At least one thing I noticed was that network traffic (like copying files) was painfully slow on that machine. However, the network interface cannot have been the problem, since it occurred with a 1 GB interface card and with the built-in 100 MB network interface. I'm still puzzled. But I want to thank all you contributers for thinking with me. It was much appreciated.

Rocky Luck
  • 21
  • 3
  • To clarify: if it happens, it almost always happens when you right-click a file. For instance the recycle bin. – Rocky Luck May 29 '09 at 19:50

8 Answers8

1

I've seen this happen with duplicate hostname and / or IP addresses.

squillman
  • 37,618
  • 10
  • 90
  • 145
1

Rocky: Are these clean installs of Windows XP SP3, or have you installed third-party software? If so, what have you installed? (I'm thinking specifically of anti-virus software, but it could be anything-- drivers, etc).

It sounds like a Shell Extension is running amok, but I can't substantiate that. It really could be just ab out anything.

I'd be curious to see what the call stack looks like when Explorer "hangs". Process Explorer can get you that information. If you can get a reasonable terse log from Process Monitor to post somewhere I'd be glad to take a look.

Evan Anderson
  • 141,071
  • 19
  • 191
  • 328
  • Both machines run Avira Antivir virus scanners. Both Windows firewalls are disabled. A typical process list can be found here: ftp://92.64.74.129/ReadOnly/Explorer%20Problem/TypicalProcessList.txt I'll keep Process Explorer running, so it will be there when the hanging occurs. – Rocky Luck Jun 02 '09 at 09:47
0

Various reasons why this can happen, like you said, but one I've seen in the past is caused by a redirected "My Documents" folder; all the desktop.ini files at the next level down get parsed by Explorer to produce custom icons for subfolders, and if there are a lot of folders in there Explorer can sometimes just give up.

Maximus Minimus
  • 8,937
  • 1
  • 22
  • 36
  • Thanks. It also happens on the freshly installed xp station. So, I'm not sure how the My Documents folder could get redirected. – Rocky Luck May 29 '09 at 19:46
0

On the server open up a command box and start a continuous ping to the IP addresses of your two clients:

ping ip.address.of.client -t

Then go back to the clients and try to re-create the Explorer hang. The ping should give you an indication if you are actually losing your network connection between the machines.

Also make sure the server and clients are all patched and up to date with all their Windows updates.

Dennis Williamson
  • 60,515
  • 14
  • 113
  • 148
Codejnki
  • 66
  • 3
  • If I kill the explorer process, the network connection is back immediately (if it was gone at all). Also I always have a program called FAR running, which is sort of a substitute for explorer. That program keeps the connection and can still be used. All systems are patched up to the very last level. – Rocky Luck May 29 '09 at 20:27
  • While it is locked up does the ping from the server to the workstation die as well? Next thing I'd do is make sure you have the latest network drivers for your card. If you have an alternate card you can test with see if you have different results. – Codejnki Jun 02 '09 at 19:56
  • Both PC's use totally different network cards (one a 100MBit built-in, the other a 1GBit additional card with the built-in network card disabled in BIOS). – Rocky Luck Jun 03 '09 at 09:41
  • Drivers are updated to the last level – Rocky Luck Jun 04 '09 at 09:16
0

Were the new machines slipstream installed with XP SP3? If so, there are some documented issues with slipstream SP3 vs upgrade from SP2. I'll look for some links about the specific issues (because I don't have them handy right now) and post them in an edit on this post.

-JFV

EDIT: Okay, I lied... I can't find anything that's documented about it... But I know that there are issues with a straight slipstreamed SP3 installation because I've encountered some of them at my location. I'll try to update if I find some links...

JFV
  • 751
  • 1
  • 7
  • 15
0

I'd start with shexview and disable all the shell extensions. If the problem goes away, re-enable them gradually until you have found the culprit.

(Old versions of TortoiseCVS/SVN could have crashed the Explorer in exactly this way when TSVNCache started to scan the network shares for repositories, but usually it recovered after 5-10 minutes.)

If the problem persists, and it happens when you enter a folder on a network share, try to disable all antivirus (both on the client and on the server you accessed).

(There once was a version of GDT Antivirus which reproducibly crashed the Explorer if you only entered a directory, left it (by backspace), entered it again, left it again and entered it a third time within 5-10 seconds. Use a directory where there a files in which require network access for fetching their icons, like .exe or .ico. Or which use thumbnail view.)

If the problem still persists, no idea, sorry.

mihi
  • 820
  • 1
  • 7
  • 13
0

There's a significant amount of information that you need to provide in order to diagnose the problem.

  • Are your machines joined to the domain?
  • Are your users running as local administrators?
  • What group policies, have you configured if any?
  • What error does explorer produce in the Event Viewer, if any?

Why 'must' it be a server / network issue? After looking over your post, I can't see anything that would stand out as the server / network being the cause.

Your best place to start hunting for the solution is at the PC's. I would begin by:

  • Unplug the PC from the network. See if the problem occurs unplugged.

  • If the problem still occurs, it's an issue with the windows installation. Use CCleaner to pick up bad registry keys and delete them. Could also be a firewall issue (either Windows or Kerio)

  • If the problem occurs when the PC is plugged in only, then expand your search to the network configuration of the two PC's. Do they have identical hostnames? IP addresses?

  • Is your firewall software just not playing cricket with your network? Uninstall it and see if the problem persists. I have seen some antivirus applications cause a significant headache in a domain environment (of course if you're using one).

My guess is you have a crazy shell extension that probably doesn't like Windows XP SP3. Make a list of all of your non standard applications that have a shell extension, and use the application's options to disable that shell extension.

EvilChookie
  • 248
  • 1
  • 3
  • 8
  • The machines are in a WorkGroup, not a domain. The users are local administrators. No group policies are configured. No errors in the logs. It's a server/network problem, because it occurs on a freshly installed XP. CCleaner did not reveal any problems. It is not a problem of the two PC's being in the same network: the PC on which XP is freshly installed is there because the other PC started to exhibit this behavior. The firewall is disabled. Shell Extensions was the first thing I thought about. But the freshly installed XP machine has the same problem. – Rocky Luck Jun 02 '09 at 10:15
  • If they're in a work group, I would not be surprised if Explorer were trying to crawl the shares on your Server, and crashing due to a lack of credentials or something crazy like that. Do you have the ability to join one of the PC's to a domain, and see if that fixes the problem? – EvilChookie Jun 02 '09 at 17:18
0

JFV sort of hit on this, but you may want to consider not installing SP3. Try having them with all of the patches at the SP2 level and see if they run for a while or not. I have heard (all-be-it anecdotal) SP3 has caused problems with some people's XP installations, such as weird explorer problems happening. Personally I have not experience these issues, but I would be willing to run it as an SP2 machine and see what happens.

squillman
  • 37,618
  • 10
  • 90
  • 145
Matt
  • 433
  • 1
  • 5
  • 10