Only Keyboard & Not Mouse Can Start Programs

[Dobermann]

I have an extremely clean XP-P box with virtually nothing installed on it and no internet connection having been made yet with it. It does the strangest thing.

If I double click on any program icon or its name in explorer or even right click on it in explorer and select a program to open it, all it does is give me the little hour glass for a couple of seconds and then disappears when I move my mouse. None of the programs ever open up.

However, if I press Enter with the icon selected or use keyboard shortcuts, such as MSFlag+E, I can open the program.

I have tried to see what is running via right click on task bar and selecting Task Manager, but as to be expected, it will not start. C+A+D and selecting Task Manager sadly will not either.

When I try to shutdown, it hangs on Saving System Settings and I have to use the master power button.

I have never seen anything like this before. I would at first think that it is not getting enough power, but this does not make sense because I am able to use the keyboard to make the simple programs work (explorer, Notepad, Textpad).

Any ideas?
Thanks
Dobermann

[stapp]

Tried a different mouse?

Does the same thing happen in safe mode?

What mouse are you using?

[philby]

I have tried to see what is running via right click on task bar and selecting Task Manager, but as to be expected, it will not start. C+A+D and selecting Task Manager sadly will not either.

Will Ctrl + Shift + Escape open TM?

[philby]

Also, have you checked for any problem under 'Mice and other pointing devices' under devmgmt.msc?

Maybe the driver has got screwed up...

[Carver]

How about a check disk and a sfc/scannow.

[Dobermann]

-{ Quote: "Tried a different mouse?" }-
Same problem

-{ Quote: "Does the same thing happen in safe mode?" }-
Nope! Tasklist /svc yields these three svchosts running:
dcomLaunch
RpcSs
CryptSvc, dmserver, helpsvc, winmgmt

but wow, it took forever to load past mup.sys


-{ Quote: "What mouse are you using?" }-
Kensington, both a wireless and USB

Now, something very interesting happened, please read response below, which is why I listed the running svchosts

[Dobermann]

-{ Quote: "Will Ctrl + Shift + Escape open TM?" }-

In all my many years, I have never known about this keyboard shortcut. How beautiful it was! This did display the TM where I found one of 4 or 5 svcshost files running. It was using all available CPU, pinning my CPU usage graph to a constant 100%. I was able to do a right click, End Process Tree on it. Once that happened, the world was flat! The mouse worked, double clicking restored, CPU usage fell.

Now, since it was ended, when I did Tasklist /svc, it was not listed. Just the three lines I listed above. If I try to run Tasklist /svc without having Ended this hog, it will eventually reboot on its own rather than displaying the services.

My next step,
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost

to see which ones are set to run. My guess is that I will have to first kill the hog. Will report back...

[Dobermann]

-{ Quote: "Also, have you checked for any problem under 'Mice and other pointing devices' under devmgmt.msc?

Maybe the driver has got screwed up..." }-

No problem items whatsoever (which is a good thing).

[Dobermann]

-{ Quote: "How about a check disk and a sfc/scannow." }-

Have not tried this yet, as I think I might be on to the root of the problem.

[Dobermann]

Well, I searched the Reg Key noted above, but nothing seemed out of place to me. Here is a text file of its contents:



Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
Class Name: <NO CLASS>
Last Write Time: 10/17/2009 - 6:13 PM
Value 0
Name: HTTPFilter
Type: REG_MULTI_SZ
Data: HTTPFilter

Value 1
Name: LocalService
Type: REG_MULTI_SZ
Data: Alerter
WebClient
LmHosts
RemoteRegistry
upnphost
SSDPSRV

Value 2
Name: NetworkService
Type: REG_MULTI_SZ
Data: DnsCache

Value 3
Name: netsvcs
Type: REG_MULTI_SZ
Data: 6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Messenger
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
wscsvc
xmlprov
BITS
wuauserv
ShellHWDetection
helpsvc
WmdmPmSN

Value 4
Name: DcomLaunch
Type: REG_MULTI_SZ
Data: DcomLaunch
TermService

Value 5
Name: rpcss
Type: REG_MULTI_SZ
Data: RpcSs

Value 6
Name: imgsvc
Type: REG_MULTI_SZ
Data: StiSvc

Value 7
Name: termsvcs
Type: REG_MULTI_SZ
Data: TermService


Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\DComLaunch
Class Name: <NO CLASS>
Last Write Time: 10/17/2009 - 6:10 PM
Value 0
Name: CoInitializeSecurityParam
Type: REG_DWORD
Data: 0x1

Value 1
Name: DefaultRpcStackSize
Type: REG_DWORD
Data: 0x8


Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\HTTPFilter
Class Name: <NO CLASS>
Last Write Time: 10/17/2009 - 10:43 AM
Value 0
Name: CoInitializeSecurityParam
Type: REG_DWORD
Data: 0x1


Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService
Class Name: <NO CLASS>
Last Write Time: 10/17/2009 - 10:43 AM
Value 0
Name: CoInitializeSecurityParam
Type: REG_DWORD
Data: 0x1

Value 1
Name: AuthenticationCapabilities
Type: REG_DWORD
Data: 0x2000


Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs
Class Name: <NO CLASS>
Last Write Time: 10/17/2009 - 6:10 PM
Value 0
Name: CoInitializeSecurityParam
Type: REG_DWORD
Data: 0x1

Value 1
Name: AuthenticationCapabilities
Type: REG_DWORD
Data: 0x3020


Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\PCHealth
Class Name: <NO CLASS>
Last Write Time: 10/17/2009 - 6:11 PM
Value 0
Name: CoInitializeSecurityParam
Type: REG_DWORD
Data: 0x2

Value 1
Name: AuthenticationCapabilities
Type: REG_DWORD
Data: 0x40


Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs
Class Name: <NO CLASS>
Last Write Time: 10/17/2009 - 6:10 PM
Value 0
Name: CoInitializeSecurityParam
Type: REG_DWORD
Data: 0x1

Value 1
Name: DefaultRpcStackSize
Type: REG_DWORD
Data: 0x8



There are 5 svchost.exe files running. The resource hog has a user name of System. I only have 18 processes running from all users, one of which is the hog.

Isn't there a better way to see what exactly is behind this svchost? I remember seeing a s/w a while back that would detail it, but I cannot remember its name.

Thanks for all the help,
Dobermann

[stapp]

Process Explorer?

Also any clues showing in your Event Viewer?

[philby]

As stapp says, PE should shed more light on those svchosts.

Maybe also check task scheduler - I've found some weird things running there on some machines.

[Dobermann]

PE looks like a great tool. I tried it on this computer. Too bad that I cannot start it on the bum one! There are no keyboard shortcuts to start the program, and the mouse like before will not start it. If I stop the hog in TM, I can then start PE, but since the service is stopped, PE can't help me. Sounds like a catch 22. >:(

I forgot to check Event Viewer and Task Scheduler, but I really do not think there are any tasks scheduled, as I usually even disable this service. I will have to check them out tomorrow evening and report back.

[Dobermann]

Created a desktop shortcut, assigned a Shortcut key C+A+P. When I tried it, it would not load even though it was attempted to be started via a keyboard and not the mouse.

Event Viewer - I need a keyboard shortcut to try to make it run.

Scheduled Tasks - None.

===========

Update, finally it let me load PE with my keyboard shortcut, but just when it comes up, the computer reboots. So now I have put a shortcut to it in the Startup Programs. Gotcha you sucker! PE loads and runs for about two minutes before it locks up. But, here is the scoop:

It is Windows\System32\svchost.exe (some qualifiers I could not write down before it died)
Net Service
PID 932

I now remember that the other day when it booted up it had a slash through the network icon. I wonder if it is trying to connect to my server and the network card is non-functional. Yet I would think that it would not log on to the computer upon booting if it could not connect to the network and my DHCP server. I input UserID, Password and Domain, give it a moment, and it loads up.

It's a dual boot with <eek> Win98SE. I wonder if I would have the same problems in that OS. It would be interesting to find out.

I think this box has basically seen better days. I've kept it together with duct tape for the last how many years now? (Athlon 1200 CPU bought at its hayday), basically cannibalizing this and that from here and there to keep it running. Sadly, as it has my SCSI, Zip drive, tape drive, 4 HDs and all the older stuff that I can't just trash since I have never taken the time to bring the data files forward to newer media and capacity.

It's a bitch getting old :'(

[philby]

Event Viewer - I need a keyboard shortcut to try to make it run.

Winkey + R, then type eventvwr.msc

[philby]

Isn't there a better way to see what exactly is behind this svchost? I remember seeing a s/w a while back that would detail it, but I cannot remember its name.

I've never used this (http://svchostviewer.codeplex.com/) and don't know if it'll give you anything more than you've already got, but maybe it's worth a look.