Laptop with Win XP Pro. (Here because all of you were once there)

PC running for days never off.

Some apps run some do not.
Seems for example Thunderbird starts but never shows up on screen.
Others similar.

Boot the PC and I can run Thunderbird.
But Apps with built in update capability will never update through the app.

Let the PC sit idle for hours came back and some apps will not start
including Thunderbird.

Not matter where I try to start an app it will not show up on screen.
Shortcut on desktop, in the Start menu etc are all no go for certain apps.

On 8/23/2022 3:01 PM, Josh wrote:
> Laptop with Win XP Pro. (Here because all of you were once there)
>
> PC running for days never off.
>
> Some apps run some do not.
> Seems for example Thunderbird starts but never shows up on screen.
> Others similar.
>
> Boot the PC and I can run Thunderbird.
> But Apps with built in update capability will never update through the app.
>
> Let the PC sit idle for hours came back and some apps will not start including Thunderbird.
>
> Not matter where I try to start an app it will not show up on screen.
> Shortcut on desktop, in the Start menu etc are all no go for certain apps.
>

You could run a copy of Sysinternals Process Monitor, an older
version that still supports Windows XP.

WinXP does not have a health report like some of the other OSes do,
so you don't have the convenience of checking there for details.

The Event Viewer may not offer any hints either.

On Windows XP, I don't think the loader particularly cares about
anything, except loading stuff :-) If you have an AV program
loaded, or even if you have remnants of an expired AV onboard,
an AV takes an interest in the loader and what it is doing.
And for "exploited" materials, it could drop the loader in its
tracks (by denying IO perhaps).

And on a more modern OS, I can give an example of how lame
the loader is. If you attempt to start a Metro App by
double clicking the EXE, those do not load that way.
However, the EXE file happens to be a "normal executable"
as well, except it is a "null executable". It has no code
body and just... exits. Double clicking the thing,
causes the screen to flash, and then, there is no log in
the Event Viewer or anything. So it is possible, on a newer
OS, to have "bogus behavior" of that type. In the sense that
no notification appears on the screen to say "you idiot,
don't click those" or similar :-)

I prefer attenuated computer responses to be accompanies
with a notification, at least if the behavior is legit and
above board. If it is malware, then there is no requirement
to inform the user malware did it.

If it was a limitation of pages pool or unpaged pool,
I don't know how that would manifest itself.

But my first step would be Process Monitor. You could
start it after a reboot, in the File menu, untick the
capture box so it stops capturing. And only turn capturing
back on, just before clicking something expected to not respond.
Then check the trace for clues.

https://superuser.com/questions/1131344/how-to-use-procmon-on-windows-xp-get-an-error-about-initializesrwlock

It seems that the ProcMon from May 13, 2014 version 3.10 works on XP.

Available for download from

https://web.archive.org/web/20140625080651/http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx

Paul

"Josh" <Josh@JoshInSpam.com> wrote
| | Some apps run some do not.
| Seems for example Thunderbird starts but never shows up on screen.
| Others similar.
|

In addition to what Paul said, also get autoruns while
you're getting procmon. Make sure nothing is going online.
It sounds like you have some cleanup to do. Make sure
browser caches are small or nonexistent. Also, why
do you leave the laptop running? Turn it off or put it in
sleep mode.