Posted 14 September 2009 - 05:10 PM
Acer laptop, using integrated keyboard and trackpad, running Windows XP SP 3.
Had been running okay, then Mum reported that it was hanging. Mouse was non-responsive, but would sometimes jump around.
I had a look, tried lots of things and made it worse.
So, first off, booting to Safe Mode is fine. Keyboard and mouse work fine for hours.
Second, booting to regular mode, it was getting to login screen. It froze before I could select the account and enter the password.
Used safe mode to autologin. Just have time to hit ctrl-alt-del which starts task manager. Machine appears to run fine at 50 to 60% CPU... just the mouse and keyboard do not respond.
A bit more on how I got there, since I improved some things before making them worse.
From safe mode used system restore to back up a month or so.
Booted fine... but CPU was running at 60 to 80% when idle. McAfee Hacker Watch (HWAPI) was using all the CPU.
Ran full anti-virus scan. Nothing reported.
Ran full F-Secure BlackLight Rootkit Eliminator. Nothing reported.
Ran quick and then full Malware Bytes scan. Reported two registry errors that prevent MS from report antivirus and firewall stopped.
Other than hacker watch everything looked okay. Looked at the internet and it suggest heavy McAfee CPU if component got corrupted. Solution: Uninstall and reinstall McAfee.
So I disconnected from the internet, uninstall McAfee and rebooted.
Thats is where I am upto today. Without HWAPI it appears that the keyboard and mouse freeze. They work momentarily after automated login, but not long enough to do anything.
It is not hardware related... since it works just fine in safe mode.
Not sure what to do next. MSConfig does not seem to let me reset services and startup programs in safe mode (well maybe the programs work don't run any more).
Keyboard and mouse lock up before login (when it had the login screen), so I suspect a service rather than startup (login) program.
There are no scheduled tasks.
From safe mode, can I reconfigure the services that will be used at next regular boot?
Is there a better way of attacking this problem?
I have file by file backup of the server from about three months ago. It is a very low use machine, probably not had anything installed other than MS patches since the backup.