This is what explorer looks like when it hangs. ================= Opened log file 'c:\tmp.txt' 0:000> ~ . 0 Id: 22c.230 Suspend: 1 Teb: 7ffdf000 Unfrozen 1 Id: 22c.244 Suspend: 1 Teb: 7ffde000 Unfrozen 2 Id: 22c.2bc Suspend: 1 Teb: 7ffb8000 Unfrozen 0:000> ~0 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 00a3d218 7c90a395 ntdll!RtlSizeHeap+0x42d 00a3d264 7c90a5d1 ntdll!RtlFreeHeap+0x37c 00a3d2e0 7c90aab4 ntdll!RtlFreeHeap+0x5b8 00a3d36c 7c71b19d ntdll!RtlAllocateHeap+0x3b7 00a3d3f4 7c71b2d4 kernel32!FindNextFileA+0x366 00a3d408 7c71b470 kernel32!FindFirstFileExW+0x30 00a3d428 6a371e29 kernel32!FindFirstFileW+0x38 00a3d690 6a38cec9 shell32!ILRemoveLastID+0x1141 00a3dafc 6a3a5f2b shell32!Ordinal96+0x5c57 00a3db44 6a38f4d4 shell32!Ordinal172+0x953 00a3ddb0 6a3a5f2b shell32!Ordinal96+0x8262 00a3ddf8 6a3896f1 shell32!Ordinal172+0x953 00a3e26c 004739e8 shell32!Ordinal96+0x247f 00a3e2d8 0040e2a7 explorer+0x739e8 00a3e320 00416dee explorer+0xe2a7 00a3e80c 00443f2c explorer+0x16dee 00a3e830 77eba719 explorer+0x43f2c 00a3e950 77ebac76 user32!CallWindowProcA+0xc3f 00a3e998 77ebb3bf user32!CallWindowProcA+0x119c 00a3ea04 0041278f user32!SendMessageW+0xef 0:000> ~1 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 016cff2c 7602565b ntdll!KiIntSystemCall+0x6 016cff60 76021148 rpcrt4!RpcNetworkIsProtseqValidA+0xc35 016cff94 7c70db99 rpcrt4!RpcServerListen+0x153 016cffec 00000000 kernel32!CreateThread+0xaa 0:000> ~2 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0172fb80 7c912a47 ntdll!KiIntSystemCall+0x6 0172fb94 7c907d91 ntdll!RtlEnterCriticalSection+0x33 0172fba0 7c90a781 ntdll!RtlIsThreadWithinLoaderCallout+0x42 0172fc2c 7c912702 ntdll!RtlAllocateHeap+0x84 0172fc44 7c90352e ntdll!RtlAllocateActivationContextStack+0x2b 0172fc98 7c904bd2 ntdll!LdrLoadDll+0x4d7 0172fd10 7c90854a ntdll!LdrQueryImageFileExecutionOptions+0xdf8 00000000 00000000 ntdll!KiUserApcDispatcher+0x25 0:000> .logclose Closing open log file c:\tmp.txt This is also what explorer looks like when it hangs. ================= Opened log file 'c:\tmp2.txt' 0:000> ~ . 0 Id: 22c.230 Suspend: 1 Teb: 7ffdf000 Unfrozen 1 Id: 22c.244 Suspend: 1 Teb: 7ffde000 Unfrozen 2 Id: 22c.2bc Suspend: 1 Teb: 7ffb8000 Unfrozen 3 Id: 22c.2c4 Suspend: 1 Teb: 7ffb7000 Unfrozen 4 Id: 22c.2d0 Suspend: 1 Teb: 7ffb6000 Unfrozen 0:000> ~0 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 00a3d218 7c90a395 ntdll!RtlSizeHeap+0x427 00a3d264 7c90a5d1 ntdll!RtlFreeHeap+0x37c 00a3d2e0 7c90aab4 ntdll!RtlFreeHeap+0x5b8 00a3d36c 7c71b19d ntdll!RtlAllocateHeap+0x3b7 00a3d3f4 7c71b2d4 kernel32!FindNextFileA+0x366 00a3d408 7c71b470 kernel32!FindFirstFileExW+0x30 00a3d428 6a371e29 kernel32!FindFirstFileW+0x38 00a3d690 6a38cec9 shell32!ILRemoveLastID+0x1141 00a3dafc 6a3a5f2b shell32!Ordinal96+0x5c57 00a3db44 6a38f4d4 shell32!Ordinal172+0x953 00a3ddb0 6a3a5f2b shell32!Ordinal96+0x8262 00a3ddf8 6a3896f1 shell32!Ordinal172+0x953 00a3e26c 004739e8 shell32!Ordinal96+0x247f 00a3e2d8 0040e2a7 explorer+0x739e8 00a3e320 00416dee explorer+0xe2a7 00a3e80c 00443f2c explorer+0x16dee 00a3e830 77eba719 explorer+0x43f2c 00a3e950 77ebac76 user32!CallWindowProcA+0xc3f 00a3e998 77ebb3bf user32!CallWindowProcA+0x119c 00a3ea04 0041278f user32!SendMessageW+0xef 0:000> ~1 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 016cff2c 7602565b ntdll!KiIntSystemCall+0x6 016cff60 76021148 rpcrt4!RpcNetworkIsProtseqValidA+0xc35 016cff94 7c70db99 rpcrt4!RpcServerListen+0x153 016cffec 00000000 kernel32!CreateThread+0xaa 0:000> ~2 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0172fb80 7c912a47 ntdll!KiIntSystemCall+0x6 0172fb94 7c907d91 ntdll!RtlEnterCriticalSection+0x33 0172fba0 7c90a781 ntdll!RtlIsThreadWithinLoaderCallout+0x42 0172fc2c 7c912702 ntdll!RtlAllocateHeap+0x84 0172fc44 7c90352e ntdll!RtlAllocateActivationContextStack+0x2b 0172fc98 7c904bd2 ntdll!LdrLoadDll+0x4d7 0172fd10 7c90854a ntdll!LdrQueryImageFileExecutionOptions+0xdf8 00000000 00000000 ntdll!KiUserApcDispatcher+0x25 0:000> ~3 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0173fb80 7c912a47 ntdll!KiIntSystemCall+0x6 0173fb94 7c907d91 ntdll!RtlEnterCriticalSection+0x33 0173fba0 7c90a781 ntdll!RtlIsThreadWithinLoaderCallout+0x42 0173fc2c 7c912702 ntdll!RtlAllocateHeap+0x84 0173fc44 7c90352e ntdll!RtlAllocateActivationContextStack+0x2b 0173fc98 7c904bd2 ntdll!LdrLoadDll+0x4d7 0173fd10 7c90854a ntdll!LdrQueryImageFileExecutionOptions+0xdf8 00000000 00000000 ntdll!KiUserApcDispatcher+0x25 0:000> ~4 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0175fb80 7c912a47 ntdll!KiIntSystemCall+0x6 0175fb94 7c907d91 ntdll!RtlEnterCriticalSection+0x33 0175fba0 7c90a781 ntdll!RtlIsThreadWithinLoaderCallout+0x42 0175fc2c 7c912702 ntdll!RtlAllocateHeap+0x84 0175fc44 7c90352e ntdll!RtlAllocateActivationContextStack+0x2b 0175fc98 7c904bd2 ntdll!LdrLoadDll+0x4d7 0175fd10 7c90854a ntdll!LdrQueryImageFileExecutionOptions+0xdf8 00000000 00000000 ntdll!KiUserApcDispatcher+0x25 0:000> ~5 k ^ Illegal thread error in '~5 k' 0:000> .logclose Closing open log file c:\tmp2.txt This is what taskmgr looks like when it doesn't show a window even though you clicked the Task manager button in the Security window. ================= Opened log file 'c:\tmp_taskmgr.txt' 0:004> ~0 k *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\shell32.dll - ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 006bec3c 6a3b4c4c ntdll!KiIntSystemCall+0x6 006bf040 6a3b4cac shell32!Ordinal241+0xd8 *** ERROR: Module load completed but symbols could not be loaded for C:\ReactOS\System32\taskmgr.exe 006bf050 00403efb shell32!Shell_NotifyIconW+0x21 006bf4bc 0040840b taskmgr+0x3efb 006bf730 0040bf50 taskmgr+0x840b *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\user32.dll - 006bf790 77eba719 taskmgr+0xbf50 006bf8b0 77ebb8c5 user32!CallWindowProcA+0xc3f 006bf8dc 77ea473d user32!CallWindowProcW+0xa4 006bf908 77eba719 user32!DefDlgProcW+0x7d 006bfa28 77ebac76 user32!CallWindowProcA+0xc3f 006bfa70 77ebb3bf user32!CallWindowProcA+0x119c 006bfadc 77ea5ebe user32!SendMessageW+0xef 006bfd9c 77ea63c7 user32!EndDialog+0x14c6 006bfdc0 004086d2 user32!DialogBoxParamW+0x9d 006bfef8 0040d885 taskmgr+0x86d2 006bff10 0040d6b3 taskmgr+0xd885 006bff84 0040d715 taskmgr+0xd6b3 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\kernel32.dll - 006bff8c 7c70ad6d taskmgr+0xd715 006bfff0 00000000 kernel32!CreateProcessW+0xd4 0:004> ~1 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0124ff14 0040b240 ntdll!KiIntSystemCall+0x6 0124ff94 7c70db99 taskmgr+0xb240 0124ffec 00000000 kernel32!CreateThread+0xaa 0:004> ~2 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0144f934 00406531 ntdll!KiIntSystemCall+0x6 0144ff94 7c70db99 taskmgr+0x6531 0144ffec 00000000 kernel32!CreateThread+0xaa 0:004> ~3 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 016cfb2c 0040578c ntdll!KiIntSystemCall+0x6 016cff94 7c70db99 taskmgr+0x578c 016cffec 00000000 kernel32!CreateThread+0xaa 0:004> ~4 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 016dfff4 00000000 ntdll!DbgBreakPoint 0:004> ~5 k ^ Illegal thread error in '~5 k' 0:004> .logclose Closing open log file c:\tmp_taskmgr.txt This is what explorer looks like at that time. ================= Opened log file 'c:\tmp_explorer.txt' 0:000> ~0 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 00a3d218 7c90a395 ntdll!RtlSizeHeap+0x424 00a3d264 7c90a5d1 ntdll!RtlFreeHeap+0x37c 00a3d2e0 7c90aab4 ntdll!RtlFreeHeap+0x5b8 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\kernel32.dll - 00a3d36c 7c71b19d ntdll!RtlAllocateHeap+0x3b7 00a3d3f4 7c71b2d4 kernel32!FindNextFileA+0x366 00a3d408 7c71b470 kernel32!FindFirstFileExW+0x30 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\shell32.dll - 00a3d428 6a371e29 kernel32!FindFirstFileW+0x38 00a3d690 6a38cec9 shell32!ILRemoveLastID+0x1141 00a3dafc 6a3a5f2b shell32!Ordinal96+0x5c57 00a3db44 6a38f4d4 shell32!Ordinal172+0x953 00a3ddb0 6a3a5f2b shell32!Ordinal96+0x8262 00a3ddf8 6a3896f1 shell32!Ordinal172+0x953 *** ERROR: Module load completed but symbols could not be loaded for C:\ReactOS\explorer.exe 00a3e26c 004739e8 shell32!Ordinal96+0x247f 00a3e2d8 0040e2a7 explorer+0x739e8 00a3e320 00416dee explorer+0xe2a7 00a3e80c 00443f2c explorer+0x16dee *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\user32.dll - 00a3e830 77eba719 explorer+0x43f2c 00a3e950 77ebac76 user32!CallWindowProcA+0xc3f 00a3e998 77ebb3bf user32!CallWindowProcA+0x119c 00a3ea04 0041278f user32!SendMessageW+0xef 0:000> ~1 k *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\rpcrt4.dll - ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 016cff2c 7602565b ntdll!KiIntSystemCall+0x6 016cff60 76021148 rpcrt4!RpcNetworkIsProtseqValidA+0xc35 016cff94 7c70db99 rpcrt4!RpcServerListen+0x153 016cffec 00000000 kernel32!CreateThread+0xaa 0:000> ~2 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0172fb80 7c912a47 ntdll!KiIntSystemCall+0x6 0172fb94 7c907d91 ntdll!RtlEnterCriticalSection+0x33 0172fba0 7c90a781 ntdll!RtlIsThreadWithinLoaderCallout+0x42 0172fc2c 7c912702 ntdll!RtlAllocateHeap+0x84 0172fc44 7c90352e ntdll!RtlAllocateActivationContextStack+0x2b 0172fc98 7c904bd2 ntdll!LdrLoadDll+0x4d7 0172fd10 7c90854a ntdll!LdrQueryImageFileExecutionOptions+0xdf8 00000000 00000000 ntdll!KiUserApcDispatcher+0x25 0:000> ~3 k ^ Illegal thread error in '~3 k' 0:000> .logclose Closing open log file c:\tmp_explorer.txt When Ctrl+Alt+Del doesn't work any more. First taskmgr and then explorer. ================= Opened log file 'c:\tmp_nocad.txt' 0:004> ~0 k *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\shell32.dll - ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 006bec3c 6a3b4c4c ntdll!KiIntSystemCall+0x6 006bf040 6a3b4cac shell32!Ordinal241+0xd8 *** ERROR: Module load completed but symbols could not be loaded for C:\ReactOS\System32\taskmgr.exe 006bf050 00403efb shell32!Shell_NotifyIconW+0x21 006bf4bc 0040840b taskmgr+0x3efb 006bf730 0040bf50 taskmgr+0x840b *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\user32.dll - 006bf790 77eba719 taskmgr+0xbf50 006bf8b0 77ebb8c5 user32!CallWindowProcA+0xc3f 006bf8dc 77ea473d user32!CallWindowProcW+0xa4 006bf908 77eba719 user32!DefDlgProcW+0x7d 006bfa28 77ebac76 user32!CallWindowProcA+0xc3f 006bfa70 77ebb3bf user32!CallWindowProcA+0x119c 006bfadc 77ea5ebe user32!SendMessageW+0xef 006bfd9c 77ea63c7 user32!EndDialog+0x14c6 006bfdc0 004086d2 user32!DialogBoxParamW+0x9d 006bfef8 0040d885 taskmgr+0x86d2 006bff10 0040d6b3 taskmgr+0xd885 006bff84 0040d715 taskmgr+0xd6b3 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\kernel32.dll - 006bff8c 7c70ad6d taskmgr+0xd715 006bfff0 00000000 kernel32!CreateProcessW+0xd4 0:004> ~1 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0124ff14 0040b240 ntdll!KiIntSystemCall+0x6 0124ff94 7c70db99 taskmgr+0xb240 0124ffec 00000000 kernel32!CreateThread+0xaa 0:004> ~2 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0144f934 00406531 ntdll!KiIntSystemCall+0x6 0144ff94 7c70db99 taskmgr+0x6531 0144ffec 00000000 kernel32!CreateThread+0xaa 0:004> ~3 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 016cfb2c 0040578c ntdll!KiIntSystemCall+0x6 016cff94 7c70db99 taskmgr+0x578c 016cffec 00000000 kernel32!CreateThread+0xaa 0:004> ~4 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0103fff4 00000000 ntdll!DbgBreakPoint 0:004> ~5 k ^ Illegal thread error in '~5 k' 0:004> .detach Detached NoTarget> .attach explorer.exe WARNING: The debugger does not have a current process or thread WARNING: Many commands will not work Couldn't resolve error at 'explorer.exe' NoTarget> | WARNING: The debugger does not have a current process or thread WARNING: Many commands will not work ^ Illegal thread error in '|' NoTarget> || WARNING: The debugger does not have a current process or thread WARNING: Many commands will not work ^ Illegal debuggee error in '||' NoTarget> .logclose WARNING: The debugger does not have a current process or thread WARNING: Many commands will not work Closing open log file c:\tmp_nocad.txt Opened log file 'c:\tmp_nocad.txt' 0:000> ~0 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 00a3d218 7c90a395 ntdll!RtlSizeHeap+0x42a 00a3d264 7c90a5d1 ntdll!RtlFreeHeap+0x37c 00a3d2e0 7c90aab4 ntdll!RtlFreeHeap+0x5b8 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\kernel32.dll - 00a3d36c 7c71b19d ntdll!RtlAllocateHeap+0x3b7 00a3d3f4 7c71b2d4 kernel32!FindNextFileA+0x366 00a3d408 7c71b470 kernel32!FindFirstFileExW+0x30 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\shell32.dll - 00a3d428 6a371e29 kernel32!FindFirstFileW+0x38 00a3d690 6a38cec9 shell32!ILRemoveLastID+0x1141 00a3dafc 6a3a5f2b shell32!Ordinal96+0x5c57 00a3db44 6a38f4d4 shell32!Ordinal172+0x953 00a3ddb0 6a3a5f2b shell32!Ordinal96+0x8262 00a3ddf8 6a3896f1 shell32!Ordinal172+0x953 *** ERROR: Module load completed but symbols could not be loaded for C:\ReactOS\explorer.exe 00a3e26c 004739e8 shell32!Ordinal96+0x247f 00a3e2d8 0040e2a7 explorer+0x739e8 00a3e320 00416dee explorer+0xe2a7 00a3e80c 00443f2c explorer+0x16dee *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\user32.dll - 00a3e830 77eba719 explorer+0x43f2c 00a3e950 77ebac76 user32!CallWindowProcA+0xc3f 00a3e998 77ebb3bf user32!CallWindowProcA+0x119c 00a3ea04 0041278f user32!SendMessageW+0xef 0:000> ~1 k *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\ReactOS\system32\rpcrt4.dll - ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 016cff2c 7602565b ntdll!KiIntSystemCall+0x6 016cff60 76021148 rpcrt4!RpcNetworkIsProtseqValidA+0xc35 016cff94 7c70db99 rpcrt4!RpcServerListen+0x153 016cffec 00000000 kernel32!CreateThread+0xaa 0:000> ~2 k ChildEBP RetAddr WARNING: Stack unwind information not available. Following frames may be wrong. 0172fb80 7c912a47 ntdll!KiIntSystemCall+0x6 0172fb94 7c907d91 ntdll!RtlEnterCriticalSection+0x33 0172fba0 7c90a781 ntdll!RtlIsThreadWithinLoaderCallout+0x42 0172fc2c 7c912702 ntdll!RtlAllocateHeap+0x84 0172fc44 7c90352e ntdll!RtlAllocateActivationContextStack+0x2b 0172fc98 7c904bd2 ntdll!LdrLoadDll+0x4d7 0172fd10 7c90854a ntdll!LdrQueryImageFileExecutionOptions+0xdf8 00000000 00000000 ntdll!KiUserApcDispatcher+0x25 0:000> ~3 k ^ Illegal thread error in '~3 k' 0:000> .logclose Closing open log file c:\tmp_nocad.txt