Win2k restart/shutdown problem

[time]

Customer runs Windows 2000 Pro. He's vague, but a few months ago it started hanging with a blank screen when he tries to do a restart. It gets through the 'saving your settings' part, then blackness (and sometimes a cursor), but only the big switch (or reset) gets it any further.

And now for the interesting bit.

After uninstalling all identifiable device drivers, he took the hard drive out and copied the contents to a new, different drive in a new box with different hardware. After installing new drivers on the new drive in the new box, it hangs at shutdown.

After checking some of the info on the web, I'm stumped. I need tips on where to begin here ...

 

[Will Rickards]

He's got the latest service packs and all that jazz?
Have you searched the knowledgebase: support.microsoft.com?

 

[Buck]

Have you checked for spyware, virii, worms and all their friends?

 

[time]

Yes (SP4) and the MS info I've turned up so either hasn't been useful or hasn't been relevant (eg XP only). It doesn't mean that it isn't there, just that I haven't found it.

There was one that talked about copy protection software, but the file concerned wasn't on the computer.

 

[time]

Have you checked for spyware, virii, worms and all their friends?

I can't see any wormsign yet, and his copy of NOD32 is up to date. It's something I plan to investigate further, but he doesn't use IE or Outbreak.

BTW, like a lot of my tricky problems, the PC is about 600 miles away. :-?

 

[Buck]

Your customer seems quite reasonable using NOD32 and not using IE or OE. Nonetheless, I mentioned the issue with spyware simply because I had a customer with a similar issue. Unbeknownst to her, she was downloading spyware automatically with her fancy emoticon attachment software for email. Once that software was uninstalled and the system cleaned of any spyware infections, all was well.

PS: Don't rely on Micosoft's current anti-spyware. As usual, they've adulterated perfectly good software.

PPS: Does the customer have any externally attached USB storage devices?

 

[Fushigi]

My W2K workstation at home does this as well. Been doing it for at least a couple of months now. I've no idea why, but my gut instinct tells me it's related to the network config.

Nothing of interest in event viewer. Totally up to date on MS patches, AVG, CounterSpy, Tiny Personal Firewall, yada yada.

It hasn't been a huge concern since I don't reboot that often, but it is annoying.

BTW, I'm trialing NOD32 on my wife's PC and it halts Shutdowns by trying to access the FD when there's no disk in the drive. I have to click Continue twice before it'll shut down. I've not seen any config options that fix this; I won't be buying the software because of it.

 

[Buck]

BTW, I'm trialing NOD32 on my wife's PC and it halts Shutdowns by trying to access the FD when there's no disk in the drive. I have to click Continue twice before it'll shut down. I've not seen any config options that fix this; I won't be buying the software because of it.

My reply has to be: :eekers:

I've installed this on 50+ machines (old and new) so far without ever seeing this issue.

 

[Will Rickards]

Is NOD32 what has been generating that message on my machine? (XP Home) I don't have to click continue it will eventually restart on its own.
This might be a new thing because I don't remember experiencing it before.
I don't remember if I had the problem on the my win2k build. I replaced it with XP about one to two months ago. Actually I think I did have the problem then too. Because I was surprised it followed me when I did a fresh install of windows XP. That is if my memory is reliable which it often isn't.

Try uninstalling NOD32.

 

[Fushigi]

It didn't start until NOD32 was installed. This was a clean XP Pro SP2 install with all updates applied.

I won't uninstall it until I've determined a replacement. Another install of AVG or something else. Maybe FProt or Trend's product (despite their goofup earlier this year).

Also, I haven't checked with Eset to see if it's a known bug or not. I should go through the motions before I dismiss it outright.

The other thing to note is that it's my wife's PC. I catch grief whenever it has to be messed with. Especially since the HD failure I mentioned a couple of weeks back.

 

[Buck]

BTW, I'm trialing NOD32 on my wife's PC and it halts Shutdowns by trying to access the FD when there's no disk in the drive. I have to click Continue twice before it'll shut down. I've not seen any config options that fix this; I won't be buying the software because of it.

Have you tried de-selecting the Diskette tick-box in the AMON/Setup/Detection tab?

Also, just to make sure, you do have a floppy drive, correct?

 

[Fushigi]

Didn't help. However, on that same panel, disabling boot sector scans on shutdown did eliminate the message. I don't like this much since it'll mean boot sectors - on all drive - won't be scanned on shutdown (but will on bootup) but I can live with it.

 

[Buck]

Didn't help. However, on that same panel, disabling boot sector scans on shutdown did eliminate the message. I don't like this much since it'll mean boot sectors - on all drive - won't be scanned on shutdown (but will on bootup) but I can live with it.

I read on the world wide wobble, that this is not limited to NOD32. :roll:

 

[Will Rickards]

Fushigi, I wasn't suggesting you uninstall it but time's customer, the one with the original problem.

Buck, do you have a link to where you read it isn't limited to NOD32.

 

[Fushigi]

Buck - I've never seen this before. Or at least in so many years that I don't remember it. It doesn't happen with the various AVG installs I'm aware of nor does it happen with McAfee Enterprise, which we use at work.

Will - No problem.

 

[Buck]

Buck, do you have a link to where you read it isn't limited to NOD32.

I'm trying to find it Will. It was on the Wilders Security Forums.

 

[time]

I tried disabling NOD32's scan at shutdown option, but it didn't help.

I also finally got the user to boot in safe mode and restarts from there - it did exactly the same thing!

Surely, this means it's not a simple driver or rogue service issue?

 

[LiamC]

BIOS issue? I know you copied things to a new box, but stay with me. My BH6 did some wacky stuff like you mentioned and I ended up having to force 2000/XP to use the ACPI HAL which the install program should have recognised and installed.

Once this was done, the BH6 shut down with the best of them. As I had to force the issue, I think that just moving the HDD would still use the plain-jane HAL. IIRC, aACPI is required to enable the OS to control shutdown/restart.

A way to test would be to get another blank drive and install.

Again, IIRC, a later BIOS removed this issue completely.

 

[time]

BIOS issue? ... I ended up having to force 2000/XP to use the ACPI HAL which the install program should have recognised and installed. ... A way to test would be to get another blank drive and install.

I had already run the PC up with a different drive and installed Win2k before shipping it out, so I don't need to try that again.

Device manager says ACPI is working okay. How did you 'force' it?

The only other thing I can think of to try is a Windows repair.

 

[Bozo]

If you go to Device Manager>Computer; double click on the computer setup (IE: ACPI Multiprocessor PC) then click on the Drivers tab. Click on Update Driver. Then Install from List.....> Don't Search, I will choose the driver.....>
There you will see a list of drivers. Pick the one that fits the hardware.

Hope this helps!

Bozo :mrgrn:

 

[time]

Well, I got the customer to image his C drive (apps live on D) and send it to me on DVD. After some messing about, I managed to get this onto an identical PC (except for HDD brand) that I've been playing with.

Sure enough, it too now has the shutdown problem.

I tried changing the HAL back and forth to no avail. I also ran SFC and Windows Repair. Finally, I went through the hidden items in Device Manager and clobbered some that weren't working and shouldn't have been there.

No joy.

If anyone has any ideas, I now have a guinea pig machine to try anything on.

 

[Will Rickards]

Well I'm not getting that shutdown error anymore in my new build which has no floppy drive and I think it is disabled in the bios. So maybe try disabling it and see if it goes away?

 

[Bozo]

Remove the anti-virus software?

Bozo :mrgrn:

 

[time]

Well I'm not getting that shutdown error anymore in my new build which has no floppy drive and I think it is disabled in the bios. So maybe try disabling it and see if it goes away?

I tried it, but no dice. According to M$, an FDD conflict like that is down to copy-protection software. Even though I couldn't find it on the system, I installed an updated version of the software just in case, but it didn't do anything.

Remove the anti-virus software?

I did the deed, but twas to no avail. I've also uninstalled a few other things that I convinced myself might be causing the problem, but that didn't help either.

I also loaded group policies to see if there was a shutdown script, but of course there wasn't. WTF could stop Windows powering down or restarting in Safe Mode?

Unfortunately, the customer has maybe 50 software apps installed, so wiping and installing Windows from scratch is a singularly unattractive option.

I'm going nuts here. I hate Windows with a passion that green youngsters can only imagine. Curse Gates and his company's half-assed creations of spaghetti and chewing gum. :boom:

 

[Buck]

Have you called Microsoft?

 

[P5-133XL]

Have you tried an in-place reinstall of the OS? I've often found that that often fixes that which I can't figure out what the problem is.

 

[time]

Have you tried an in-place reinstall of the OS? I've often found that that often fixes that which I can't figure out what the problem is.

Wouldn't that involve reinstalling all the software? :eekers:

 

[Mercutio]

Not if you do an "Upgrade" install while Windows is running.

 

[P5-133XL]

An In-place re-install keeps the old registry intact so that all the applications remain installed.

Boot to the CD; Refuse the first offer to repair; Accept the 2nd and it should simply reinstall the OS on top of the current OS. All HW gets re-discovered and It will reinstall all OS supplied drivers, as well as all OS files get replaced (with the version on the CD -- All Windows updates get replaced). The OS-Specifc registry settings get initialized but other than that, the registry remains intact. The reinstall, will also not touch application files, unless the application replaced an OS file.

Since you have a test machine to practice on, it is relatively safe.

 

[P5-133XL]

P.S. You will need the Original Windows key because this is an install and it won't proceed without it...

 

[time]

Thanks Mark, but I already performed a repair exactly as you described.

Merc, can you elaborate on your upgrade suggestion?

 

[time]

Well, I think LiamC may have been onto something when he suggested ACPI/HAL problems. Rather than just switch between reasonable HALs such as ACPI PC, ACPI Uniprocessor PC and ACPI Multiprocessor PC, I bit the bullet and selected Standard PC, i.e. not ACPI at all.

Windows appeared to rebuild its device tree from scratch, and reboots et al started to work! Of course, with no ACPI, some of the device drivers are hosed, so I switched back to ACPI Uniprocessor and the problem reappeared.

M$ reckons you can't or shouldn't do it this way, but rather should reinstall Windows as an upgrade as Merc suggested. I've now done this a couple of times and unfortunately, it didn't work.

There's other evidence poiting to broken HAL:

Normally, there is an option to enable the keyboard to resume from standby, but it's missing on this install. Of course, I can't enter standby anyway - it has exactly the same problem.

More significantly, if I look at the HAL driver details on a working PC, there are three files. On the problem install, there are about eight! Nothing I have done so far has been able to change this.

Can everyone check this for me? (Device Manager - Computer - ACPI - Properties - Driver - Driver Details)

TIA.

 

[Buck]

I have three. How many dll files are listed for you?

 

[Mercutio]

The upgrade install didn't work? Or Mark's idea?

The way I maintain my sysprep images is to build them out on whatever hot new Via/AMD platform I have handy, install software updates to software that needs 'em (adaware, firefox etc), prep that... let the machine reboot, then start an XP Upgrade. After the machine shuts down the first time, I transfer the hard disk in question to whatever other platform I want to prep (nvidia/AMD or Intel/Intel), to let the install finish. My applications continue to work and I might have to install a driver or something. It's usually a pretty simple thing.

But I've done the upgrade thing to change HALs a couple times, usually because a BIOS flash was about to make ACPI mandatory on old P3s that didn't have it on by default. I've seen it work, at least.

Also, is there a chance that APIC (not ACPI) is set to disabled in your BIOS? I've seen that cause crashy weirdness on XP computers.

This is going to sound kind of weird, but have you considered the possibility that the problem might be Malware? Microsoft has been saying for a few months now that there are undetectable/unremovable parasite programs out there that replace or extend system level files in such a way that Windows can't do anything about them being there.
Extra files related to your HAL sounds a great deal like some kind of external weirdness.

 

[Mercutio]

2003 Server/A64 - ACPI Uniprocessor - 3 files
XP Pro/AthlonXP -ACPI Uniprocessor - 3 files
2000 Pro/AthlonXP - ACPI PC - 3 files

 

[time]

The upgrade install didn't work? Or Mark's idea?

Neither.

Also, is there a chance that APIC (not ACPI) is set to disabled in your BIOS?

I can't see any APIC or ACPI options in the latest BIOS for this Gigabyte K8NF-9. Also, don't forget it works fine with a virgin installation.

Here are the files and their versions:

5.00.2195.5201 hal.dll
5.00.2195.5400 kernel32.dll
5.00.2195.5400 ntdll.dll
5.00.2195.5438 ntkrnlpa.exe
5.00.2195.5438 ntoskrnl.exe
5.00.2195.5314 win32k.sys
5.00.2195.4602 winsrv.dll

Repair/reinstall CD was Win2k SP3.

On another Win2k SP3 system, I get:

5.00.2195.5201 hal.dll
5.00.2195.6902 ntkrnlpa.exe
5.00.2195.6902 ntoskrnl.exe

 

[Buck]

You probably know this already, but I tried to find some basic definitions to some of the extra files that are loading.

5.00.2195.5201 hal.dll
5.00.2195.5400 kernel32.dll - handles memory management, input/output operations, and interrupts.
5.00.2195.5400 ntdll.dll
5.00.2195.5438 ntkrnlpa.exe
5.00.2195.5438 ntoskrnl.exe
5.00.2195.5314 win32k.sys – handles 639 system services, including GDI calls (NtGdixxx), DirectDraw calls (NtGdiDdxxx), Direct3D calls (NtGdiD3dxxx), and USER calls (NtUserxxx).
5.00.2195.4602 winsrv.dll - File that contains the server side version of the 32-bit user and GDI routines (graphics engine).

This article may help.
MS Article 237556http://support.microsoft.com/default.aspx?scid=kb;en-us;237556

 

[mubs]

My W2k system shuts down and restarts properly, but has major problems with standby. Device Mangler info:

ACPI Multiprocessor PC

Driver Details:
5.00.2195.7006 hal.dll
5.00.2195.7006 kernel32.dll
5.00.2195.7006 ntdll.dll
5.00.2195.7045 ntkrnlpa.exe
5.00.2195.7045 ntoskrnl.exe
5.00.2195.7034 win32k.sys
5.00.2195.7029 winsrv.dll

 

[time]

The extra driver files appear when you select Multiprocessor. On a working system, they went away when I changed back to Uniprocessor, but they hang around forever on the broken system.

Well, I tried everything I could think of or find on the net, but now I'm admitting defeat. The exercise frequently felt like whack-a-mole.

The windows installation has been through at least 4 motherboards, one Via, two nForce2 and now nForce4. It really bugged me that the Via IDE driver appeared to still be running (Hidden Devices under Device Manager), as was an SiL driver, but they refused to die (or would come back to life, unasked).

I found that refraining from installing the nForce4 ATA drivers appeared to correct the reboot/shutdown problem, but of course, you need them for RAID operation. In any case, there was no problem with a fresh Windows install (I did a couple more just to be certain).

For some time, I thought it was something to do with old fragments of nForce2 IDE drivers. Nvata.sys was still wired up (deleting it kills Windows dead, as happened repeatedly). When purging utilities didn't work, I went through the registry with an axe, but it was all for nought.

My final desperate throw was to cut the System registry hive out of a fresh install of Windows on the same PC, then transplant it into the black heart of the pox-ridden, festering heap of putrescence that taunted me.

'Windows' (we call it that, but I know better) almost made it to the desktop, then suddenly rebooted ... and proceeded to repeat the whole process in an infinite loop.

I'm tired now.

Someone remind me to buy an axe.

 

[Bozo]

Try to do the 'second' repair like you did before. Only this time press F5 during the first few seconds when you "press F6 if you have......" The F5 key will allow you to select the type of computer. Maybe doing this in the very beginning will help.

Bozo :mrgrn: