Fullscreen HTML5Med Res (??MB)HTML4

COMPUTERS: tracking down elusive problems Tracking down an elusive fault in Windows XP By STEPHEN DAVIS Tracking down an elusive fault in your PC’s operating system can be a frustrating and time-consuming exercise. Although used to solve a particular problem, the approach described here can be applied to tracking down other faults as well. When a fault or a glitch appears in your PC’s operating system, the first question you must ask yourself is “How far am I willing to go to fix this problem?” After all, many problems can be fixed simply by reinstalling the operating system and provided you have backed up important files, there is noth­ing wrong with this. However, this method does have two important drawbacks: (1) it leaves you none the wiser as to what actually caused the problem in the first place; and (2) you risk losing settings and software updates that you may have spent a lot of time getting right. As a result, many people prefer to trou­bleshoot any problems as they arise, if only to satisfy their own curiosity or to meet a challenge. And – dare I say it? – fixing a crashed computer can actu­ally be a lot of fun. Desktop folders won't open In this article, I am going to give you the step-by-step process I used to fix a strange fault in my own computer. This fault would always appear after what appeared to be a normal boot-up. Quite simply, folders on my desktop wouldn’t open when double-clicked. Instead, the cursor would bring up the “hourglass” icon and just “hang” there. What’s more, when ever I gave the computer the three finger salute (Ctrl-Alt-Del) to bring up the Task Manager, Fig.1: checking the Device Manager will quickly reveal if there are any resource conflicts or hardware problems. 86  Silicon Chip there would be no application running in the foreground to turn off. And the taskbar at the bottom indicated that CPU utilisation was running at 100%! So what was causing this problem? I hadn’t added any new software lately; nor had the comput­er recently crashed or done anything else unusual. Safe mode Initially, I decided to restart the computer in safe mode (by pressing F8 during the boot) to see if this gave any clues. Fortunately, the folders now opened up normally, so I was not hampered by that particular problem. I had been on the Internet the night before and although any downloaded material is automatically checked by a virus scanner, I decided to do a thorough virus scan as a first step. That step quickly excluded a virus infection as being the cause of my problems. Next, I had a cursory look in Device Manager (Fig.1) to see if any obvious faults were present. However, having had a stable system running for quite some time (and with no new hardware recently added), I wasn’t surprised to see that everything was normal. Registry rollback The next consideration has to be a corrupt registry, so I rebooted into safe mode and “rolled back” the registry to a date when I knew the folders opened normally (see Fig.2). That’s one very worthwhile feature of XP – you can easily rollback the registry to an earlier time. Unfortunately, the problem was still present in normal mode, so I rebooted into safe mode again and ran Scandisk and Defrag to exclude the possibility that file allocation or disk corruption errors were causing the problem. The hard disk was given a clean bill of health and, as I quickly found out, the problem remained. The next step was to get back into normal mode and use the Windows Configuration Utility so that the normal startup runs in diagnostic mode. Typing “msconfig” in the “Run” dialog box brought up the configuration utility and I selected “Diagnostic Start Up”. www.siliconchip.com.au al-up connection. It obviously didn’t need the WebClient service. System file checker Fig.2: Windows XP’s System Restore utility lets you roll back the system to an earlier date when everything worked normally. This utility is accessed through the Start menu. After rebooting, the folders now opened normally but of course, I now had none of the services that allow the computer to be usable. By a process of elimination, I was then able to quickly show that the problem was in the “services” area and not in the “start-up” or “.ini” files. This was done by selecting “Selective Startup” (Figs.3 & 4) and enabling one group but not the other before reboot­ ing, then doing the reverse. By using the same process of elimination within the “Serv­ices” group, I found that the folders would open normally if “WebClient” was disabled. To check what this service actually does, I went into Start, Control Panel, Administrative Tools, Services, and looked up “WebClient”. This is what I found there: “WebClient enables Windows-based programs to create, access and modify Internet-based files. If this service is stopped, these functions are no longer available. Services that depend on it will fail to start”. It also showed that the executable for this service was svchost.exe in the system32 folder. As a result of disabling this service, programs such as Acrobat Reader, Eudora and Internet Explorer would no longer load. However, Netscape Navigator continued to work perfectly and could access the Internet via a di- Fig.3: the System Configuration utility lets you load only selected services and devices at start-up. www.siliconchip.com.au A corrupt file now looked a distinct possibility so the next step was to run the System File Checker. This was done by booting into normal mode and typing “sfc /scannow” in the “Run” dialog box. I had been fairly confident that this would fix the prob­lem, so you can imagine my frustration when, at the end of the file check, the original fault was still there. Perhaps not fully accepting the result, I then used the “repair” option available during the Windows XP reinstallation procedure, using the origi­nal CD to replace the system files in the Windows directory. But again, there was no joy. Incidentally, I was impressed by the fact that this proce­ dure apparently changed none of my settings or hardware configu­ rations. However, anyone who has Windows XP preinstalled by an OEM should look at Microsoft’s Knowledge Base article on this subject before attempting this procedure. Safe mode vs diagnostic mode My next step was to think about the difference between safe mode and diagnostic mode in normal startup. The folders opened normally in safe mode and Acrobat Reader, Internet Explorer and Eudora all worked normally. At this point, I enabled logging during both safe mode and diagnostic mode boot up. By then reading the ntbtlog. txt file in the Windows directory and highlighting the differences between the two boots, I found that non-Microsoft files were present in diagnostic startup but not present in safe mode. These non-Microsoft files included port drivers, sound drivers, modem drivers, an Nvidia video card driver and Nor­ton’s Internet Security filter. Next, I uninstalled the video and sound drivers and in­ stalled the latest updates (why waste the opportunity?). I also disabled the Norton filter file, along with the modem and port drivers (by going into the driver Fig.4: in this case, disabling WebClient allowed all folders on the desktop to open normally. February 2003  87 COMPUTERS: tracking down elusive problems physical memory. Event Viewer Fig.5: you can quickly find out what a particular service does by going to Start/Control Panel/Administrative Tools/ Services. In this case, the WebClient description is shown. directory and renaming them). The problem was still present! However, one thing I did notice was that those programs that refused to load when the system was in normal mode would, in fact, finish loading as the system was shut­ting down. In addition, a window would appear to indicate that an error had occurred. In Windows XP, “dwwin.exe” is the Microsoft error reporting utility and this puts the error message into a format that can be sent to Microsoft. In my case, I disabled this file (by renaming it), so that any errors would be reported in readable format on the screen as they occurred. I then rebooted the computer in normal mode (with “WebClient” disabled) and tried to start Inter­net Explorer, which I knew would fail to load. I then clicked Start, Turn Off Computer, Restart and as the computer was shutting down, Internet Explorer started to finish loading. And as it did so, up popped the following message just before reboot: “The instruction at 0x7621a4ca referenced data at 0x0176d000. The required data was not placed into memory because of an I\O error status of 0xc0000010”. Exactly the same error occurred at the same memory location when I rebooted and did the same thing with Adobe Acrobat Reader. I then did an Internet search on this error but could find very little information about it. Furthermore, there was no information about the error in Microsoft’s Know­ledge Base. Of course, I didn’t really know whether this error was due to the original fault or because I had disabled “WebClient”. Howev­er, it did cause me to think about the possibility of a physical memory fault. It occurred to me that either the physical memory was faulty or that this error was the result of a memory allocation problem for some reason. To test the physical memory, I downloaded the memtest. exe utility from www.memtest86.com and allowed this to thoroughly test the machine’s memory. This ran for some 12 hours and tests both the SDRAM and on-board caches. The result was clean bill of health for the system’s 88  Silicon Chip By this stage, I was running out of ideas so I went to the Administrative Tools section in the Control Panel and opened the Event Viewer. Of course, errors here would probably be the result of disabling “WebClient” but I was getting desperate. In the System section of the Event Viewer, there were two error messages that had been repeated a number of times. These were: (1) “The SYMTDI service depends on the TCP/IP protocol driver service which failed to start because a device attached to the system is not functioning”; and (2) “The IPSEC Service de­pends on the IPSEC driver service which failed to start because a device attached to the system is not functioning”. Yet another message appeared in the Application section: “Faulting application explorer.exe, faulting module wininet.dll”. In order to make absolutely sure that neither wininet.dll nor explorer.exe were corrupted, I renamed both files (in the system32 and windows folders respectively) and did another file check by typing sfc /scannow in the Run dialog box. This forced the System File Checker to install new versions of these files on the hard disk, direct from the CD but the problem remained. The SYMTDI service is the Norton Internet Security Filter and I had checked this previously. Similarly, the IPSEC service is the Microsoft Internet Security Service and was included in the operating system files that had already been checked for corruption. So what was left? By now it was obvious that the fault was connected with the Internet modules in the operating system, because it disappeared when “WebClient” was disabled. In addition, the faults listed in Event Viewer all pointed to Internet modules, wininet.dll being the Internet extensions dll for win32. And the fact that Netscape Navigator could still be used, despite Internet related software problems, pointed the finger at Internet modules that were asso­ciated with Microsoft. The thought dawned on me that Internet Explorer itself could be the problem, since this has files deeply embedded in the operating system. As a result, I started poking around at the folders associated with Internet Explorer and quickly found that I couldn’t open the “Temporary Internet Files” folder. Despite the fact “WebClient” had been disabled, this one folder wouldn’t open but instead caused the computer to hang. The conclusion was almost an anticlimax. After booting into Safe Mode, I deleted the offending folder, then rebooted into Normal Mode again to regenerate the “Temporary Internet Files” folder. The operating system then behaved normally again. So that was it – the Temporary Internet Files folder was corrupt and for some reason (probably known only to God and to Microsoft), it affected every other folder. I was lucky that I had enough time to track down this fault but I now appreciate more fully why so many people chose reinstallation as a first option when strange SC faults appear. www.siliconchip.com.au