Rebooting issues with XP

I've had a rebooting issue with my XP desktop for quite some time now. Every time I reboot (100% of the time) it shuts down fine. However, on startup, I receive the black screen with the gray text... the ole WE'RE SORRY FOR THE INCONVENIENCE, BUT WINDOWS DID NOT START PROPERLY... and so on, along with the options to start "normally" or "last known successful startup" or something to that regards, and the 30 second window of opportunity to choose. The major problem with this is that it apparently fragments the heck out of my computer; I have IObit SmartDefrag installed and without fail after every reboot, it'll defrag for nearly 20 minutes. I've scanned for spyware with Adaware and Spybot and AVG Antivirus detects no viruses. I also use CCleaner regularly and scanned the puter with HijackThis and found nothing unrecognizable. Short of a sledgehammer, I've run out of ideas. I even tried the MajorGeeks search engine to find similar posts, but none I could find that would help. Any input would be greatly appreciated!

 

Have you checked Event Viewer to see if there are any errors?

Open the Windows Directory and then open the minidump folder. If there are any dump files zip-up the latest ones and using the 'Manage Attachments' feature upload the file to your next post.

We can try some debugging.

 

Thanks for your reply. Sorry for the delayed return reply... I'll stay posted for the remainder of today. As for Event Viewer, I did find NUMEROUS errors in the APPLICATION, SECURITY and SYSTEM folders; some were "errors" and others were "warnings". As for Windows Directory and the dump files, please forgive my ignorance since I profess to being nothing more than an "intelligent novice" regarding computers. Not sure how to navigate to the dump files. Once I can get that info, I'll attach the necessary file(s) asap. Thanks again~

 

Thanks for your reply. Sorry for the delayed return reply... I'll stay posted for the remainder of today. As for Event Viewer, I did find NUMEROUS errors in the APPLICATION, SECURITY and SYSTEM folders; some were "errors" and others were "warnings". As for Windows Directory and the dump files, please forgive my ignorance since I profess to being nothing more than an "intelligent novice" regarding computers. Not sure how to navigate to the dump files. Once I can get that info, I'll attach the necessary file(s) asap. Thanks again~

 

Post some of the errors you found in Event Viewer:

1. Click on Start -> Run
2. Type eventvwr.msc then hit enter. (Alternately you could start it from computer management)
3. Review all errors and warnings in 'Application' and 'System'.
4. Look for any that may coincide with your boot times (or other unexplained errors)
5. Double click on the item to open "properties". Click on the Clipboard icon below the navigation arrows. (Looks like two sheets of paper text)
6. Open notepad or other text editor, right click in notepad and select "paste".
7. After pasteing, hit enter twice to double space, minimize notepad to tray.

Repeat the above procedure for each error entry, opening notepad which is now in the tray and paste, double space and return notepad to tray.

To post: at top of notepad select "Edit". In the Edit menu select "Select All", then in Edit select "Copy".

Come back to this thread, right click in the reply box and select "Paste".


To navigate to the dump files:

Double click on My Computer

Double click on C drive (provided that is the drive that contains the Windows installation files.)

Double click on 'Windows'

Scroll down and look for the minidump folder

 

Again, please forgive my slow response. We've had a death in the family and its been crazy here lately. I've posted the errors and warnings in APPLICATION and SYSTEM event lists, but I also rebooted tonight (8/28) at 10:40pm with the same issues described in my first post, but only the AVG email error was reported. However, I KNOW I've had this issue before the AVG email problems... the AVG problems came about after I updated to the newest version and haven't been able to resolve it thus far. I went back almost a month to post the most common events, but they don't seem to coincide with reboots. Here's the events (and thanks for going into detail in your instructions!):

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/28/2008
Time: 10:44:12 PM
User: N/A
Computer: VALUED-FF2CC4B2
Description:
The AVG8 E-mail Scanner service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7009
Date: 8/28/2008
Time: 10:44:11 PM
User: N/A
Computer: VALUED-FF2CC4B2
Description:
Timeout (30000 milliseconds) waiting for the AVG8 E-mail Scanner service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: E100B
Event Category: None
Event ID: 4
Date: 8/27/2008
Time: 11:19:54 PM
User: N/A
Computer: VALUED-FF2CC4B2
Description:
Adapter Intel® PRO/100 VE Desktop Connection: Adapter Link Down
Data:
0000: 00 00 04 00 02 00 58 00 ......X.
0008: 00 00 00 00 04 00 04 c0 .......À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 04 00 04 c0 ...À


Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 8/27/2008
Time: 11:19:34 PM
User: N/A
Computer: VALUED-FF2CC4B2
Description:
The IP address lease 24.168.236.45 for the Network Card with network address 000255F726B5 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 8/17/2008
Time: 7:40:13 PM
User: N/A
Computer: VALUED-FF2CC4B2
Description:
Faulting application atomica.exe, version 0.0.0.0, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x00001010.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 61 74 6f ure ato
0018: 6d 69 63 61 2e 65 78 65 mica.exe
0020: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0028: 20 69 6e 20 6e 74 64 6c in ntdl
0030: 6c 2e 64 6c 6c 20 35 2e l.dll 5.
0038: 31 2e 32 36 30 30 2e 32 1.2600.2
0040: 31 38 30 20 61 74 20 6f 180 at o
0048: 66 66 73 65 74 20 30 30 ffset 00
0050: 30 30 31 30 31 30 0d 0a 001010..


Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 8/11/2008
Time: 1:42:33 PM
User: N/A
Computer: VALUED-FF2CC4B2
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....‚..€
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 7/16/2008
Time: 6:22:48 PM
User: N/A
Computer: VALUED-FF2CC4B2
Description:
Faulting application firefox.exe, version 1.8.20080.62306, faulting module firefox.exe, version 1.8.20080.62306, fault address 0x001be4ba.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 66 69 72 ure fir
0018: 65 66 6f 78 2e 65 78 65 efox.exe
0020: 20 31 2e 38 2e 32 30 30 1.8.200
0028: 38 30 2e 36 32 33 30 36 80.62306
0030: 20 69 6e 20 66 69 72 65 in fire
0038: 66 6f 78 2e 65 78 65 20 fox.exe
0040: 31 2e 38 2e 32 30 30 38 1.8.2008
0048: 30 2e 36 32 33 30 36 20 0.62306
0050: 61 74 20 6f 66 66 73 65 at offse
0058: 74 20 30 30 31 62 65 34 t 001be4
0060: 62 61 0d 0a ba..


Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 7/14/2008
Time: 11:04:40 PM
User: N/A
Computer: VALUED-FF2CC4B2
Description:
Fault bucket 825975806.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 38 32 35 39 37 35 38 30 82597580
0010: 36 0d 0a 6..


Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 3/1/2008
Time: 10:51:57 AM
User: NT AUTHORITY\SYSTEM
Computer: VALUED-FF2CC4B2
Description:
Windows saved user VALUED-FF2CC4B2\user registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Also, I failed to mention up above that I've navigated EVERY Windows file, including in the SYSTEM file and found NO dump file folder... starting to wonder if that in itself might be the issue. I HAVE been getting a lot of "virtual memory low" warnings lately.

 

i had a similar problem and i believe it was due to Iobit SmartDefrag i got rid of it and it went away

hope this helps

Wolf

 

Thanks for the suggestion... I'd thought about doing that in the past, but dismissed it several times. This time I actually uninstalled SmartDefrag and although it seems to make my computer run smoother without it, the reboot issue unfortunately remains. Any other suggestions would be gladly welcomed.

As for navigating to the dump files, it's just not to be found. Call me crazy, but I've searched every folder in Windows, including doing a Start/Search/All Files and Folders search as well, and to no avail... computer can't even find it.

 

Just a quick point... I have Norton Ghost 2003 (Symantec) and noticed after opening it that there is a Boot Wizard for creating boot disks. Not sure if this could cause the reboot issue or not; I'm not even sure Ghost is necessary on my computer... looks like its nothing more than a glorified image file creator, which I think I can create on my SpywareBlaster program as a system snapshot. Anyway, thought I'd mention the fact that I have this program in case it may be relevant.

 

I must've really stumped everyone! Just wondering if anyone had other suggestions or follow-ups to this reboot issue. Thanks in advance for any replies.

 

Wouldn't say that you have stumped everyone, its just that after you get a few replies most of the experienced users don't look anymore and assume the problem has been fixed.

You mentioned having Norton Ghost 2003 installed. Was this a part of of Norton System Works 2003? Best that I remember, it also included the antivirus app. Was all this uninstalled before adding AVG 8? If not, this could be your problem.

Your problem seems to indicate that an email scanner wasn't launched/denied access and was still trying when shut down. Were it me, I would remove everything associated with Norton/Symantec ( use their clean tool ) and also AVG. After doing so and rebooting, run CCleaner with the issues tab to remove registry entries. Reinstall AVG without the email scanner, as I believe that the active scanners also scan all downloads which would include email.

I'm sure that other members will have other/better suggestions. Hope this helps!

 

Thanks for your post Novice. I actually got rid of Norton Ghost altogether earlier today and AVG has been uninstalled/reinstalled without the Email Scanner, along with CCleaning the registry. However, reboot issue still persists. I have a feeling it is something incredibly simple... we just haven't come across it yet. Keep the suggestions coming!

 

Another thing that may be related to this reboot issue... if I leave Yahoo Messenger running for half a day, it sucks most of my resources up and the alert message appears telling me so. Thus, I usually reboot every other day now... with the reboot issue still present, and it fragments my computer bigtime. Again, just throwing things out there that may be relevant.

 

I've Googled to see if there were others out there with similar problems finding dump files in XP and came to the conclusion that this particular computer has no dump files to speak of. Not even a Dr. Watson... the Dr. Watson file exists, but is empty. Also, I had AUTOMATIC RESTART checked when I right clicked C/Properties/Advanced/StartUp and Recovery, so I unchecked it to see if that's an issue. Any other help would be greatly appreciated!

 

I KNOW I've stumped everyone now! Any help on this issue would be greatful... I'm running out of hairs to pull trying to figure this reboot thing out:confused... thanks!

 

Just curious about one of the entries in your event viewer post. Did or have you installed the program Atomica? It does install itself as a service, and a service not shutting down could cause the problems that you describe.

 

I believe a few days ago I did have Atomica... if its a computer game, then I probably did, but uninstalled it but issue persists. As for Dr. Watson, I tried to locate it via drwtsn32 and found it, but again, the file was empty... no application errors present, and all proper configurations were checked; DUMP ALL THREAD CONTENTS, APPEND TO EXISTING LOG FILE, and CREATE CRASH DUMP... all checked. And dump file type is checked as MINI. I wish I had something else I could give you all to add some hope... sorry that this is turning into a monster issue! :banghead

 

About the only other thing I can suggest is that a year or two ago I read the DISABLING UNNECCESSARY SERVICES sticky thread in COMPUTER MAINTENANCE that directed me to BlackViper.com and tweaked a few things there in the SAFE category. Is there any SERVICE that I tweaked that might have created this issue? Just a thought...

 

Also, in EventViewer under SECURITY, I'm getting multiple failures, all stating "Windows firewall has detected an application listening for incoming traffic" and it shows navigation toward svchost.exe. Again, not sure if this is relevant, but I'll suggest anything at this point :banghead

 

Any takers? If there's a link to a Windows troubleshooting page that will reference this issue, feel free to post it... I've searched endlessly. If you should happen to need more info from me, let me know. I have faith that someone in this great forum can resolve this. Thanks all!

 

After reading your post about ports listening for incoming traffic, I would go here, http://forums.majorgeeks.com/showthread.php?t=35407. Please follow all instructions carefully and do all that is asked! Hope this helps!

 

okay let me try giving u some more advice hopefully this may be a little better okay first is it possible your computer is reaching max cpu usage because of your ram, how much do u have

second you say you get a message saying there was an error now im not sure if this will change anything im not a pro with services but if you go to

Start>Run>services.msc try disableing Error Reporting Service
not sure if that will eliminate the problem but its a long shot

good luck

Wolf

 

Thanks for your replies Novice and Wolf. As to Wolf's suggestion about disabling Error Reporting Service, it was already disabled. And I have 256MB Ram (XP- SP2).

And Novice, thanks for the thread link... I did that a few years ago, but guess I should've rechecked it again; MANY things have changed since then, including different scan tools, etc. I'm currently following step-by-step, so looks like its going to take a loooong time. I'll post here again upon conclusion.

 

Is your file system NTFS or FAT32? I've seen FAT32 systems where this occurs. You should not be using FAT32 if you can possibly avoid it. It's all but directly worse than NTFS in 95% of modern situations.

Open up a command prompt and run fsutil dirty query c:. On a proper system, it should be reporting as not dirty. If it's reporting as dirty, there's something odd. Whether it's marked as dirty or not, next run chkdsk c: /r. Now reboot and let Windows scan the disk for errors. It can take upwards of an hour on a large disk and you won't be able to do anything else, so beware.

Also, do me a favor a post a screenshot like the one I've attached. Basically, HKEY_LOCAL_MACHINE\SYSTEM\Select is the part of the registry that determines which hardware configuration is in use. I want to see which one it's using and which ones are available.

 

Thanks Chick for the reply... I THINK I have NTFS. I opened Belarc Advisor and I found the info there. Also, Command Prompt reported my puter as NOT dirty. I'll do the disk check shortly... still finishing up the tedious procedure of cleaning my computer via the thread Novice gave me. And by the way, again, forgive my ignorance but I've never done a screenshot save before... how do I do so? Only options I see are IMPORT or EXPORT.

Finally, need to let whomever know... since my original post, I'm having to reboot twice a day now due to system resources being sucked up by... eh, something. I'm starting to think whatever's doing this might resolve all issues I've reported thus far. I ran Scanner.exe, which lets me know in a pie chart what's taking up harddrive space, but unfortunately doesn't tell me about resources... and I have 50% free on harddrive if wondering.

 

im quite sure that XP needs 512 Ram to run smoothly with Nothing

Wolf

 

Right-click on the disk in My Computer and choose Properties. On the General tab it will display the File System type.

If you hit <PrtScr> (Print Screen) then Windows will copy the current screen to the clipboard. Then you can go into MS Paint or Paint.NET and paste it. If you do <Alt>+<PrtScr> then it only takes the current window and not the whole screen. Saving it as a PNG file is generally best.

If you have Automatic Updates turned on, then every time you reboot it will scan the system for updates. It's a fairly intensive process. Windows Defender and many Anti-Virus programs also do this.

If you want to know about resources, right-click on the task bar and choose Task Manager. The Process and Performance tabs will let you know what's consuming CPU or memory and if you're maxing anything out.

 

Alrighty then; I FINALLY finished the proper cleaning procedure... followed instructions maticulously (hopefully). I'm posting attachments per that thread's instructions.

Also, Chicken, couldn't figure out how to create a screenshot, so I'll type exactly what is displayed on my Registry Editor per your navigation location:


(Default) REG_SZ (value not set)
Current REG_DWORD 0x00000004 (4)
Default REG_DWORD 0x00000004 (4)
Failed REG_DWORD 0x00000003 (3)
LastKnownGood REG_DWORD 0x00000001 (1)

 

Since there's a 3 attachment max, and I have 4, here's the final attachment. And as warned on that cleanup thread, this MGlogs zip file may not be complete because I think I'm operating a 32bit computer:

 

TidaGuy,

Glad to see that you completed the instructions in the thread link that I supplied! Now please post a new thread here, http://forums.majorgeeks.com/forumdisplay.php?f=35. Ask that the Malware experts review the same logs that you submitted in this post/forum ( you will have to send/attach them again ) for possible malware infections. It is standard procedure for such logs to be analyzed in that forum.

When they give your computer a clean bill of health, then post back and will work on whatever problem is still there.

 

TidaGuy,

Just noticed that chaslang gave you a clean bill of health in the Malware removal forum, and suggested that you continue in Software.

As I looked over your logs, I saw at least one item from Symantec still running, and that would be LiveUpdate. You can remove this from Control Panel/Add/Remove programs.

Also saw that you had LimeWire installed. Is this installed to run only when started, or to run all the time? Yahoo Messenger along with the Yahoo toolbar could also be contributing to your problem.

The open ports issue that bothered me could be contributed to either LimeWire, Yahoo Messenger, or LiveUpdate.

As wolfx28 noted and chaslang confirmed, you need more ram in this computer to function efficiently with the programs that you have running!

Were it me, I would manually shut down any Messenger programs that were running, as well as any P2P programs that were running to see if that did away with the screen that you're seeing when you do a manual restart!

Hope this helps!