This is only a preview of the February 2003 issue of Silicon Chip. You can view 27 of the 96 pages in the full issue, including the advertisments. For full access, purchase the issue for $10.00 or subscribe for access to the latest issues. Articles in this series:
Items relevant to "The PortaPAL Public Address System":
Items relevant to "The SC480 50W RMS Amplifier Module; Pt.2":
Items relevant to "Using Linux To Share An Optus Cable Modem; Pt.4":
Items relevant to "A Windows-Based EPROM Programmer; Pt.3":
Purchase a printed copy of this issue for $10.00. |
COMPUTERS: tracking down elusive problems
Tracking down an elusive
fault in Windows XP
By STEPHEN DAVIS
Tracking down an elusive fault in your PC’s operating system
can be a frustrating and time-consuming exercise. Although
used to solve a particular problem, the approach described
here can be applied to tracking down other faults as well.
When a fault or a glitch appears in your PC’s operating
system, the first question you must ask yourself is “How
far am I willing to go to fix this problem?” After all, many
problems can be fixed simply by reinstalling the operating
system and provided you have backed up important files,
there is nothing wrong with this.
However, this method does have two important
drawbacks: (1) it leaves you none the wiser as to what
actually caused the problem in the first place; and (2)
you risk losing settings and software updates that you
may have spent a lot of time getting right. As a result,
many people prefer to troubleshoot any problems as they
arise, if only to satisfy their own curiosity or to meet a
challenge.
And – dare I say it? – fixing a crashed computer can
actually be a lot of fun.
Desktop folders won't open
In this article, I am going to give you the step-by-step
process I used to fix a strange fault in my own computer. This fault would always appear after what appeared
to be a normal boot-up. Quite simply, folders on my
desktop wouldn’t open when double-clicked. Instead,
the cursor would bring up the “hourglass” icon and just
“hang” there.
What’s more, when ever I gave the computer the three
finger salute (Ctrl-Alt-Del) to bring up the Task Manager,
Fig.1: checking
the Device
Manager will
quickly reveal
if there are any
resource conflicts
or hardware
problems.
86 Silicon Chip
there would be no application running in the foreground
to turn off. And the taskbar at the bottom indicated that
CPU utilisation was running at 100%!
So what was causing this problem? I hadn’t added any
new software lately; nor had the computer recently crashed
or done anything else unusual.
Safe mode
Initially, I decided to restart the computer in safe
mode (by pressing F8 during the boot) to see if this
gave any clues. Fortunately, the folders now opened
up normally, so I was not hampered by that particular
problem.
I had been on the Internet the night before and although
any downloaded material is automatically checked by a
virus scanner, I decided to do a thorough virus scan as a
first step. That step quickly excluded a virus infection as
being the cause of my problems.
Next, I had a cursory look in Device Manager (Fig.1) to
see if any obvious faults were present. However, having
had a stable system running for quite some time (and with
no new hardware recently added), I wasn’t surprised to
see that everything was normal.
Registry rollback
The next consideration has to be a corrupt registry,
so I rebooted into safe mode and “rolled back” the
registry to a date when I knew the folders opened normally (see Fig.2). That’s one very worthwhile feature of
XP – you can easily rollback the registry to an earlier
time. Unfortunately, the problem was still present in
normal mode, so I rebooted into safe mode again and
ran Scandisk and Defrag to exclude the possibility that
file allocation or disk corruption errors were causing the
problem.
The hard disk was given a clean bill of health and, as I
quickly found out, the problem remained.
The next step was to get back into normal mode and
use the Windows Configuration Utility so that the normal
startup runs in diagnostic mode. Typing “msconfig” in the
“Run” dialog box brought up the configuration utility and
I selected “Diagnostic Start Up”.
www.siliconchip.com.au
al-up connection. It obviously didn’t need the WebClient
service.
System file checker
Fig.2: Windows XP’s System Restore utility lets you
roll back the system to an earlier date when everything
worked normally. This utility is accessed through the
Start menu.
After rebooting, the folders now opened normally but
of course, I now had none of the services that allow the
computer to be usable. By a process of elimination, I was
then able to quickly show that the problem was in the
“services” area and not in the “start-up” or “.ini” files.
This was done by selecting “Selective Startup” (Figs.3 &
4) and enabling one group but not the other before reboot
ing, then doing the reverse.
By using the same process of elimination within the
“Services” group, I found that the folders would open
normally if “WebClient” was disabled. To check what
this service actually does, I went into Start, Control Panel,
Administrative Tools, Services, and looked up “WebClient”. This is what I found there: “WebClient enables
Windows-based programs to create, access and modify
Internet-based files. If this service is stopped, these functions are no longer available. Services that depend on it
will fail to start”.
It also showed that the executable for this service was
svchost.exe in the system32 folder.
As a result of disabling this service, programs such
as Acrobat Reader, Eudora and Internet Explorer would
no longer load. However, Netscape Navigator continued
to work perfectly and could access the Internet via a di-
Fig.3: the System Configuration utility lets you load only
selected services and devices at start-up.
www.siliconchip.com.au
A corrupt file now looked a distinct possibility so the
next step was to run the System File Checker. This was
done by booting into normal mode and typing “sfc /scannow” in the “Run” dialog box.
I had been fairly confident that this would fix the
problem, so you can imagine my frustration when, at the
end of the file check, the original fault was still there.
Perhaps not fully accepting the result, I then used the
“repair” option available during the Windows XP reinstallation procedure, using the original CD to replace
the system files in the Windows directory. But again,
there was no joy.
Incidentally, I was impressed by the fact that this proce
dure apparently changed none of my settings or hardware
configu
rations. However, anyone who has Windows
XP preinstalled by an OEM should look at Microsoft’s
Knowledge Base article on this subject before attempting
this procedure.
Safe mode vs diagnostic mode
My next step was to think about the difference between safe mode and diagnostic mode in normal startup.
The folders opened normally in safe mode and Acrobat Reader, Internet Explorer and Eudora all worked
normally.
At this point, I enabled logging during both safe mode
and diagnostic mode boot up. By then reading the ntbtlog.
txt file in the Windows directory and highlighting the differences between the two boots, I found that non-Microsoft
files were present in diagnostic startup but not present in
safe mode.
These non-Microsoft files included port drivers, sound
drivers, modem drivers, an Nvidia video card driver and
Norton’s Internet Security filter.
Next, I uninstalled the video and sound drivers and
in
stalled the latest updates (why waste the opportunity?). I also disabled the Norton filter file, along with
the modem and port drivers (by going into the driver
Fig.4: in this case, disabling WebClient allowed all folders
on the desktop to open normally.
February 2003 87
COMPUTERS: tracking down elusive problems
physical memory.
Event Viewer
Fig.5: you can quickly find out what a particular service
does by going to Start/Control Panel/Administrative Tools/
Services. In this case, the WebClient description is shown.
directory and renaming them). The problem was still
present!
However, one thing I did notice was that those programs
that refused to load when the system was in normal mode
would, in fact, finish loading as the system was shutting
down. In addition, a window would appear to indicate
that an error had occurred.
In Windows XP, “dwwin.exe” is the Microsoft error reporting utility and this puts the error message into a format
that can be sent to Microsoft. In my case, I disabled this
file (by renaming it), so that any errors would be reported
in readable format on the screen as they occurred. I then
rebooted the computer in normal mode (with “WebClient”
disabled) and tried to start Internet Explorer, which I knew
would fail to load.
I then clicked Start, Turn Off Computer, Restart and
as the computer was shutting down, Internet Explorer
started to finish loading. And as it did so, up popped the
following message just before reboot: “The instruction at
0x7621a4ca referenced data at 0x0176d000. The required
data was not placed into memory because of an I\O error
status of 0xc0000010”.
Exactly the same error occurred at the same memory
location when I rebooted and did the same thing with
Adobe Acrobat Reader. I then did an Internet search on
this error but could find very little information about it.
Furthermore, there was no information about the error in
Microsoft’s Knowledge Base.
Of course, I didn’t really know whether this error
was due to the original fault or because I had disabled
“WebClient”. However, it did cause me to think about the
possibility of a physical memory fault. It occurred to me
that either the physical memory was faulty or that this
error was the result of a memory allocation problem for
some reason.
To test the physical memory, I downloaded the memtest.
exe utility from www.memtest86.com and allowed this
to thoroughly test the machine’s memory. This ran for
some 12 hours and tests both the SDRAM and on-board
caches. The result was clean bill of health for the system’s
88 Silicon Chip
By this stage, I was running out of ideas so I went to
the Administrative Tools section in the Control Panel and
opened the Event Viewer. Of course, errors here would
probably be the result of disabling “WebClient” but I was
getting desperate.
In the System section of the Event Viewer, there were
two error messages that had been repeated a number of
times. These were: (1) “The SYMTDI service depends on
the TCP/IP protocol driver service which failed to start
because a device attached to the system is not functioning”;
and (2) “The IPSEC Service depends on the IPSEC driver
service which failed to start because a device attached to
the system is not functioning”.
Yet another message appeared in the Application section: “Faulting application explorer.exe, faulting module
wininet.dll”.
In order to make absolutely sure that neither
wininet.dll nor explorer.exe were corrupted, I renamed both files (in the system32 and windows folders
respectively) and did another file check by typing sfc
/scannow in the Run dialog box. This forced the System
File Checker to install new versions of these files on the
hard disk, direct from the CD but the problem remained.
The SYMTDI service is the Norton Internet Security
Filter and I had checked this previously. Similarly, the
IPSEC service is the Microsoft Internet Security Service
and was included in the operating system files that had
already been checked for corruption. So what was left?
By now it was obvious that the fault was connected with
the Internet modules in the operating system, because it
disappeared when “WebClient” was disabled. In addition,
the faults listed in Event Viewer all pointed to Internet
modules, wininet.dll being the Internet extensions dll for
win32. And the fact that Netscape Navigator could still be
used, despite Internet related software problems, pointed
the finger at Internet modules that were associated with
Microsoft.
The thought dawned on me that Internet Explorer itself
could be the problem, since this has files deeply embedded in the operating system. As a result, I started poking
around at the folders associated with Internet Explorer
and quickly found that I couldn’t open the “Temporary
Internet Files” folder. Despite the fact “WebClient” had
been disabled, this one folder wouldn’t open but instead
caused the computer to hang.
The conclusion was almost an anticlimax. After booting
into Safe Mode, I deleted the offending folder, then rebooted into Normal Mode again to regenerate the “Temporary
Internet Files” folder. The operating system then behaved
normally again.
So that was it – the Temporary Internet Files folder
was corrupt and for some reason (probably known only
to God and to Microsoft), it affected every other folder.
I was lucky that I had enough time to track down this
fault but I now appreciate more fully why so many people chose reinstallation as a first option when strange
SC
faults appear.
www.siliconchip.com.au
|