How diagnose unexplained hangs?

[Guest]

Hi ,
My Win XP Home is hanging unexpectedly. Not necessarily running anything
while it hangs. DRWATSON32 does not show anything. I had loaded Itunes and
thought that was causing the crashes but I removed that and I'm still getting
crashes. I'd like to troubleshoot it further but not sure what to
troubleshoot.

Thanks,

 

[Saucy Lemon]

Hi ,
My Win XP Home is hanging unexpectedly. Not necessarily running
anything while it hangs. DRWATSON32 does not show anything. I had
loaded Itunes and thought that was causing the crashes but I removed
that and I'm still getting crashes. I'd like to troubleshoot it
further but not sure what to troubleshoot.

Thanks,

Could be a RAM problem:

http://www.memtest86.com/

Is the power supply adequate for the hardware? This might not be an issue
when the computer is new, but if you add stuff later the powers situation
might not be good and a power supply upgrade mightbe in order.

Do a checkdisk on the harddrives, then a defrag.

 

[Gerry Cornell]

Try Ctrl+Alt+Delete to select Task Manager and click the
Performance Tab. What is the Total, the Commit Charge
and the Peak?

You may check on pagefile (virtual memory) usage with
Page File Monitor for XP:
http://www.dougknox.com/

If you get anything much more than 50 mb virtual memory
usage for most users this means you need to add RAM
memory. The system uses virtual memory for a limited
number of tasks rather than RAM memory.

Make sure you study the readme.txt file carefully to ensure
you get the utility to work as it should.

How large is your hard drive? Is it partitioned? How much free space on
each drive / partition. How is the drive formatted -FAT32 or NTFS. To
get this information whilst in Windows Explorer place the cursor on each
drive in turn, right click and select Properties.

What is your CPU speed? Right click on the My Computer icon on your
Desktop, select Properties to get this information.

What are your ant-virus / anti spyware arrangements?


--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[WTC]

If you get anything much more than 50 mb virtual memory
usage for most users this means you need to add RAM
memory.

You really believe that? I sure don't. I have 2 GB of RAM and currently my
pagefile IN USE is around 500 mb.

 

[WTC]

You really believe that? I sure don't. I have 2 GB of RAM and currently my
pagefile IN USE is around 500 mb.

Please disregard my last post, I had few unnecessary applications running
the background. After closing the apps, it is now around 200 mb.

 

[Gerry Cornell]

William

I have included "for most users" but I am contemplating "beefing" up
this qualification as photo editing is becoming so common. I need to
research what other commonly used programmes can cause this
generalisation to be untrue.

--

Regards.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

An update to my question. I did a test today and booted in SAFE mode and the
computer does not crash at all. Incidently I have 1.5 gb of RAM and can
actually have no programs intentionally running when the normal crashes
occur. (I know there are many processes running even if I'm not actually
running some software.). What else would you recommend I try in light of the
PC working fine in 'safe' mode? (This would seem to rule out the RAM as a
potential issue-right?)
Thanks,

 

[Rock]

Hi ,
My Win XP Home is hanging unexpectedly. Not necessarily running anything
while it hangs. DRWATSON32 does not show anything. I had loaded Itunes and
thought that was causing the crashes but I removed that and I'm still getting
crashes. I'd like to troubleshoot it further but not sure what to
troubleshoot.

Thanks,

Try running driver verifier to see if it's a driver that's causing the
problem but for some reason not blue screening to give a message. See
this newsgroup post by David Candy on how to do it.

http://groups.google.com/group/micr...id+author:Candy&rnum=5&hl=en#c0748efb31fe83de
Here's a tiny url for the same posting: http://tinyurl.com/d926l

 

[Gerry Cornell]

Chet

I suggest you Disable automatic restart on system failure. This should
help by allowing time to write down the STOP code properly. Right click
on the My Computer icon on the Desktop and select Properties, Advanced,
StartUp and Recovery, System Failure and uncheck box before
Automatically Restart.

Enable automatic restart on system failure after you have captured /
copied and pasted the message in a further post here.

There will also be Error Reports in Event Viewer. Please post copies.
What you posted would be much easier to understand if you followed the
advice in the last paragraph of this message.

You can access Event Viewer by selecting Start, Administrative Tools,
Event Viewer. When researching the meaning of the error, information
regarding Event ID, Source and Description are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&Product=winxp

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Double click the button and close Event
Viewer. Now start your message (email) and do a paste into the body of
the message. This will paste the info from the Event Viewer Error Report
complete with links into the message. Make sure this is the first paste
after exiting from Event Viewer.



--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

Hi Gerry,
Several new things.
1. After running the verifier I got the BSOD and some STOP codes.
0X0000000A and another time 0X0000000D1.
2. Before I ran the verifier I was getting a total system stop where
everything became inactive. Could not ctl-alt-del even. Had to power down
to stop. This typically happened on it's own after a period of time. Will
verifier generate a log in this type of situation where BSOD does not happen?
3. As previously mentioned SAFE mode the computer ran all day and no problems.
4. Event log pasted in below.
5. Someone asked about HD space and I have space free of 45gb-C, K-8GB (my
document drive), 42gb-L drive. (Don't know if space is relevent).

Any help is appreciated.
Thanks,
Chet (Event log below for error.)

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 1/11/2006
Time: 20:33:44
User: N/A
Computer: CHETSDESKTOP
Description:
Error code 100000d1, parameter1 b8c6e063, parameter2 00000002, parameter3
00000000, parameter4 b8c6e063.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 64 100000d
0020: 31 20 20 50 61 72 61 6d 1 Param
0028: 65 74 65 72 73 20 62 38 eters b8
0030: 63 36 65 30 36 33 2c 20 c6e063,
0038: 30 30 30 30 30 30 30 32 00000002
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 62 38 63 36 00, b8c6
0050: 65 30 36 33 e063

 

[Rock]

Hi Gerry,
Several new things.
1. After running the verifier I got the BSOD and some STOP codes.
0X0000000A and another time 0X0000000D1.
2. Before I ran the verifier I was getting a total system stop where
everything became inactive. Could not ctl-alt-del even. Had to power down
to stop. This typically happened on it's own after a period of time. Will
verifier generate a log in this type of situation where BSOD does not happen?
3. As previously mentioned SAFE mode the computer ran all day and no problems.
4. Event log pasted in below.
5. Someone asked about HD space and I have space free of 45gb-C, K-8GB (my
document drive), 42gb-L drive. (Don't know if space is relevent).

<snip>

http://aumha.org/win5/kbestop.htm
0x0000000A: IRQL_NOT_LESS_OR_EQUAL
0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL

 

[Gerry Cornell]

Chet

Can you try and copy the BSOD Stop Error Message disabling automatic
restart.

With luck you may get something like this example:
Stop: 0x000000D1 (oxBEC86PC59, 0x0000002, 0x0000000, 0xBEC8BF59)
DRIVER_INQL_NOT_LESS_OR_EQUAL
Address BEC8B859 case at BEC5A000, datestamp 3B28910a ALCXWDM.SYS

Also do you another System Error report in Event Viewer? Similar but not the
same
as the one you posted?

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Plato]

1. After running the verifier I got the BSOD and some STOP codes.
0X0000000A and another time 0X0000000D1.

http://tinyurl.com/23w5h
http://aumha.org/win5/kbestop.htm

 

[Guest]

The crashing continues. I copied another error from the event viewer which I
will paste in below. I have plenty of them. May I ask a few more questions.
1. Is it worthwhile for me to run the 'system restore' utility to take the
software back to an earlier state?
2. I also have software called 'goback' on installed on my pc as well but I
hesitate to use it unless it's a last resort since I have photographs not
backed up yet that I would lose. (I believe system restore will not affect
the my documents folder where goback does.)
3. I do plan to go into safe mode and back all my data/photos tomorrow.
(Should have been doing this all along.)
4. While attempting to do a hotsync on my palm i got the BSOD without the
verifier turned on. This was strange since I've never had a problem sync'ng
and the sync software has not changed.
5. Is it worthwhile to remove the most recently installed software as a
fixative measure?
6. I went to the referenced web sites about the STOP errors but they don't
seem to tell me which driver to that might be causing the problem. How do I
tell which driver is the problem. (Assuming it really is a driver problem.).
Thanks and best regards,

Chet Shannon

 

[Guest]

Sorry I forgot to include the event log paste but here it is now..

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 1/13/2006
Time: 18:35:29
User: N/A
Computer: CHETSDESKTOP
Description:
Error code 000000c9, parameter1 0000020e, parameter2 ac5ecd7d, parameter3
973b4f20, parameter4 00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 63 000000c
0020: 39 20 20 50 61 72 61 6d 9 Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 32 30 65 2c 20 00020e,
0038: 61 63 35 65 63 64 37 64 ac5ecd7d
0040: 2c 20 39 37 33 62 34 66 , 973b4f
0048: 32 30 2c 20 30 30 30 30 20, 0000
0050: 30 30 30 30 0000

 

[Guest]

Hi Gerry,
Any more advice on my last event long posting and such? Thx... Chet

 

[Gerry Cornell]

Chet

You asked about System Restore. Do you have a restore point
before the problem started? If yes then it would be worth a try.

The latest Event Viewer Report unfortunately does not help.

Autoruns is a programme, which list everything starting and
where it starts from. It will run in Safe Mode. Try downloading
and installing:
http://www.sysinternals.com/Utilities/Autoruns.html

You can save the output of the Everything tab to a txt file.
Place the cursor on any item in the list and it gives a save
as option on the File drop down.Could you email me a copy
to (e-mail address removed) removing dump and I will see if
I can spot anything out of the ordinary.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[David Candy]

Type verifier in Start Run, follow the wizard but choose All Drivers. This will slow down your computer and cause more blue screen crashes but will pinpoint what is causing the crash (if the original error message didn't). Once you fix it you rerun verifier and turn it off.

If you can't start after enabling verifier
choose Last Known Good Configuration at the Failed Boot menu (which will
start without verifier).


You will be creating a crash dump file in c:\windows\minidump every blue screen. Make sure you are set to record minidumps (Small Memory Dumps) - type it in Help to see how.

Then

If you have the XP SP2 Security Update CD (else see
http://www.microsoft.com/whdc/­devtools/debugging/symbolpkg.m­spx
)


Install symbols from <CD Drive Letter>:\SUPPORT\SYMBOLS

Download
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Load the crash dump file into windbg
and read what it says. You may need to tell it where the symbols are. Read it.
Type
!Analyze -v
into Windbg's command line.
(this will hopefully tell you the faulty component)

If the above is too technical then email the crash dump files to david @ mvps.org. Don't send me lots of them. Just the one from your last crash after you turn verifier on. And only one per mail.

You can look up specific details here
http://msdn.microsoft.com/library/d..._ea8b9fd0-2d81-4a04-a7ed-c1c6a80bd501.xml.asp

If it indicates faulty memory might be the cause you can get a memory tester
here
http://oca.microsoft.com/en/wi­ndiag.asp


If it mentions a core windows system file, meaning it a MS fix is required,
upload a minidump to

http://oca.microsoft.com

Also try typing the main error code in Help while online (ie,
Stop 0x50
and also try in the 8 digit form
stop 0x00000050)
and if there are too many hits use a filename if available. Generally memory
addresses are different for each computer (as each computer has a different
mix of drivers) so parameters that are memory addresses aren't that useful for searching, but NTStatus codes are (plus you can look them up here http://cvs.sourceforge.net/viewcvs.py/mingw/w32api/include/ddk/ntstatus.h?rev=1.2).

If this doesn't work try

Get your XP CD and install Windows Support Tools.


Type in start run after installing and rebooting


pstat > "%userprofile%\desktop\driverl­ist.txt"


The last table in this file is a list of loaded drivers. Other things apart
from hardware uses drivers. Post the list of drivers (the last table only -
REPEAT THE LAST TABLE O N L Y ) or match the fault address to the driver.

This will allow you to match memory addresses to a driver.