Strange App/Windows shutdown issue

[Guest]

Here is the situation. This is a problem we are seeing for about 1% of our
users at my company that just received new Dell workstations. Here are the
specs:

Dell Optiplex GX270
Windows XP SP1
Pentium 4 2.8GHz with HyperThreading
1GB RAM
40GB HD
nVidia GEForce FX5200 video card with 128MB

Here is the behavior we are seeing anywhere from once every two weeks to 4
or 5 times a day:

1. User logs in when they arrive. We use Windows 2003 servers and roaming
profiles for the users.
2. Our suite of applications loads based on a layout that the user can
specify. Most users have a custom layout, but others use predefined layouts
of apps.
3. At some point, most, but not all, of the application windows close,
leaving behind the same apps almost every time. The related processes exit as
well.
4. After the exiting of processes, and this is what is strange, msgina.dll
is called to display the standard "Windows is shutting down, what do you want
the computer to do?" dialog that gives the user the options of Shutdown,
Restart, Stand By, Cancel.

What we've ruled out:

1. Viruses, trojans, spyware, adware. We've run scans with AdAware, Spybot,
HiJackThis, and virus scanners as well as having McAfee installed on every PC
and kept up to date automatically.
2. Direct user action. The behavior resembles pressing Alt-F4 repeatedly,
but this is not occuring.
3. Hardware issues. We've swapped workstations with a user not having the
problem, and the problem stays with the user, and doesn't follow the PC to a
new user.
4. Profile issues. We've given the user a new profile and the problem goes
away for a day or so, then returns.
5. Server issues. Problem is not happening to every user in a location, so
we don't think it's a server problem.

What we have looked at:

1. Event logs. Nothing there except the usual events associated with apps
closing.
2. Performance Monitor. Again, nothing unusual.
3. AppSight. This tool lets us record literally everything going on with a
certain program or process. This is how we noticed that the shutdown dialog
was coming up AFTER all the processes exit.

What we think it might be:

1. Some sort of resource issue. This problem showed up not long after we
installed a single sign-on solution on the PCs that watches for login dialogs
and web pages, and offers to remember credentials. It is pretty resource
intensive, and some of our custom apps contain multiple web pages, etc. At
the same time, we were rolling out dual monitors and activating NView in the
video drivers to provide management of displays. In that vein, we've had
users turn off one or both items, which reduces the frequency, but doesn't
eliminate the problem completely.
2. Overheating, but usually that results in a power off, not in applications
closing, and we don't think that even if overheating could cause apps to
close, they would exhibit the same closing behavior each time.

If you've read this far, hopefully you are curious, or know the answer or at
least have some ideas.

I and my colleagues would appreciate any input at this point.

I will try to provide any requested info as long as it's something I can
freely provide.

Thanks,

Dave Hampson

 

[Quaoar]

Here is the situation. This is a problem we are seeing for about 1%
of our users at my company that just received new Dell workstations.
Here are the specs:

Dell Optiplex GX270
Windows XP SP1
Pentium 4 2.8GHz with HyperThreading
1GB RAM
40GB HD
nVidia GEForce FX5200 video card with 128MB

Here is the behavior we are seeing anywhere from once every two weeks
to 4 or 5 times a day:

1. User logs in when they arrive. We use Windows 2003 servers and
roaming profiles for the users.
2. Our suite of applications loads based on a layout that the user can
specify. Most users have a custom layout, but others use predefined
layouts of apps.
3. At some point, most, but not all, of the application windows close,
leaving behind the same apps almost every time. The related processes
exit as well.
4. After the exiting of processes, and this is what is strange,
msgina.dll is called to display the standard "Windows is shutting
down, what do you want the computer to do?" dialog that gives the
user the options of Shutdown, Restart, Stand By, Cancel.

What we've ruled out:

1. Viruses, trojans, spyware, adware. We've run scans with AdAware,
Spybot, HiJackThis, and virus scanners as well as having McAfee
installed on every PC and kept up to date automatically.
2. Direct user action. The behavior resembles pressing Alt-F4
repeatedly, but this is not occuring.
3. Hardware issues. We've swapped workstations with a user not having
the problem, and the problem stays with the user, and doesn't follow
the PC to a new user.
4. Profile issues. We've given the user a new profile and the problem
goes away for a day or so, then returns.
5. Server issues. Problem is not happening to every user in a
location, so we don't think it's a server problem.

What we have looked at:

1. Event logs. Nothing there except the usual events associated with
apps closing.
2. Performance Monitor. Again, nothing unusual.
3. AppSight. This tool lets us record literally everything going on
with a certain program or process. This is how we noticed that the
shutdown dialog was coming up AFTER all the processes exit.

What we think it might be:

1. Some sort of resource issue. This problem showed up not long after
we installed a single sign-on solution on the PCs that watches for
login dialogs and web pages, and offers to remember credentials. It
is pretty resource intensive, and some of our custom apps contain
multiple web pages, etc. At the same time, we were rolling out dual
monitors and activating NView in the video drivers to provide
management of displays. In that vein, we've had users turn off one or
both items, which reduces the frequency, but doesn't eliminate the
problem completely.
2. Overheating, but usually that results in a power off, not in
applications closing, and we don't think that even if overheating
could cause apps to close, they would exhibit the same closing
behavior each time.

If you've read this far, hopefully you are curious, or know the
answer or at least have some ideas.

I and my colleagues would appreciate any input at this point.

I will try to provide any requested info as long as it's something I
can freely provide.

Thanks,

Dave Hampson

Likely your #1: once loaded, the damage has already been done; memory
leak, memory management issues, bogus instructions or incorrect use of
API calls. If the log-on app is actually polling the OS through API
calls frequently, look at that as the source of the problem, i.e., each
call fails to reuse memory already allocated by the previous iteration
or there is a counter overflow. Something simple in a poorly QA'd code.

Q

Q