Strange shutdown error message in XP Pro 6

[RBHirsch]

After finally disabling Spyware Doctor, the serious problems being produced by it seemed gone. So I totally unninstalled the software.

But, it was still after me. When I went onto the Internet, I had no connection. I confirmed that my network was OK, on another machine. So I tried again, and when the "no access" message box came up, and XP offered to help with the problem, I decided to let Windows XP Pro "fix" the problem. It came up with a message box stating that (sorry, I didn't copy down the exact message) a layer/file (or something) from PC Tools (the company behind Spyware Doctor) was the culprit, and did I want it removed. I clicked on OK, rebooted, and all seemed well - IE 7 and my OE mail were back in place.

But now, all of a sudden, when I shut down my system, and the shutdown has gone about half was through, a blue screen with this message appears

STOP: c000021a {Fatal System Error}
The Windows Logon Process System process terminated unexpectedly with a status of 0xc0000005 (0x00000000 0x00000000)
The system has been shut down.

At this point, I just kill the power, as Windows has been shutdown, but not in the proper event sequence et al.

I don't understand what the logon process has to do with shutting down, unles somehow, I've been logged on incorrectly.

I'm the only user, and administrator. I have not set up any password, so when I turn on my machine, it just boots up, asking nothing more of me.

Can anyone give me an idea of what that message means, and what I can do to get rid of it?

I'm perfectly willing to edit the Registry, or go into the users' setup screens, or whatever is needed to resolve this issue.

Thanks

Ron Hirsch

 

[linney]

The Question Marks are nothing to worry about, or so it seems if you read this.

Should this have this 2 ?'s in /??/C:/Windows/System32/csrss.exe

http://www.wilderssecurity.com/showthread.php?t=87980

If you want the highly technical cause of a crash look in the Documents and Settings/ All Users/ Application Data/ Microsoft/ Dr Watson/ Drwtsn32.log

Find the entry that is relevant by date and time to the crash you are investigating. The exact cause of the crash is indicated by "FAULT ->" on the left of page next to line of code causing crash. This, if your as cluey as me, wont tell you much but you can use it to see if it is the same fault all the time, and further up the log you can find what processes and modules are running.


How to gather information after a memory dump in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;314084&Product=winxp

315263 - Reading the Small Memory Dump Files That Windows XP Can Create for Debugging

http://support.microsoft.com/default.aspx?scid=kb;en-us;315263&FR=1&PA=1&SD=HSCH

314084 - How to gather information after a memory dump in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;314084&FR=1&PA=1&SD=HSCH

315271 - How to Use Dumpchk.exe to Check a Memory Dump File

http://support.microsoft.com/default.aspx?scid=kb;en-us;315271&FR=1&PA=1&SD=HSCH

254649 - Overview of memory dump file options for Windows 2000, for Windows XP, and for Windows Server 2003

http://support.microsoft.com/default.aspx?scid=kb;en-us;254649&FR=1&PA=1&SD=HSCH

Other sources of information.

Location of Dr Watson dump files

X:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp

X:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson

Help and Support titles to read.

Using the Dr. Watson log file
Using Dr. Watson


These will take you up a further level in debugging and introduce you to Symbols and other non-musical terms.

Debugging a DUMP file in XP
thread779-1292544

Third copy attempt on 2GB data files = BSOD!
thread779-1025514

By the time you have read that lot a clean install will seem like a breeze.

 

[RBHirsch]

Linney,

The DrWatson dumps always reference the same "Winlogon.exe" file. And of course, that file with added text in the name is always the one in the PCHealth dump folder.

What has me puzzled is why a shutdown after a boot is always clean. And sometinmes, even after working in several programs, it is clean. This seems to say that some activity that I perform is related to the crash.

I guess my next step will be to try and repair the Windows install. But before I do that, I guess I could try to use a Restore point from a time period before the problem.

It's not clear to me what using "Restore" actually changes in the Registry. This whole thing has been one puzzling situation - even more so, since along the way I had several days of clean shutdowns, which suddenly changed to crashes. There are variables here that escape me.

Ron

 

[linney]

Here's a thought, in the ten days this post has been running I have clean installed 3 systems and fully updated them with Windows and necessary programs and restored data files. OK, it was a new machine that I set up to multi boot, but I'm sure there is a moral in the story?

Have a read of this first article, it will give you an insight of what is available in a Restore Point, and how to manually recover the Registry Snapshot, if just using System restore doesn't do it for you.

An easy to follow recovery console description when unable to start computer due to corrupt registry.

http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot_toot.htm

The above is a layman's version of Q307545 in simple language. I believe that 307545 has a Guided Help Tool to do it for you. This might be a rare example of where the Guided Help might work, as in most instances people facing the dilemma that the MSKB refers to, can't boot at all, so the tool is useless.

Those last are just for reading and information. Here is some more information on System Restore.

How to gain access to the System Volume Information folder

http://support.microsoft.com/default.aspx?scid=kb;en-us;309531&FR=1&PA=1&SD=HSCH

Microsoft Windows XP System Restore

http://msdn2.microsoft.com/en-us/library/ms997627

MS-MVP Bert Kinney's site is only about System Restore in XP:

http://bertk.mvps.org/

I'll throw this in for you too, it might come in handy if you are ever delving into the Registry?

Registry Backup and Restore for Windows NT/2000/XP

http://www.larshederer.homepage.t-online.de/erunt/

 

[RBHirsch]

Thanks Linney. You've been outstanding in the time and efforts you've put in, in past weeks.

One further simple question for you, if I may.

The "crash" on shutting down would seem to be similar to just powering down the computer, rather than using the usual approach, and missing the "saving your settings" function.

The effects of this situation have not been visible to me in the normal course of using my system. What negative effects are actually involved when a user just "pulls the plug", as opposed to using the normal shutdown procedure?

Ron

 

[electronicsfreak]

If your refering to computer shutting down without asking to save anything that can be stopped in registry. Go to start, run, type regedit and hit enter. Click edit , then find and type autoendtask

When it finds it, right click on it, left click modify and change the value from 0 to 1 if its 0.

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[electronicsfreak]

I meant to say change it from 1 to 0 as 1 will make it shutdown without asking to save anything.

1 means yes auto end task, shutdown without asking to save

0 means no, prompt you to save first

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[linney]

I think we touched on faulty Shutdown in comments of 9 Oct 07 15:34 and 9 Oct 07 16:37. The NTFS file system is pretty good in handling such problems without too many problems but repeated faulty Shutdown might be pushing your luck.

Here's something else you can try if you have the room on the hard drive. It may be a way of eliminating possible causes of the problem?


See this paragraph in this article.

"To install Windows XP to a new folder (to perform a parallel installation):"

How to install or upgrade to Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;316941&FR=1&PA=1&SD=HSCH

After the parallel install you then have a testing platform running on the suspect machine. There is no need to immediately activate it either. See if you can duplicate the fault as you add software etc. If I was a betting man I'd say you won't be able to, but I always lose those type of bets.

 

[RBHirsch]

Here's some interesting happenings in the case of my crashing on exiting - and a potential workaround that I discovered.

Hopefully some of the Tek-Tips forum experts can interpret my workround (see below), and see a path to correct whatever is interfering with a "normal" shutdown.

If I was convinced that running a repair with my XP CD would have resolved things, I would have done that already. But I'm not convinced that it would resolve things completely. Remember, the shutdown crash has never occurred if shutdown was done immediately after booting up, indicating possibly that elements outside of the OS were contributing to the situation. And aside from the shutdown crash, bootup and performance was always perfectly normal with no problems. And days might go by where normal shutdowns occurred.

I did some playing with my startup programs. And I also have defragged my C drive several times - zero problems there. I installed the latest version of Ccleaner, and cleaned the Registry, and also removed all the various "trash" and other extraneous files in the system several times.

Suddenly, everything seemed back to normal - the crashes stopped, for 3 days, and over a dozen sessions. But, based on history, I wasn't ready to claim victory. This scenario had happened previously, and suddenly the crashes would return.

Sure enough, on the 4th day, the crashes restarted, on every shutdown (except those immediately after bootup). The error message was back to the "winlogon.exe" problem, and the DUMP subfolder in the Windows PCHEALTH folder got its copy of winlogon.exe with the added date string and added HDMP extension.

All the material I've read said that this situation was most likely related to permission to access system files during shutdown, and when this failed the crashes occurred. Why the permissions were being denied was unknown to me. I am the only user, and administrator. So I decided to try a new shutdown procedure. Rather than starting off by using the normal shutdown procedure, I logged off first. Then when the log off was completed, and the next window showed, I elected to shutdown. Things went smoothly, with no crashes.

I have now used this procedure for three days, and all has been well. Of course, I've been through false "fixes" before now, where I never really knew why things got fixed. But in this latest scenario, the "fix" I tried immediately produced smooth shutdowns, with a plausible reason - I wasn't logged on when the final shutdown was selected. If this will continue to resolve things, I have no problem using that new shutdown routine. The actual time until the computer turns off is essentially the same as the older standard shutdown routine.

So, with this new info, can anyone suggest where something may be "set wrong", or where a Registry entry may need some editing?

Ron Hirsch

 

[linney]

Have you tweaked your Registry with any Shutdown Fast editing such as this?

"shutdown xp Faster" [HKEY_LOCAL_MACHINE/SYSTEM/CURRENT CONTROL SET/CONROL Then Select "Wait To Kill Service Time out" Highlight it and modify from 2000 to 200"

Corrupted Profiles and the UserHive cleanup tool I think have already been mentioned in this thread.

 

[RBHirsch]

Hi Linney,

I have no such key under the CONTROL listing?? I did a REgistry search for "Wait To Kill Service Time out", and no such item was found anywhere

Will the REPAIR procedure restore that key, assuming that it is missing. And, would it also fix any profile or userhive problems, should they exist?

It seems that the problems are in those areas.

Earlier, I accidentally shutdown the "usual" way, without first logging off, and the crash occurred. Next time I logged off first, and it shut down smoothly.

Ron

Ron

 

[linney]

shutdown xp Faster" is a tweak that I wondered if you had manually inserted. Don't worry about it if you haven't installed it.

"Will the REPAIR procedure restore that key, assuming that it is missing. And, would it also fix any profile or userhive problems, should they exist?"

No to the first and probably No, but I can't be sure to the last two . A repair install will do its best to save your settings (that's the nature of the beast) as well as repair Windows, sometimes the two conflict and bad user settings and malware get saved during the repair.

If it is a profile problem then this may help.
811151 - How to Copy User Data to a New User Profile

http://support.microsoft.com/?kbid=811151

To download and install UPHClean, visit the following Microsoft Web site:

http://www.microsoft.com/downloads/details.aspx?FamilyId=1B286E6D-8912-4E18-B570-42470E2F3582

 

[RBHirsch]

Well, I finally bit the bullet, and used the REPAIR mode of my XP Pro CD. The shutdown crashes returned in spades. All went reasonable smoothly, but it did take a looong time to do it all.

There is a minor glitch somewhere now. I needed of course to download all the updates since my SP2 XP Pro CD was made.

There are no longer any crashes during shutdown. But, I have 80 updates to be installed, and that message comes up when I proceed through shutdown. So I click on the shutdown icon (as instructed and usual), and the next thing that appears is a message stating that 1 of 80 updates is being installed. But the shutdown still proceeds, and the system shuts down cleanly after 10 seconds or so, before any of the updates have been installed.

I can't find a setting anywhere that controls this.

Any idea how I can set things such that the updates do get installed before the system shuts down?

There are no error messages or anything else. It just appears that the shutdown proceeds as if there were no updates being installed.

Ron Hirsch

 

[linney]

I don't know whether you will find anything useful in this thread but have a look anyway.

XP Home auto restart after updates
thread779-1399261

This might give you a few ideas, although the update pack seems to only go up to June this year.

RyanVM's Windows XP Post-SP2 Update Pack

http://www.ryanvm.net/msfn/updatepack.html

You might find something similar around the traps. AutoPatcher ran foul of Microsoft but can still be found in a few places, but that stops at August.

If you use Windows Updates that should after the first couple of Housekeeping updates, proceed with the next 70 odd without a need for any reboot.

You may at some stage run in to the failure of updates to install because of a current (Windows Update) problem too.

Updates are not installed successfully from Windows Update, from Microsoft Update, or by using Automatic Updates after you repair a Windows XP installation

http://support.microsoft.com/kb/943144/en-us

Windows Updates Fails After Upgrading to WindowsXP
thread779-1393612

 

[RBHirsch]

Hi Linney,

I've gotten some new info - the problem appears to be that the updates are failing to install, and may well be cured by the following.

Windows Updates Fails After Upgrading to WindowsXP
thread779-1393612: Windows Updates Fails After Upgrading to WindowsXP

I had initially assumed that shutdown just didn't pause to do the installs. But the problem appears to be that the shutdown occurs after XP refused the installs of the updates. So I'm going to work on the Registry steps to create the necessary Registry entries noted in the MS documents you gave me the links to.

I had previously instlaled the Windows Update Agent, but that did not help. Just now I went into TOOLS>WINDOWS UPDATE in IE, and downloaded all the updates. But Windows then reported that installing all of them failed

As always, you can be counted on to come through.

I did post a new thread re this, along with another question, as I felt this thread was getting too long, and would not get much attention anymore.

Ron

 

[RBHirsch]

Hi Linney,

Well, you are right on the button again.

The following steps below were all that I had to do to get the update installation working properly. Just register a single DLL. I would think that MS should consider making that part of their REPAIR process.

The 82 updates then all installed as they should. And MS was kind enough not to install IE 7, but put it aside, and then questions users if they wanted it, which I did.

This is the url you gave me

http://support.microsoft.com/kb/943144/en-us

THESE ARE THE STEPS
2. Register the Wups2.dll file. To do this, follow these steps:
a. At the command prompt, type the following command, and then press ENTER:

regsvr32 %windir%\system32\wups2.dll

So, all my shutdowns are going smoothly, and I hope they stay that way. The REPAIR process does take time, and it cannot be started, and then walk away. There were various things that the process wanted along the way, but the bottom line is that all went quite well.

Ron Hirsch

 

[linney]

Only time will tell, I hope this is the end of this problem.

 

[RBHirsch]

Hi Linney,

I have a good feeling about the problem resolution. But, I've had earlier times when the problem disappeared for a few days, and then returned. But, since I have done a very extensive REPAIR of XP, I have high hopes that the work I've done currently has indeed fixed things.

XP REPAIR seems to be as close to a reinstall of Windows as one can come without actually starting from scratch.

And since I have about 12 pieces of hardware installed, and over 100 programs, it's a lot easier to use REPAIR, than start from scratch.

So, thank you again for all your help.

I'm still looking for the path to save my desktop layout with about 100 icons on my display. Any time I do a SAFE boot (which uses a low res display), and then return to my hi res display, the icons are all lumped into one big "blob". I can't find the path to save the desktop
it exists.

Ron

 

[linney]

Safe Mode is a bit like that I'm afraid. I don't think there is any magic setting for the Icons. Procedures that involve a layout.dll file and VBS script may help (see link).

Is there any way to safeguard icon positioning on the desktop?
thread779-1398848

Preserving Desktop after res change
thread779-1348035

I love your questions but it is only you and me reading this thread, please start new threads for off-topic questions so that we can share the questions and possible answers with everyone.

 

[BadBigBen]

No Linney, I am reading this thread, as well, since I was interested in the solution...

just couldn't offer any insight other than that which I had given...



Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[RBHirsch]

Hi Linney,

I did start a new thread with the icon question in it.

There was a little typo in the thread name. But you will see it on the second pages of messages in this forum.

This message thread has really gotten to be a very large one.

I save "stuff" by printing out to PDF, and keep a PDF library on my machines. The thread is now up to about 48 pages!!! It's a small book.

Thanks again -

Ron Hirsch