Does the System Run without Crashing?

Say the system boots in normal mode; or by following step 2, you have the system booted in Safe mode or using the Last Known Good configuration. Now, does the system run without crashing? If yes, go to step 4. Otherwise, read on.

First, since the system boots, it is probably almost right. But "almost" covers a really wide territory. Does the system boot, but then crash almost immediately? Or does the crash come sometime later? Can you cause it to crash by running an application or performing a specific task? Does the crash seem to happen at random times, or does there seem to be some rhyme and reason to the crash? We're in detective mode now.

The System Boots, Then Crashes Almost Immediately

This situation is virtually as bad as a system that won't boot. Possibly the cause of the crash is something that is starting up when the system starts. Try this: Start the system, but don't log on. Just sit and watch for at least twice as long as it normally takes to crash. Does it crash? If it does, this is probably due to some system component. You are probably stuck with little or no hope except to reinstall or to restore from a backup.

If the system doesn't crash immediately, the crash is probably due to something that the user is loading. Log on as another user. Does it crash? If it does, the problem is probably

something that is common to all users. Check out the common Startup directory

(%SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup or

%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Startup) and clean it out. Try starting the system again. If it fails again, you are probably stuck with either a restore or a reinstallation.

If the system only crashes when you log on as a particular user, you may be saved yet. Check the failing user's Programs → Startup directory in the Start menu. Check all Programs\Startup directories for that matter, cleaning out each one; put anything contained in the Startup

directories into temporary directories. Once you have cleaned out the Startup directories, log on again as the user who causes the system to fail.

If the system doesn't fail once you've cleaned out a user's Startup directory or the Startup directory for all users (you're almost home free now), check the entries that were in the Startup directory. Consider manually starting each one; then wait for a reasonable period to see if the system fails or not. This will almost certainly help localize the problem to a single entry in the Startup directory.

How do you get to the Startup directory if the system keeps failing? Again, you can rely on your old friend, the dual-boot. (You did create a dual-boot system as I described in Chapter 2, right?) Boot the backup operating system and use it to allow you to clear out the Startup directories. Just make sure you are deleting the correct Startup directories.

Some additional locations that items may run from include:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ CurrentVersion\Run

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\

CurrentVersion\RunOnce

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\

CurrentVersion\RunOnceEx

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\

CurrentVersion\RunServices

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\

CurrentVersion\RunServicesOnce

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

• HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Run

• HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\RunOnce

• HKEY_CURRENT_USER\Software\Microsoft\Windows\

CurrentVersion\RunOnceEx

• HKEY_CURRENT_USER\Software\Microsoft\Windows\

CurrentVersion\RunServices

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\

RunServicesOnce

• HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run

• HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load

The Crash Comes Sometime Later

How much later? Minutes, hours, or days? A crash that comes many hours or days later is probably not related to the registry. A crash that happens a few minutes later is almost identical to the above situation where the crash is virtually immediate. Nevertheless, a crash that happens some minutes or even an hour later could easily be a registry entry gone awry.

How does this happen? When Windows XP starts, it starts up many services and devices.

Some services are slow to start and other services start but then spend some time initializing.

Try this: In either %SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup or

%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Startup (depending on whether the current installation is an upgrade or a clean installation), put in a link to

taskmgr.exe. This launches the Windows XP Task Manager application. Look at what Task Manager is saying. Sort the entries in the Processes tab by CPU usage. Do you see an

application that is jumping up in CPU utilization just before the system crashes? This may be the problem.

OK, let's say you have a suspect. The Task Manager shows a big chunk of CPU utilized by a particular application. Let's call this application badapp.exe. (Great name, isn't it?) What do you do? First, it would be nice to simply tell Windows XP not to load or execute badapp.exe.

However, it may be virtually impossible to do that, since this application may be launched by a registry entry. Remember, there are six places in the registry that function much like the various Programs\Startup directories.

What is the next best thing? If you have nothing to lose, consider temporarily renaming the file. Boot into your backup operating system and use it to rename the file, giving it a new temporary filename. I would add the prefix bad_ to the original filename, making it easy to find later. Just make sure you are renaming the correct file.

After renaming the file, restart the original or backup Windows XP installation. You should expect to see at least one message informing you that the file you renamed can't be found, and you can probably ignore this. Probably, but not always. If the file is a necessary part of the operating system, Windows XP probably won't start. Arrgggg! Such is life; in this case, an operating system restoration or repair is the only solution.

Can You Cause the System to Crash?

Sometimes the system will remain stable until you do a specific thing. In this case, there are two possible courses of action. If the application worked at one time and just recently started to fail, something has happened either to the application's files or to the application's registry entries. In either case, a good course of action is to simply try reinstalling the application.

If possible, try removing the application before doing the reinstallation; be sure to back up any user data files first, though. Sometimes installation programs don't write over certain files that already exist.

If the application never worked on your system, again, there is but one alternative: uninstall the application, posthaste. Sadly, some applications are poorly written and don't have an uninstall program. With due caution (make backups), rename the application's directory to

something you'll notice, so that in a week or so, if the system remains stable, you can delete the directory.

After renaming the application's directory, restart the system and see if there is any instability.

If things are stable after a day or two, use a registry cleanup tool such as RegClean, CleanReg, or RegMaid to extract any registry entries for this application. My choice would be to use CleanReg (see Chapter 8), because CleanReg will check more than just the OLE entries.

The Crash Happens at a Specific Time or Date

If the system always seems to crash after a specific time, check to make sure that there are no time-based applications or commands that run. (The Windows XP AT command is a suspect here.) What other things happen at the time? Is the time absolute or relative to boot? If absolute, suspect that something is being started at the specific time or shortly before. If relative, look for something that is being started with the system bootup, but maybe taking a very long time to initialize because it fails. Note that some systems are timing interdependent, which means that process A must start after process B. Again, beware of any catch-22

situations where two processes are mutually dependent.