Certain installers lock up XP

[mikemacdee]

I'm running Windows XP on a Dell Dimension 4800. We've had it for a while, obviously.

Against my better judgment I took this puppy in to Geeksquad to check one problem and it came back with another that I believe is registry related: certain program installers/uninstallers lock up the computer that didn't use to lock it up. Clicking icons and buttons and even ctrl/alt/del do nothing, and nothing short of pulling the plug cures it. RAM use is normal when it happens, so I know nothing is eating all my RAM and causing a dramatic slowdown. It's been like this for a couple weeks, virus/spyware scans reveal nothing, system restore didn't cure the problem, and I'll be damned if I'm taking it back in to the people who may or may not have caused the issue in the first place (it's possible the problem started before the Geeksquad visit and just didn't rear its ugly head 'til afterward). Some fluke just turns it into a zombie.

Here's a list of things that have caused the lockups so far:

audacity sound software installer
adobe flash player update for ie
webroot spy sweeper update
registry cleaning program uninstaller (didn't use it, found out it was bogus, but then I couldn't get rid of it and had to do a system restore just to be safe).

When I run any of these, the computer locks up before it gives me any options. The only one that's really bothering me is the webroot update, being that it's for my spyware protection (its the program update, fortunately, not the definition update). Nobody else has posted a problem like this anywhere on the net that I can see: just issues regarding "windows locks up after installing sound card/video card/windows" and it's really irritating.

So any suggestions of the problem's cause? If I can get around having to reformat again that would be great.

 

[mailpup]

On balance, IMHO, reformatting would be less trouble and take less time than struggling with all these problems. Of course, save any data you don't want to lose. Instead of dealing with this for a couple of weeks, you'd be done by now.

 

[mikemacdee]

On balance, IMHO, reformatting would be less trouble and take less time than struggling with all these problems. Of course, save any data you don't want to lose. Instead of dealing with this for a couple of weeks, you'd be done by now.

Yeah, I totally agree, but if the cause turns out to be something minor I'd rather not use such a dramatic solution. It'd take me forever to put everything back on afterward....

 

[Bobbye]

Against my better judgment I took this puppy in to Geeksquad to check one problem

1. What was that problem?
2. Was that problem resolved?
3.

registry cleaning program uninstaller (didn't use it, found out it was bogus, but then I couldn't get rid of it and had to do a system restore just to be safe).

Ah, maybe damage form this?
4.

When I run any of these, the computer locks up before it gives me any options.

Locks up in as 'freeze', crash, error message?
5. Have you checked the Event Viewer for Error corresponding to 'lock up'?
Start> Run> type in eventvwr

Do this on each the System and the Applications logs:
1. Click to open the log>
2. Look for the Error>
3 .Right click on the Error> Properties>
4. Click on Copy button, top right, below the down arrow

Please ignore Warnings and Information Events. Do not paste the entire log.

I'm not big on reformatting/reinstalling. To me that's the last ditch when "nothing" else will work.

 

[mikemacdee]

The initial problem was that the computer would give me the "primary drive 0 not found" error seemingly at random, and windows wouldn't boot. When I unplugged the machine, let it rest for a few hours, and plugged it back in it was fine. This happened twice in the course of two weeks and it gave me the impression that the hardware was overheating due to excessive dust (we'd had two house renovations that spewed thick, clinging white dust onto every surface, which we found in the machine when we popped it open). I had Geeksquad double check for other hardware problems and when they found none I had them clean everything with compressed air. Haven't had that error since.

While they were doing the hardware diagnostic, though, they ran a program to check the registry for errors and said their program found and fixed a couple policy errors. The explanation on the paperwork was very vague and the guy that did the job didn't know what the errors were because it was just a matter of "error found, hit the FIX button to fix it." But again, I don't know for sure if the new problem appeared because of this or if it appeared before the Geeksquad visit and just went unnoticed til afterward (I did a system restore to a week before the Geeksquad job and the problem was still there).

When the computer locks up it just becomes unresponsive. Clicking the Start Menu button doesn't bring up the start menu, double-clicking icons doesn't run the attached applications, ctrl/alt/del doesn't bring up everyone's favorite little menu. All this happens the moment I double-click the aforementioned (un)installers, and I'm forced to pull the plug to fix it because not even a hard reboot is possible.

That registry cleaning program I downloaded definitely didn't cause the problem: i downloaded it a week after discovering the lockup issue.

I'll try what you suggested and post the results later. Too tired now....

 

[Bobbye]

the guy that did the job didn't know what the errors were because it was just a matter of "error found, hit the FIX button to fix it."

And you "paid" someone to tell you this?! When you've rested up and got the events, I'll take a look.

 

[mikemacdee]

And you "paid" someone to tell you this?!

Actually, that was a bonus. I paid someone to not find a problem I already knew about. At least they actually fixed that one when I told them to....

I have no intention of ever visiting them again regardless.

 

[mikemacdee]

I recently learned that the computer randomly locks up on startup, too: family failed to tell me about this until today, so I don't know how long it's been going on. I ran that SpySweeper program update at about ten to 9, and not only did it lock up immediately, but the computer locked up on the next 3 successive reboots shortly before windows finished booting. Restarted in safe mode and it was fine. Did spyware scan and found nothing.

I found several instances of 4 different System Errors from the time I ran the installer to the time I finished scanning and rebooted normally. They are:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 5/4/2009
Time: 8:54:07 PM
User: N/A
Computer: USER-IETMS0KJ26
Description:
The MCSTRM service failed to start due to the following error:
The system cannot find the file specified.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 5/4/2009
Time: 8:59:03 PM
User: NT AUTHORITY\SYSTEM
Computer: USER-IETMS0KJ26
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 5/4/2009
Time: 8:59:57 PM
User: N/A
Computer: USER-IETMS0KJ26
Description:
The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error:
A device attached to the system is not functioning.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 5/4/2009
Time: 8:59:57 PM
User: N/A
Computer: USER-IETMS0KJ26
Description:
The following boot-start or system-start driver(s) failed to load:
AFD
Fips
intelppm
IPSec
MRxSmb
NetBIOS
NetBT
OMCI
RasAcd
Rdbss
Tcpip
tmtdi

There were about four to six occurrences of each, except the last one, which only popped up once. There were no Application Errors in the time I specified.

So whaddaya think?

 

[Bobbye]

None of these 'errors' are actually 'errors'. You were in Safe Mode, attempting to use a process that does not start in Safe Mode.

Try again in Normal Mode.

 

[mikemacdee]

Try what again in normal mode? I was in normal mode when I locked the computer up.

If these are just normal things that pop up when I'm in safe mode, then maybe this problem doesn't register any error at all in the log.

 

[Bobbye]

Try what again in normal mode? I was in normal mode when I locked the computer up.

Restarted in safe mode and it was fine.

The following process belongs to RealNetworks Virtual Path Manager.
[

Event Type: Error
Event Source: Service Control Manager
Event ID: 7000
Date: 5/4/2009/ Time: 8:54:07 PM
Description: The MCSTRM service failed to start due to the following error:
The system cannot find the file specified

.

Are you starting up with Real Player checked to start on boot? Since there is a 5min. interval between this first Error and the rest, I am not sure you were in safe Mode them. I advise you go to the start Menu using msconfig> uncheck any entries related to this. It can be that if you were in Safe Mode at 8:54:07pm, it doesn't start in Safe Mode:

Date: 5/4/2009 Time: 8:59:03 PM to 8:59:57 PM> on this date, during this time interval, the machine was running in Safe Mode.

Event Type: Error
Event Source: DCOM
Event ID: 10005
Date: 5/4/2009/Time: 8:59:03 PM
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Event Type: Error
Event Source: Service Control Manager
Event ID: 7001
Date: 5/4/2009/ Time: 8:59:57 PM
Description: The DHCP Client service depends on the NetBios over Tcpip service

Event Type: Error
Event Source: Service Control Manager
Event ID: 7026
Date: 5/4/2009/ Time: 8:59:57 PM
Description:
The following boot-start or system-start driver(s) failed to load:
AFD. etc.

 

[mikemacdee]

At 8:54 I was in normal mode trying to run the anti-spyware program update. I'm also pretty sure we haven't had realplayer on here for years, unless Rhapsody is related to it.

Is there anything else I can check that might be useful?

 

[Bobbye]

"MCSTRM service"

is connected with the Real Rhapsody software.There are quite a few links resulting from that Google search showing what to do. Here's just one example: Fix found here:

http://real.lithium.com/real/board/message?board.id=InstallingRhapsody&thread.id=30807

If you don't use Rhapsody (which comes preinstalled on many OEM computers),
I'd just uninstall it rather than mess with it.

The Events clearly indicate the system was in Safe Mode at the time they occurred. The only suggestion I have is to boot into Normal Mode and deliberately reproduce the errors. Then go back to the Event Viewer and see if they occur. If they do and you KNOW you were in Normal Mode, then the Geek Squad has messed the system up- likely be changing Startup Type for these Services.

Check that here:
Start> Run> services.msc> find each of the Services mentioned> double click on each> make sure set as below:
DCOM> Automatic
DHCP> Automatic
AFD> Manual

(These services depend on AFD, so if AFD isn't running, they won't run either:
Network Location Awareness (NLA)
TCP/IP NetBIOS Helper
DHCP Client
QoS RSVP

Fips>> Federal Information Processing Standards (FIPS) Manual
intelppm> Inter Process Driver. Part of the OS< Manual
IPSec> Automatic
MRxSmb> Part of the OS> Manual
NetBIOS> Automatic
NetBT> NetBIOS Over TCP/IP. Required by Networks that use TCP/IP for File and Printer Sharing.
(DHCP Client and TCP/IP Helper Services "depend on" NetBT running. If it is not, they won't run either.)
OMCI>> Dell OpenManage Client Instrumentation>> Manual or Disable
RasAcd>> RAS Automatic Connection Driver>> Manual
Rdbss(Redirected Drive Buffering SubSystem Driver)

IF this occurs in Normal Mode:
rdbss.sys is located in the folder C:\Windows\System32\drivers.You may
extract a fresh file from XP CD. Or Run this command:
sfc /scannow

Reboot your machine and see if the issue will resolve.[/QUOTE]
Tcpip> Automatic
tmtdi> Trend Micro Network Security Components > Manual or Automatic IF using software from this company.

The above represent either Services or drivers. They typically do not start when the system is booted into Safe Mode. Please don't go changing anything unless you have established with certainty that the Errors were made in Normal Mode- even seconcd here can change what loads!

 

[mikemacdee]

Well this is interesting: AFD isn't even on that list.

I'll do it again and keep rebooting til it stops locking up, then I'll check and get back to you. In the meantime, what does sfc /scannow do? This is the first I've heard of it.

 

[Bobbye]

Well this is interesting: AFD isn't even on that list.

Actually it is: In Post #8:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 5/4/2009
Time: 8:59:57 PM
User: N/A
Computer: USER-IETMS0KJ26
Description:
The following boot-start or system-start driver(s) failed to load:
AFD
Fips
intelppm
IPSec
MRxSmb
NetBIOS
NetBT
OMCI
RasAcd
Rdbss
Tcpip
tmtdi

There were about four to six occurrences of each, except the last one, which only popped up once. There were no Application Errors in the time I specified.
So whaddaya think?

 

[mikemacdee]

I mean it wasn't in the services.msc list when I checked. Or does it not appear there in the first place?

 

[Bobbye]

The following is for your information only- a description of what it is. It's not going to start in Safe Mode.

Copy and paste from 2 MS sites:

afd.sys: Ancillary Function Driver for WinSock belongs to the software Microsoft Windows Operating System or AFD Networking Support Environment . afd.sys is a Windows core system file. The TCP/IP NetBIOS Helper Service and the QOS RSVP Service depend on the AFD Networking Support Environment Service to function properly.

You do NOT need to take ths action> it's FYI only.

To find afd:
1. Start Device Manager.
2. Click View, and then click Show hidden devices.
3. In the right pane of Device Manager, click Non-Plug and Play Drivers.
4. Double-click AFD Networking Support Environment.
5. Under Device usage, select the Use this device (enable) check box, and then click OK.

If AFD Networking Support Environment does not appear in Device Manager, run the sfc /scannow command to force the System File Checker to scan and verify the versions of all protected system files.

If you note in the group that won't start in Safe Mode, it includes TCP/IP NetBIOS Helper Service which also won't start because of the dependency.

 

[mikemacdee]

The comp locked up on startup today (normal mode). I rebooted, and found it did it again. Third time was a charm. This familiar error came up right before both lockups:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 5/9/2009
Time: 2:39:57 PM
User: N/A
Computer: USER-IETMS0KJ26
Description:
The MCSTRM service failed to start due to the following error:
The system cannot find the file specified.

I ran sfc /scannow, too, with the Windows XP disk in the drive (my drive is pretty much shot but it seems to do okay when it's rested a while -- been meaning to replace it). A window popped up frequently stating "files need to be copied from the cd, make sure the disk is in your CD-Rom" with retry, more info, and cancel buttons. It doesn't pop up at first; after a while, still early in the scan, it pops up about every ten to twenty seconds. then it pops up again and again until i just cancel. i ran it twice and both scans went like this identically, so I don't know if there are tons of files missing or if my cd-rom screws up in a really anal retentive fashion. Should I go ahead and copy-paste a new rdbss.sys from the CD or is sfc /scannow supposed to do that for me?

 

[Bobbye]

This Error:
Event Type: Error
Event Source: Service Control Manager
Event ID: 7000
Date: 5/4/2009/ Time: 8:54:07 PM
Description: The MCSTRM service failed to start due to the following error:
The system cannot find the file specified

has to do with Real Player. It's not going to be on the Windows CD. And if Real Player is crashing the system, you need to remove it :
1. Uncheck all Real Player entries on the Startup menu using msconfig.
2. Uninstall Real Player> use the uninstaller if program has one. If not, uninstall in Add/Remove Programs in the Control Panel.
3. Delete the program folder using Windows Explorer> Programs.

Empty the Recycle Bin when through.

Clicking the Start Menu button doesn't bring up the start menu,

Accessing the Start Menu to make changes is done using Start> Run> msconfig> enter> Selective Startup> Startup Menu.

You are getting indication of hard drive problems, possibly failure. Recommend you backup anything you do not want to lose. I don't think Real Player is causing all the problems.