Hello all!

If you find the time, could you, please, take a look at Windows Update locks up computer and if you have any suggestions, don't hesitate to tell me. I have almost worn out a set of Ghost Boot Disks ... :( ... !

Sorry for being lazy, posting a link to a different forum but thanks in advance,
Christer

I read the referenced thread.  By locked up, do you mean cpu running at 100%?  Ctrl-alt-delete or right-click-taskbar to start task manager.

There have been numerous complaints and postings about Windows Update in XP taking a long time (5 minutes etc.) to determine if you have any updates.  Eventually it finishes.  How long did you wait for the 100% cpu (if that was it) to finish?  

Search for Windows update high cpu usage etc on Google.  There were a few targeted fixes, but in general, it's better to just keep up to date so it doesn't take over the computer, especially if it has been off for awhile.

I would try again and then go to lunch for awhile.

Christer


Quote:

If I, after this time has elapsed, go to Windows Update for a manual download. I have managed to get the ActiveX control and the new update software installed. In addition to that, the WGA thingy but it locks up during or immediately after that update.

So, I was trying to follow the sequence of events...but I am quite lost!!!

Is it the running of Windows Update that results in the problem...or is it a *specific* update that is causing the problem--is it when the WGA is updated and/or runs?

Ghost4me,


Quote:

By locked up, do you mean cpu running at 100%?  Ctrl-alt-delete or right-click-taskbar to start task manager.

I assume that the CPU is running at 100% but I don't know or if so, which process. It locks up completely, mouse pointer moves but no clicks work and nothing else. After hitting the reset button, it restarts but locks up immediately, connected to the web or disconnected. Restoring a Ghost Image is the only way to get it back. The same happens if doing a manual update at Windows Update or an automatic update.


Quote:

How long did you wait for the 100% cpu (if that was it) to finish?

Five to ten minutes. I have experienced lags on other computers where the green bar rolled on and on but no lock ups.


Quote:

... but in general, it's better to just keep up to date so it doesn't take over the computer, especially if it has been off for awhile.

The reason for the system being out of date is that I restored an Image created in March 2005. I brought the system up to date by manually installing all missing updates to current and created a fresh Image which I now use. There is nothing for Windows Update or Windows Automatic Update to do but check that everything is OK.


Quote:

I would try again and then go to lunch for awhile.

I will give it more time to finish but I believe the owner has let it idle for hours.

NightOwl,


Quote:

Is it the running of Windows Update that results in the problem...

Yes, both manual and automatic sessions lock up the computer.


Quote:

...or is it a *specific* update that is causing the problem

No, there is nothing that the system needs, apart from KB892130 which can not be downloaded and installed from CD.


Quote:

--is it when the WGA is updated and/or runs?

On a few occasions, it has managed to install the "new" ActiveX control and the "new" Windows Update software that is prompted for prior to checking for updates. On even fewer occasions has it been able to download and install the WGA Validation Tool (KB892130). On no occasion has it been able to check for other updates and the WGA Validation Tool has never been run (if it runs on each connection, I don't know).

My thoughts:

My first thought was that it must be hardware related (the hardware itself or drivers) since restoring a Ghost Image (for me) has cured everything else.

It has nothing to do with a specific internet provider. The situation is the same at my home as at my friends home.

There is a second task running almost in parallel with wuauclt.exe and that is wmiprvse.exe. Maybe the latter is the culprit and I'm currently looking into that one.

The Windows Update Agent itself has recently been updated. The new files have the time stamp July 2007 which coincides with this issue. Could it be a LAN-driver issue with the new WUA? I have updated to the most recent LAN-drivers but no difference.

I will, sooner or later, do a fresh install to see how it behaves from square one, just XP SP2, nothing else.

Thanks for your input,
Christer

Quote:

I assume that the CPU is running at 100% but I don't know or if so, which process. It locks up completely, mouse pointer moves but no clicks work and nothing else. After hitting the reset button, it restarts but locks up immediately, connected to the web or disconnected.

I would disable Windows Update, and then startup the Windows Task Manager, set the Task Manager so that the cpu column is sorted by highest first, then enable Windows Update.

When you say locked up, Ctrl-Alt-Delete doesn't bring up the Task Manager window?

How are you "manually install all missing updates"?  I've never heard of that; wonder if that is somehow related.

Have you considered reformatting and doing a clean install of XP, and then running Windows update and letting it choose and install all critical and recommended updates?


Quote:

I have downloaded and installed drivers for the chipset which includes LAN-drivers for the nVidia driven port, LAN-drivers for the Marvell driven port (two ports, both are not in use but they are there) and video drivers for the GV-N62128 (strange things can happen with video drivers) but nothing made any difference.

Since you are in the investigation/debugging mode, I would remove one of the LAN cards so the system has only ONE installed.  My choice would be to go to device manager and uninstall the Marvell (never heard of that brand) and then physically remove it after shutting down, then restart.

Christer


Quote:

My first thought was that it must be hardware related (the hardware itself or drivers) since restoring a Ghost Image (for me) has cured everything else.

Not sure what you are saying--drivers will be software!  And if a restore of an image to a previous time *cures* the problem--that certainly means that it's software related, and not hardware--because the hardware remains the same--only the restore of the software image is changing!


Quote:

Yes, both manual and automatic sessions lock up the computer.

So, if you disable Windows Update, the system works fine until such time as you either manually run Update or change the setting to allow Update to run on its own?  

Do you know what Windows program is responsible for running Windows Update?  Can you look at the programs time stamp and properties to see the version number?  Can you replace that program with the original version off the installation CD or from some other system that has a version number that is older--i.e. not a more recent version?

Ghost4me,


Quote:

I would disable Windows Update, and then startup the Windows Task Manager, set the Task Manager so that the cpu column is sorted by highest first, then enable Windows Update.

That's a good idea! When it locks up, Task Manager is on top and I can see what happens, if TM gets it, that is.


Quote:

When you say locked up, Ctrl-Alt-Delete doesn't bring up the Task Manager window?

No reaction to any key strokes or mouse clicks. Ctrl-Alt-Del doesn't bring up TM.


Quote:

How are you "manually install all missing updates"?  I've never heard of that; wonder if that is somehow related.

On my own system, I have Windows Automatic Update set to "notify but do nothing else". When notified of updates, I go to Microsoft Update Catalog and download them to the local HDD and install "manually" from there. In this case, I have burnt the updates to a CD and install "manually" from there.


Quote:

Have you considered reformatting and doing a clean install of XP, and then running Windows update and letting it choose and install all critical and recommended updates?

Yes, I will probably do that later today to find out if XP SP2 (nothing else what-so-ever installed) will connect to WU without locking up. I would be quite surprised if it works because my original Image is as close to a fresh install as one can get.


Quote:

Since you are in the investigation/debugging mode, I would remove one of the LAN cards so the system has only ONE installed.  My choice would be to go to device manager and uninstall the Marvell (never heard of that brand) and then physically remove it after shutting down, then restart.

If only it was possible. Both are integrated on the motherboard. Disabling in Device Manager is the closest one gets.

NightOwl,


Quote:

Not sure what you are saying--drivers will be software!

What I mean is that it is either a hardware failure (motherboard with integrated LAN), which I now doubt (but still a possibility) or any of the hardware drivers (Lan drivers) conflicting with the new version of the Windows Update Client. I regard hardware drivers as being a different "breed" of software.


Quote:

And if a restore of an image to a previous time *cures* the problem--that certainly means that it's software related, and not hardware--because the hardware remains the same--only the restore of the software image is changing!

Maybe I was unclear (as usual) but that restoring a Ghost Image cures a software problem is my general experience but in this particular situation, it doesn't. That's why I suspect(ed) hardware failure or driver conflict. If restoring the Ghost Image had cured the system, I wouldn't post this thread.


Quote:

So, if you disable Windows Update, the system works fine until such time as you either manually run Update or change the setting to allow Update to run on its own?

Yes!


Quote:

Do you know what Windows program is responsible for running Windows Update?

Windows Automatic Update is a service but exactly how it works, I don't know.


Quote:

Can you look at the programs time stamp and properties to see the version number?  Can you replace that program with the original version off the installation CD or from some other system that has a version number that is older--i.e. not a more recent version?

I have planned to check the file versions on my own computer and compare with the other one. I will copy the files from my system to the other one but I doubt that "Windows System File Protection" will allow me to do that.

Christer

Quote:

Quote: Since you are in the investigation/debugging mode, I would remove one of the LAN cards so the system has only ONE installed.  My choice would be to go to device manager and uninstall the Marvell (never heard of that brand) and then physically remove it after shutting down, then restart. If only it was possible. Both are integrated on the motherboard. Disabling in Device Manager is the closest one gets.

Go into the bios when the compuer starts up, and disable one of the on-board nics.  Almost all cmos/bios's let you enable/disable the onboard devices so that a user can use his own video or nic or audio, etc.

Then go into device manager and remove it.

Also, if cntrl-alt-delete won't bring up the task manager then it is likely an issue with either hardware or device driver, such as video or nic maybe driver that has the pc locked.

In your case you can also set the video to vga mode (essentially like safe mode) except that you are just disabling the video drivers.  I mention this since you said the pc works in safe mode.  That signals to me video driver or double nics (unusual) or some other device.

Quote:

The problem coincides (more or less) with the recent update to the Windows Update Client discussed elsewhere on the WindowsBBS.

I'm concerned about your approach to manually download updates and then apply them to another different system.  It's possible that windows update is confused or that your updates weren't applied in the right order (prerequisites).  Of course Windows Update "shouldn't" get confused, but it could take a long time for it to determine which updates are needed when you enable automatic checking.

Also, I am assuming you have checked the website for your Gigabyte motherboard to be certain you have the latest bios updates for it?

At some point you have to decide how much time you want to devote to *fixing* the problem vs. reformatting and clean install.  And which alternative will give you confidence that the pc is working reliably and correctly.  If you like to tinker, tinker on.  If it is a client's business computer, I would reformat, disable the 2nd nic, and only use automatic updates.

In fact I might be tempted to disable BOTH nic's via the bios, and install a separate Linksys pci nic (very cheap now).

Ghost4me,


Quote:

Go into the bios when the compuer starts up, and disable one of the on-board nics.

I haven't checked the BIOS for those options but I have disabled (in Device Manager) each NIC in turn but no difference.


Quote:

Also, if cntrl-alt-delete won't bring up the task manager then it is likely an issue with either hardware or device driver, such as video or nic maybe driver that has the pc locked.

I have uninstalled and reinstalled the most recent drivers for chipset, 2xNIC and video card but no difference.


Quote:

In your case you can also set the video to vga mode (essentially like safe mode) except that you are just disabling the video drivers.  I mention this since you said the pc works in safe mode.  That signals to me video driver or double nics (unusual) or some other device.

I have yet to try that approach. I too lean towards conflicting drivers (WU and something else).


Quote:

I'm concerned about your approach to manually download updates and then apply them to another different system.  It's possible that windows update is confused or that your updates weren't applied in the right order (prerequisites).  Of course Windows Update "shouldn't" get confused, but it could take a long time for it to determine which updates are needed when you enable automatic checking.

I have downloaded updates and burnt to CD for years and installed on other computers. Never a sign of problems. I might miss updates that are specific to what is installed (e.g. WMP9 or WMP10) but the installer never installs an update not intended for the system. You can install in any order but I always install in the order of release date. There is one exception, Windows Installer always goes in first with a reboot before I continue.


Quote:

Also, I am assuming you have checked the website for your Gigabyte motherboard to be certain you have the latest bios updates for it?

No. not yet. It is now on my list. (There is always a degree of risk when updating BIOS and I always regard that as the last option.)


Quote:

At some point you have to decide how much time you want to devote to *fixing* the problem vs. reformatting and clean install.

I have restored the first Ghost Image of the system with XP SP2 only installed, updated to March 2005. No difference. At that time, too, the updates were installed manually from CD and the computer had never seen the internet. No matter what, it has worked flawlessly for over two years until the updated Windows Update Client was released in July 2007 (more on that). Taking it to square one with a reformat and clean installation is the next step. Will do that as time permits (early next week).

Christer

More on the updated Windows Update Client:

I have compared my system with the other system prior to connecting to the internet and letting Windows Update connect and after letting WU connect. A number of files in C:\Windows\system32\ get changed. On my system:

cdm.dll
wuapi.dll
wuapi.dll.mui
wuauclt.exe
wuaucpl.cpl
wuaucpl.cpl.mui
wuaueng.dll
wuaueng.dll.mui
wucltui.dll
wucltui.dll.mui
wups.dll
wups2.dll
wuweb.dll

All these files are time stamped July 30 2007 and the version is 7.0.6000.381.

On the other system, one file fails to install - wups.dll is still the previous version. My conclusion is that something interferes with the installation of the updated Windows Update Client.

Christer

Quote:

Quote: Go into the bios when the computer starts up, and disable one of the on-board nics. I haven't checked the BIOS for those options but I have disabled (in Device Manager) each NIC in turn but no difference.

It's not quite the same thing because unless you physically remove a network card or disable it in the BIOS, it is still available and could be affecting it. By disabling it in the BIOS, Windows XP never sees it at all; as if it were removed.  I'm not saying it is the nic but I am surprised to see to nic's on a motherboard.  Although something *should* work, sometimes it doesn't.

Setting the video card resolution to vga makes it hard to operate on the screen, but effectively removes the video code.  When updating video drivers, often the manufacturer's procedure is to set to vga mode, then uninstall old driver, then install new driver.

Interesting problem.  I'm staying tuned...

Christer wrote on Sep 21^st, 2007 at 4:15pm:

More on the updated Windows Update Client:

I think you can uninstall/remove the Windows Update client.  The new one (introduced maybe 6 months ago) searches for updates for Microsoft Office etc and other Microsoft products, not just XP.  It's a good feature.

Maybe try to uninstall the Windows Update, reboot and then enable updates and see if Microsfoft installs the new one correctly.  I usually use the "custom" (and not express mode) so I can select myself.  Also, I update to the latest one, the one that includes office etc.

Ghost4me,


Quote:

I think you can uninstall/remove the Windows Update client.

I will look into tat option prior to reformating/reinstalling.

In a previous post you wrote:


Quote:

At some point you have to decide how much time you want to devote to *fixing* the problem vs. reformatting and clean install.

I am more or less out of the fixing mode and into the "find out what beat Ghost" mode. I simply want to know!

Christer

Christer wrote on Sep 21^st, 2007 at 5:25pm:

I am more or less out of the fixing mode and into the "find out what beat Ghost" mode. I simply want to know!

I agree it's good to know.  Else, the same problem could resurface again.

Christer


Quote:

I have investigated the updated Windows Update Client. I have compared my system with the other system prior to connecting to the internet and letting Windows Update connect and after letting WU connect. A number of files in C:\Windows\system32\ get changed. On my system: cdm.dll wuapi.dll wuapi.dll.mui wuauclt.exe wuaucpl.cpl wuaucpl.cpl.mui wuaueng.dll wuaueng.dll.mui wucltui.dll wucltui.dll.mui wups.dll wups2.dll wuweb.dll All these files are time stamped July 30 2007 and the version is 7.0.6000.381. On the other system, one file fails to install - wups.dll is still the previous version. My conclusion is that something interferes with the installation of the updated Windows Update Client.

Quote:

The system has worked well as configured in March 2005. Only recently did this issue develop. There was a new release of the Windows Update Client itself in July 2007 and this coincides with the problem but I don't know if there is a connection and if so, which.

Based on your troubleshooting, it looks like a conflict with the newer Windows Update software, and the basic hardware of this system.

Have you done a *Google* search on this motherboard and issues of locking up when using WinXP...or more specifically Windows Update...especially on or after the release of the new Windows Update software?

Can you manually substitute the newer version *wups.dll* file from your system to the problem system--does that solve the problem?

Can you rename all the Windows update files to *old*, and let Windows re-install those system files with the real original *old* files for Windows Update--I forget...does Windows automatically scan system files and alert you if it finds missing files...or is there a system command you have to run to validate that the system files are all there...and if not, they will be reinstalled.  I think there is a *system backup folder* that holds those original files.  I can't remember if this is available--or just wishful thinking  ;) !

Or, alternatively, find those original files on the installation CD and copy them over to the problem system after the renaming of the newer files.

If the old original files for Windows Update do not cause the lockup, then you would want to configure Update not to allow those newer Update files to downloaded and be installed--I think you do that by removing the check marks from the boxes from the specific updates when you use Update manually--Update then asks if you want to *permanently* disallow those updates you have unchecked--and you can indicate *Yes* at that point.

Ghost4me,


Quote:

I agree it's good to know.  Else, the same problem could resurface again.

The thing is that I don't remember if or which hardware drivers I installed. There is an icon in the Notification Area for the motherboard which indicates that chipset drivers have been installed. When I reformat/reinstall from square one, I will install nothing at all except XP SP2 (slipstreamed). If WU works, I will blame the Gigabyte drivers.

NightOwl,


Quote:

Based on your troubleshooting, it looks like a conflict with the newer Windows Update software, and the basic hardware of this system.

Yes, either the hardware itself or any hardware drivers that have been installed (I don't remember if or which were installed).


Quote:

Have you done a *Google* search on this motherboard and issues of locking up when using WinXP...or more specifically Windows Update...especially on or after the release of the new Windows Update software?

That's next on my "to do list".


Quote:

Can you manually substitute the newer version *wups.dll* file from your system to the problem system--does that solve the problem?

I didn't think that "Windows File Protection" (or whatever it is called) would let me do that but I tried. I had to stop the Automatic Update Service to do it and everything installed with the exception of wups.dll (it was in use). The computer locked up immediately.

I restored the Ghost Image and rebooted into Safe Mode. All files were succesfully installed. When rebooting into Normal Mode ... ;) ... it locked up.

Maybe wups.dll is not the offending file but another one that gets installed before wups.dll. When these files get installed automatically, the installer probably has to shut down the service and restart it. I can't figure it out and am lost.


Quote:

Can you rename all the Windows update files to *old*, and let Windows re-install those system files with the real original *old* files for Windows Update--I forget...does Windows automatically scan system files and alert you if it finds missing files...or is there a system command you have to run to validate that the system files are all there...and if not, they will be reinstalled.  I think there is a *system backup folder* that holds those original files.  I can't remember if this is available--or just wishful thinking   !

I might try that too ... :-X ... one restored Ghost Image more or less makes no difference.


Quote:

If the old original files for Windows Update do not cause the lockup, then you would want to configure Update not to allow those newer Update files to downloaded and be installed--I think you do that by removing the check marks from the boxes from the specific updates when you use Update manually--Update then asks if you want to *permanently* disallow those updates you have unchecked--and you can indicate *Yes* at that point.

It is not at that stage the new Windows Update Client gets installed. When going to Windows Update for a manual session, I always choose "custom" (or whatever it is called in englsih). There is a prompt to install an ActiveX control (the yellow bar at the top) and when that one has been accepted, a new popup prompting for the installation of new update software. When accepted, it counts percent of the download and/or percent of the installation. When that is done, I am back at the choice of "express" or "custom". It is now that it usually locks up but I have on a few occasions managed to get the WGA thingy as well.

All users have the update, there is no possibility to refuse it. It gets installed silently without any notification, either when doing a manual update at Windows Update or an automatic update. Check your system, my bet is that you have it!

Christer

Christer

Okay...I thought about it and finally understand what you have been saying--you are restoring an image of about two years ago, and that image has the old original Windows Update software in it...so the restore takes Windows Update back to that original software...have I now got that right?!

So, the hardware and the software is back to that two year ago status--but running Windows Update locks it up.

The only two things that could be different...that I can think of for the moment...is some setting in the BIOS has been changed--something enabled or disabled that was not the case two years ago--talk with the owner!!!!

Or...could this be a Master Boot Record (MBR) virus?????   The normal restore of a Ghost image restores the data on the partitions, updates the Master Partition Table in the Master Boot Record (only data in absolute sector 0--sectors 1 thru 62 are left untouched!!!)--but the rest of the MBR is left untouched!!!

You could try to restore the Ghost image after starting Ghost with the switch *-ib* to see if that will cause the MBR to be overwritten by the MBR recorded by Ghost in the image--but that switch may only work if you used it in the first place to make a copy of the entire boot region when you originally created the image!

Alternatively, use Gdisk or MBRWizard to zero the MBR before you restore the image--then Ghost by default will write a necessary MBR to the HDD because it doesn't have one when you restore the image--must use *Image > to Disk* and not *Image > to Partition*.

Basically, you need to use some utility that will destroy the whole boot region--sectors 0 thru 62--and then restore the image and recreate the MBR!

Worth a try???

NightOwl,


Quote:

--you are restoring an image of about two years ago, and that image has the old original Windows Update software in it...so the restore takes Windows Update back to that original software...have I now got that right?!

Yes, that's correct! I create several Ghost Images during the installation. The first one is XP SP2 only, updated to current. (I install the updates from CD to avoid connecting to the internet without FW and AV.) I have restored that Image but it too locks up.


Quote:

So, the hardware and the software is back to that two year ago status--but running Windows Update locks it up.

Correct!


Quote:

The only two things that could be different...that I can think of for the moment...is some setting in the BIOS has been changed--something enabled or disabled that was not the case two years ago--talk with the owner!!!!

The owner is not computer savvy. He doesn't even know how to get into BIOS and mess things up. When this situation arose, I had to talk him through restoring the Ghost Image on the phone. To be sure, I'll ask him anyway!


Quote:

You could try to restore the Ghost image after starting Ghost with the switch *-ib* to see if that will cause the MBR to be overwritten by the MBR recorded by Ghost in the image--but that switch may only work if you used it in the first place to make a copy of the entire boot region when you originally created the image!

I didn't use the -ib switch. The only switches I use are -split=650 and -auto (to be able to burn to CD's if necessary and to autoname the spans).


Quote:

Basically, you need to use some utility that will destroy the whole boot region--sectors 0 thru 62--and then restore the image and recreate the MBR!

I assume that reformatting/reinstalling will rebuild the MBR, right? If so, I will fix the MBR that way. If WU works with the clean installation, we have made some progress. I will then restore an Image of the system and see what happens.

Christer

Situation report:

I think that I mentioned an icon in the Notification Area for the Motherboard. Well, there is an icon but it is for the Video Card which I think indicates that video drivers have been installed. I was not able to roll back in Device Manager so, I'm not sure.

I went into BIOS and everything seems to be normal.

I have not yet tried all suggestions but if any of them makes a difference, I'll let you know!

Christer

I found an old PCI-NIC in my closet. I wasted some more time in BIOS, disabling the integrated NICs, installed the PCI-NIC and crossed my fingers. Same results ... >:( ... !

Christer

Christer


Quote:

I assume that reformatting/reinstalling will rebuild the MBR, right? If so, I will fix the MBR that way.

Unfortunately--what we think makes sense and will happen--doesn't.  Once you create the MBR--most programs will no longer touch it.

Even clearing all the existing partitions on a HDD and creating all new ones and formatting the partitions will only effect the Master Partition Table which is in the absolute 0 first sector of the HDD--the rest of the boot region, which is sectors 0 thru 62 will be unaffected--unless you use a utility that has the ability to edit, wipe or restore a backup of that part of the HDD.

Actually, Ghost only makes a copy of and restores the absolute 0 first sector, modifying the Master Partition Table as needed--unless you have used the *-ib* (image boot) switch--Ghost will then make a backup of all sectors 0 thru 62!

GDisk--Ghost's partitioning and formatting tool can be used to wipe the MBR.  You can read about it in the User Guide:  Ghost 2003 User Guide

MBRWizard can also be used to wipe sectors 0-62--MBRWizard - The MBR utility you've been looking for!

You do not have a HDD back to its *fresh from the factory* state until the MBR is all *zeros*!

Christer wrote on Sep 22^nd, 2007 at 4:07pm:

I found an old PCI-NIC in my closet. I wasted some more time in BIOS, disabling the integrated NICs, installed the PCI-NIC and crossed my fingers. Same results

At this point you've eliminated the onboard nics.  Other suspects for complete lockups are usually video drivers, because they interact with the video card itself, the video card itself, or possibly bios firmware bugs.  Sometimes other software drivers cause complete lockups, but not normally.

I had one case where the video card fan quit working and after running for awhile the pc would lockup.  Cause was video card overheating and then locking the entire pc.

You've also determined that it is not just Windows update using 100% cpu, but a true hardware lockup.

NightOwl,

In the old Win98 days, you could run a command from the Start Disk, FDISK /MBR. I guess that GDISK has a similar command. I will look into that.

Ghost4me,

It seems to me that I have eliminated everything ... :-X ... more or less. Since I usually restore a Ghost Image, prior to installing the monthly batch of updates, this update of the Windows Update Client happens regularly on my system. I took a look into C:\WINDOWS\WindowsUpdate.log and found "Setup: Checking whether self-update is required" which seems to be performed on each run of Windows Update. On the other computer, I will let it lock up and next, reboot into Safe Mode to copy the file. The comparison will be interesting.

Christer

Christer

FDISK /MBR rewrites the Master Boot Record

I wish Microsoft would be more informative--it would be nice if they simply said *fdisk /mbr* will over-write absolute sectors 0 through 62 and create a new MBR without effecting the partition(s) or data contained therein.  

From reading the description--it sounds like that is what will happen--but, it is never said explicitly!

Christer

Switches: GDisk

Switches: GDisk and GDisk32 for Norton Ghost 2003

Put Gdisk on a floppy.  Boot to DOS prompt.  Place floppy with Gdisk in drive. Change to A:\ DOS prompt and run Gdisk.

It's not clear if the */wipe* command just wipes absolute sector 0, or if it's the whole boot region of 0 thru 62--but the description implies that the whole region is wiped when you use the *gdisk /mbr* command--but the Master Partition Table is preserved in sector 0, unless you also use */wipe* switch.  Being as you are planning on restoring an image of the HDD, I'd use this command:

gdisk /mbr /wipe

If you want to look at the data in sectors 0 thru 62, you can use a disk editor to open and view each sector:  Download PTS Disk Editor here:

Sector 0 should have the boot data and Master Partition Table.  Unless a virus or special program that uses the boot region for its code, then sectors 1-61 should be zeroes.  And sector 62 should have Ghost's *fingerprint* and disk ID code listed there.

I have prompted the user to buy a BackUp HDD that I can install (and use) as a precaution. Until that happens, nothing much to do but analyzing the WindowsUpdate.log files.

Christer

I compared the WindowsUpdate.log files. I have cut out the "not interesting" parts and the additional word in the respective file name, LockUp and NoLock, indicates which file is which. Both state "Success - Content Install - Installation Successful: Windows successfully installed the following update: Automatiska uppdateringar" but in the computer that locks up, either wups.dll or wups2.dll or both do not get updated (I did several tests with differing results).

The computer locks up after "AU finished delayed initialization" but I don't know why. The next entry in the computer that does not lock up is "Created new random SusClientId". Could it be a registry problem?

(I found no way to attach files to this post but you can get them at http://www.windowsbbs.com/attachment.php?attachmentid=2131&d=1190580079 and http://www.windowsbbs.com/attachment.php?attachmentid=2132&d=1190580086 respectively.)

Christer

I updated BIOS to the most recent revision. I had set all RAID-functions to "disabled" (boots quicker) but some RAID functions were set back to "enabled" with the BIOS update. I also noticed that the previously missing information on memory mode (dual or single channel) appeared. I let the BIOS settings be as default and connected to the web.

Windows Automatic Update does not seem to install the new Client. I waited for fifteen minutes, until well after wuauclt.exe went away from TaskManager.

When I did a manual update session at Windows Update, the new Client was installed but like previously, it locked up the computer and the file wups.dll was not copied to C:\Windows\System32.

Things left to try are the MBR fix and a reinstallation. For some reason, I doubt that it will be successful... :-/ ... !

(All RAID-functions have been set back to "disabled".)

Christer

Christer


Quote:

Things left to try are the MBR fix and a reinstallation.

Short of that--have you tried any *anti-virus* scans to see if any MBR virus is detected?

Right now, there is no FW or AV installed. I can slap on some flavour of Norton, get it updated and let it do a full system scan. I have to work for a few hours and won't get around to it until later tonight or tomorrow.

Christer

NIS 2005 installed and updated. Found nothing what-so-ever.

Christer

I don't recall if I mentioned ... :-/ ... the below so here it comes:

When the computer is rolled back to 2005-03, the file version of the Windows Update Agent files is 5.4.3790.2182 (most of them).

Installing windowsupdateagent20-x86.exe off-line updates the files to version 5.8.0.2694. The computer works well afterwards (still off-line).

Installing WindowsUpdateAgent30-x86.exe off-line updates all the files to version 7.0.6000.374 but the computer locks up (still off-line).

If I do not install WindowsUpdateAgent30-x86.exe but go on-line with Windows Automatic Update enabled, it attempts to install version 7.0.6000.381 but not all files get updated and the computer locks up.

I will compare my own computer with the one that gets messed up and try to find out what goes wrong.

Yes ... ::) ... I'm sick but I want to know. For some reason, I don't think a reinstallation is the fix!

Christer

Christer


Quote:

I don't think a reinstallation is the fix!

I would tend to agree--may have to see if there's a Microsoft fix out there for what appears to be a hardware/software incompatibility for that newest version of Windows Update and the system you are working with!

It could be an issue of resource allocation causing the incompatibility--I have run into that with other software/hardware issues.  

I had to remove all add-on cards except the video card, disable all extras that the BIOS loads (such as parallel port, built-in NIC functions, serial ports, built-in sound support, etc.), and then forced the BIOS to update its allocation table for Plug-n-Play resource allocation--and then install Windows.  

Do the Windows Updates.  

Once everything was working okay, then started adding back the various add-on cards and functions one at a time making sure everything worked okay before moving to the next item (I was also making Ghost images so I could go back and do troubleshooting testing if something went wrong with a given addition of a card or function that also required software installation--including *drivers*!

On my system, it turned out to be a conflict between the NIC and sound card--not a conflict with a Windows software component--everything has worked fine after the re-allocation of resources!

I removed the original hard disk and installed the new hard disk. Booted from the XP-SP2 CD. Created a 40 GB primary partition for the system, formated NTFS and installed XP-SP2 (slipstreamed). When done, I changed the drive letters for the opticals from D: and E: to X: and Y: respectively. I created an extended partition with a single logical of the rest (120GB) and formated NTFS.

Now, I had to install drivers for one of the NICs and I choose Marvell since it was a stand alone driver.

I disabled Windows Automatic Update and went on-line to Windows Update. The ActiveX control installed and the new software too. A reboot and back to Windows Update. Now, three updates were downloaded and installed: WGA, MSI and Package Installer.

A reboot and back to WU, eightytwo (yes, 82!) updates were offered but I didn't install any of them.

It worked okey and now, I started installing the rest of the needed drivers. I installed them one by one and went back to WU to confirm that it still worked after each one:

1) Marvell NIC drivers > installed OK > reboot > WU OK
2) nVidia Chipset drivers (including the second NIC) > installed OK > reboot > WU OK
3) RealTek sound drivers > installed OK > reboot > WU OK
4) GeForce 6200 video drivers > installed OK > reboot > WU OK

Now, the Device Manager had no more "yellow entries" but I continued to install:

5) nVidia USB drivers > installed OK > reboot > WU OK
6) nVidia IDE drivers > installed OK (optical devices and hard disk redetected) > reboot > the computer locked up!

I have yet to do the complete reinstallation but it seems like the new Windows Update Client is conflicting with the nVidia IDE drivers. All drivers listed above (except the GeForce 6200 drivers which are on a separate CD) are pre-checked for installation when the Motherboard CD is autorun. I downloaded the latest motherboard drivers and they are prechecked there too BUT when clicking to install, there is a warning that the system probably works fine without the nVidia IDE drivers and it is recommended to NOT install them.

Christer

Christer

Excellent troubleshooting/detective work--and reporting of your results!


Quote:

I have yet to do the complete reinstallation

Might be able to use your original Ghost image, disconnected from Internet access--once restored--go to Device Manager and remove the nVidia IDE drivers and let WinXP install its own drivers.

Now, re-image for your future *base-line* system image, and continue from there!

NightOwl,
thanks for your kind words!

I have started the reinstallation from square one. The old HDD will be used for backups and the new HDD will be used for the system and data.

I didn't find a way to uninstall the nVidia IDE drivers. I probably didn't look in the right place ... :-/ ... my brain was spinning in its little bowl.

Christer

Christer wrote on Sep 30^th, 2007 at 7:37am:

I downloaded the latest motherboard drivers and they are prechecked there too BUT when clicking to install, there is a warning that the system probably works fine without the nVidia IDE drivers and it is recommended to NOT install them.

That's an interesting non-recommendation warning.  >:(
I didn't realize that nVidia made motherboards.  I thought they were exclusively Video cards.

Anyway, great detective work Christer.

Ghost4me,


Quote:

I didn't realize that nVidia made motherboards.  I thought they were exclusively Video cards.

nVidia make the chipsets but others manufacture the boards, in this case - Gigabyte. They work well, in general terms. No need to do the F6 thing to install SATA-drivers when installing. Just slap XP on it right out of the box.

I don't know if nVidia or Microsoft are to blame for this situation but it's the first problem I have had with a computer based on a Gigabyte board.

Previously, there was an icon for a removable device in the Notification Area. I found it suspicious since it listed the SATA HDD which I didn't consider being removable. It's no longer there ... :o ... !


Quote:

Anyway, great detective work Christer.

Thanks! I spent a few hours trying to figure out the reason and my persistence payed off.

Christer

Christer

You might find this thread of interest in regards to Windows Update--and some problems that are occurring!

Windows Genuine Advantage and Windows Update

See this:

Stealth Windows update prevents XP repair

NightOwl,

I have seen the other thread and also the "secret". It seems like the Windows Update Agent and/or its installation is buggy. More than one problem is discussed in that context.

It also seems like the new WUA is worked on. It gets installed differently now compared to a few days ago. Trust me ... ::) ... I have checked!

Christer

I did some further tests to find out what "good" the nVidia IDE driver possibly would do. Without it, the SATA in the mobile rack must be powered on at bootup. If not, it will not get detected if powered on when the system is up and running. With the nVidia IDE driver installed, the SATA in the mobile rack gets hot swapable. It can be powered on and off at will.

By chance, I installed the nVidia IDE driver from the most recent setup file, downloaded from the Gigabyte site. When I went to Windows Update, to my surprise, it worked well.

I restored the Ghost Image and installed the nVidia IDE driver from the CD that shipped with the motherboard. When connecting to Windows Update, the computer locked up.

I think that I will play it safe and leave it out. The small benefit from a hot swapable SATA in the mobile rack is something that the owner can live without ... ;) ... especially if I don't tell him about it!

Christer

Christer


Quote:

... especially if I don't tell him about it!

Made me smile!

Yes, sometimes that's the *key*--ignorance can be bliss!