WinXP Freezing at Start-Up!

Discussion in 'Prevx Releases' started by Cruise, Nov 6, 2013.

Thread Status:
Not open for further replies.
  1. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    I'm running WSA on both my Win7 and WinXP machines. It's running without incident on my Win7 laptop but it seems to be causing a lockup of my WinXP (SP3) PC as soon as it gets to the Windows splash-screen! Although this doesn't occur every time I start/restart my XP machine, it does happen at least 50% of the time. There's no other security app running on my XP PC.

    Just wondering if there are any other WinXP-WSA users here who have experienced this? :doubt:

    Cruise
     
    Last edited: Nov 6, 2013
  2. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    Could you save a scan log and send it to my username @ gmail.com so that I can take a look?

    Thanks!
     
  3. Techfox1976

    Techfox1976 Registered Member

    Joined:
    Jul 22, 2010
    Posts:
    749
    What I'd personally do to try to figure it out is what is called the Switch Effect. Computer freezes on XP Splash 50% of the time. When WSA is uninstalled, it should be freezing 0% of the time. Then WSA back on, back to 50% of the time. It would be sad to end up waiting for WSA tech support to say they can't help you if it's not WSA causing the issue.
     
  4. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Will do - thanks.
     
  5. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Hi Techfox,

    I did that and after uninstalling WSA I attempted 5 cold boots and 5 restarts with no lockup issues. I realize that doesn't mean it won't occur on the next start, but so far so good. :doubt:
     
  6. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    Thanks! Unfortunately the logs weren't particularly helpful. Could you try logging off and logging back on to see if that slows it down still, or if it is only on reboots?
     
  7. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    First of all (as I indicated in my reply to Techfox) uninstalling WSA seemed to remedy the problem. Then upon reinstalling WSA I again experienced the problem on the very next restart!

    To answer your question, logging off and back on does not seem to bring about the issue.

    Cruise
     
  8. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    Thanks - I'm going to do some testing here and will try to narrow down potential causes and will let you know as soon as I have a plan.
     
  9. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    The 50% got me thinking !

    I've noticed for a LONG time that @ each alternative cold boot = everyday or more, WSA either asks for outbound before i'm connected & FF is launched, or it waits until vice versa.

    It's not a problem, but is curious ! I'm guessing it's linked to your issue ?

    XP/SP2
     
  10. Techfox1976

    Techfox1976 Registered Member

    Joined:
    Jul 22, 2010
    Posts:
    749
    If it is indeed freezing on the splash screen (Or Boot screen), it means it is potentially related to a (kernel) driver load. I suspect there is a contention occurring between the WSA driver and something else that has set itself to load around the same time. Ensuring that boot logging is enabled and then gathering a set of support logs to nab that boot log would be a good bet. Support logs after a Failed boot followed by a successful boot would be the best way, since the boot logs should contain both boots. The boot logs might not reveal direct information, but might.

    Cold also be a kernel level (and likely MBR) infection that WSA can't detect once the infection is present (which is not impossible. Rare, but not impossible). *Shrug*
     
  11. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    CR, I'm running IE8 with XP SP3.
     
  12. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Hmm, I do see Application Event Errors were recorded at the times of those incidents (there are no System Event Errors).

    Source is 'LoadPerf'
    Event is either '3006' or '3011'

    Hope that helps. :doubt:


    If that were the cause wouldn't I also experience the issue when WSA was not installed?
     
    Last edited: Nov 7, 2013
  13. Techfox1976

    Techfox1976 Registered Member

    Joined:
    Jul 22, 2010
    Posts:
    749
    Let's define where it's freezing first, I think...

    Computer starts booting up and shows BIOS, then shows the "Loading Windows XP" type stuff. In some cases, it will then ask the user to log in, but it may not. Then it starts to show the desktop and programs that it runs in user mode. Where in this process is it freezing?

    LoadPerf app errors tend to imply user mode is open, which is why I ask. Those two error codes imply that something is definitely not working right as the performance monitor is trying to perform an action that it can't.


    Not necessarily. Contention is when two things argue with each other over access to a resource, or when something throws a hissy fit when something happens. So, for example, if it were an infection, if it loads first and hides successfully, WSA doesn't see it. If WSA loads first and it tries to load after, it freezes the computer rather than allowing WSA to remove it.

    Or, for example, PFW used to have an issue with load order with WSA. Think of the loads like a pipe. Windows parts on either side of it. Windows stuff loads first and can handle functions A, B, and C. MOST stuff that ever loads uses functions A and B. If WSA loads first, it uses A, B, -and- C and provides them to the other end. The PFW loaded and used A and B, and since WSA allowed both through, it worked.

    If PFW loads first, it uses A and B, and only provides A and B to the other end. WSA tries to use C, PFW can't handle it, so everything breaks because PFW sucked and didn't properly handle C. PFW fixed it and all was well, but people tried to blame WSA because "It happens with WSA installed and doesn't happen with it not-installed". :)
     
  14. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    It occurs as soon as the WinXP splash-screen appears. When XP is loading normally, there is a moving 'loading bar' near the bottom of the splash-screen that makes several passes before the logon screen appears. When XP locks-up, it occurs as soon as the WinXP splash-screen appears and nothing is seen inside the 'loading bar' (indicating no loading progress whatsoever)! When this happens the system is non-responsive, so my only recourse is to power-off the PC and power it back on again!

    Cruise
     
    Last edited: Nov 7, 2013
  15. Techfox1976

    Techfox1976 Registered Member

    Joined:
    Jul 22, 2010
    Posts:
    749
    Okay, in that case, definitely boot logs.

    Run msconfig, go to the Boot tab, and check "Boot Log", then save it (OK).

    Reboot at least one happy-normal time and one frozen time.

    The log is stored at %systemroot%\ntbtlog.txt (Usually c:\windows\ntbtlog.txt) and IIRC, is also gathered by the WSALogs.exe utility if it exists. The ntbtlog shows the order of starting various kernel drivers and how far things get before they die to death.
     
  16. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Techfox,

    I have removed WSA from my XP box because I have some work to get done and can't afford the risk of the aforementioned problem. I'll reinstall WSA in a day or two but in the meantime it will be interesting to see if I experience the problem without WSA (so far, so good).

    I'm also anxiously awaiting further updates on this issue from PrevxHelp.

    Thanks for your interest and help.

    Cruise
     
  17. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    As I had some rather important work to get done on my XPpro (SP3) PC I removed WSA 2-days ago because of the lockup (at Windows startup) I had been experiencing. During that time I must have started/restarted the PC at least 6 times without incurring any lockup problem.

    Well, I reinstalled WSA today and the system again locked-up on the very next restart. I powered-down the PC and again booted it only to have it lockup again at the splash-screen. I am now convinced more than ever that there is a conflict between WSA an WinXP, so I'm removing WSA until I learn that this has been resolved.

    Cruise
     
  18. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    Thanks! I'm glad to hear that this is rather reproducible (even though it is still an issue, this will help narrow it down).

    We're in the middle of a handful of potentially relevant changes which I can get over to you via a test build once we complete them. If those don't fix it, a remote support session would probably be the best way to diagnose it closer.

    I'll let you know as soon as we finish the changes on our side.

    Thanks!
     
  19. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Okay.
     
  20. Techfox1976

    Techfox1976 Registered Member

    Joined:
    Jul 22, 2010
    Posts:
    749
    WSA works fine with Windows XP. It just doesn't work with YOUR Windows XP, and we do not know what you have in yours that makes it object to WSA.

    Good luck.
     
  21. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    Actually, it's pretty much a 'plain vanilla' Dell XP-Pro PC! The only 'special item' in my startup is Sandboxie (SbieCtrl.exe) and the only software I run on it are IE8 and MS Office 2007 apps. :doubt:

    I might also add that scans by Hitman Pro and MBAM pronounce this system to be clean!

    Cruise
     
    Last edited: Nov 10, 2013
  22. De Hollander

    De Hollander Registered Member

    Joined:
    Sep 10, 2005
    Posts:
    718
    Location:
    Windmills and cows

    Ok, what came out of the remote support session
     
  23. Cruise

    Cruise Registered Member

    Joined:
    Jun 10, 2010
    Posts:
    1,024
    Location:
    USA
    So far there hasn't been a remote support session. Furthermore I don't see how a remote session can even be conducted because (as I've described) Windows will not load with WSA installed, the system locks-up and is non-responsive!
     
  24. PrevxHelp

    PrevxHelp Former Prevx Moderator

    Joined:
    Sep 14, 2008
    Posts:
    8,242
    Location:
    USA/UK
    A remote session may still be possible by disabling specific components of WSA. We're still working through other changes but I can look into timing over the next time if you have some availability - if you could send me a PM with when you think you'd be free, that would be great.

    Thanks!
     
  25. micafighter

    micafighter Registered Member

    Joined:
    Sep 30, 2013
    Posts:
    59
    Location:
    Hungary
    Just for your info, WSA working fine here on a Dell mini, XP Sp3 x86.
     
Thread Status:
Not open for further replies.