Solved

2000 & XP PC's lock up, force restart, and fail due to missing files on restart.

Posted on 2004-10-13
6
313 Views
Last Modified: 2008-02-01
Over the last two days we have seen the following issue repeat itself on 6 workstations (either 2000 or XP). The machine suddenly locks up, forcing the user to reboot. Upon restarting the machine the user recieves either on of these error message:

cannot find \windows\system32\hal.dll
Please reinstall

cannot find \windows\system32\ntoskrnl.exe
please reinstall

It's hard to reload, as most of these machines are not equiped with a floppy drive. We've tried windows repair option, but a windows repair disc is required. We created a windows repair disc off of a similar machine. The machine gets further along in the boot process (to the windows display), and then the infamous blue screen of death appears. I'm assuming since we don't have a repair disk made from these specific machines...with reg files, etc not matching up?

As it stands it appears that our only option is to complete a full reinstall of the OS, but there HAS to be an easier way. More importantly, we need to identify what is causing the issue?

Instantly, most people look at the possibility of a Virus. We have not been able to find any reason to believe this is the case. We run a symantec managed enterprise, with updates automatically recieved via ftp from symantec. these updates come out once a day, as opposed to the "basic" every thursday "automatic" release from symantec. We check for the update evevy two hours. We have not had a virus oubreak since implementing this technology. Our exchange server is protected in the same way.

Where we are more focused on in regards to the issue is a recent change to our network. We are preparing for the migration from 2000 to 2003, and had to add a new DNS, DHCP, & Terminal Services Licensing server, while taking the other one/s offline. This was done at night, and the next day is when the problems began. There are no errors in the event logs indicating a problem with DNS, DHCP, and AD seems to be replicating just fine.

Our goal is to find a solution to the problem once it has occured, and prevent the solution from occuring again. Thanks for your help everyone!
0
Comment
Question by:mray77
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 3

Expert Comment

by:happythedog
ID: 12301299
those are the basic windows 2k files , thats the kern type sfc /enable /scanboot on the runline , are you sure domain permissions and profiles were propigated correctly could try a commandline copy of the files off of the cd but i dont think it will work
make sure all clients are configured correctly, whats the last thing that happens before this problem occurs also look for a memory.dmp file and use drwatson to make a snapshot off of the command line , make another one off of a good box and compare whats different. once you hav these snapshots format the hdd and redo it from their
0
 

Expert Comment

by:TechWar
ID: 12301432
Something is corrupting the files and if you have a logon script that runs upon boot, I would check that area as well.  The blue screen is probably happening because the HAL does not match between the Repair Disks and problem pc's. You can replace those files from any bootable CD in its respective OS.

TechWar
0
 
LVL 7

Expert Comment

by:crazijoe
ID: 12301464
You could do a repair installation.
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/doug92.mspx
http://www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/WINDOWSXP/home/using/productdoc/en/options_to_use_when_a_system_will_not_start.asp

I am not one to hack on AV programs but we use F-Secure at our shop. We found that F-Secure has found viruses that Norton didn't pickup.
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 4

Expert Comment

by:tmireles
ID: 12302338
More information would be useful on this.  Like someone else said what was the last thing that was being done when the computer froze.  Since it doesn't seem to be OS specific, you mentioned that it does this in Win 2k and XP then you could have gotten some bad spyware/malware that is freezing your computer.  Is there a common person using these machines.  Could be that he is going to a website that has some of this stuff or something was installed by this person that caused the problem.

The repair option when doing it with XP or WIN 2k can be done without a repair disk.  You just have to read the menu correctly.  One option is to do a repair with a disk and another option is to go to the recovery console.  In there you should be able to run "sfc /scannow" and have a disk handy as it will replace any files that were corrupted/destroyed or replaced by another program.

I am pretty sure you can run this from command line but not real sure.

You could also try and do a "chkdsk /R" which recovers bad sectors and recovers them.

Good Luck.

0
 
LVL 3

Accepted Solution

by:
happythedog earned 500 total points
ID: 12306454
sfc cant be used from a command line looked it up in win2k pro resource kit ,
We really need to know what was done , a script is a good start if one exists look it over very carefully for any extra spaces typos invalid paths etc.
if you can get a recovery console type drwatson inthe winnt directory and use that to tell whats not right. I dont know if this utilility comes in xp
0
 

Author Comment

by:mray77
ID: 12322969
It turned out to be an issue with a recent change to the login script. It didn't dawn on me that this change was made until it was mentioned to start by examining the scripts. Thank you to everyone for your input, and knowledge!
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction Often we come across situations wherein our batch files would be needing to reboot Windows for a variety of reasons. A few of them would be like: (1) Setup files have been updated whose changes can take effect only after a reboot …
#Citrix #POC #XenDesktop #vCenter #VMware #ESX
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.
Suggested Courses

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question