Solved

2000 & XP PC's lock up, force restart, and fail due to missing files on restart.

Posted on 2004-10-13
6
307 Views
Last Modified: 2008-02-01
Over the last two days we have seen the following issue repeat itself on 6 workstations (either 2000 or XP). The machine suddenly locks up, forcing the user to reboot. Upon restarting the machine the user recieves either on of these error message:

cannot find \windows\system32\hal.dll
Please reinstall

cannot find \windows\system32\ntoskrnl.exe
please reinstall

It's hard to reload, as most of these machines are not equiped with a floppy drive. We've tried windows repair option, but a windows repair disc is required. We created a windows repair disc off of a similar machine. The machine gets further along in the boot process (to the windows display), and then the infamous blue screen of death appears. I'm assuming since we don't have a repair disk made from these specific machines...with reg files, etc not matching up?

As it stands it appears that our only option is to complete a full reinstall of the OS, but there HAS to be an easier way. More importantly, we need to identify what is causing the issue?

Instantly, most people look at the possibility of a Virus. We have not been able to find any reason to believe this is the case. We run a symantec managed enterprise, with updates automatically recieved via ftp from symantec. these updates come out once a day, as opposed to the "basic" every thursday "automatic" release from symantec. We check for the update evevy two hours. We have not had a virus oubreak since implementing this technology. Our exchange server is protected in the same way.

Where we are more focused on in regards to the issue is a recent change to our network. We are preparing for the migration from 2000 to 2003, and had to add a new DNS, DHCP, & Terminal Services Licensing server, while taking the other one/s offline. This was done at night, and the next day is when the problems began. There are no errors in the event logs indicating a problem with DNS, DHCP, and AD seems to be replicating just fine.

Our goal is to find a solution to the problem once it has occured, and prevent the solution from occuring again. Thanks for your help everyone!
0
Comment
Question by:mray77
6 Comments
 
LVL 3

Expert Comment

by:happythedog
Comment Utility
those are the basic windows 2k files , thats the kern type sfc /enable /scanboot on the runline , are you sure domain permissions and profiles were propigated correctly could try a commandline copy of the files off of the cd but i dont think it will work
make sure all clients are configured correctly, whats the last thing that happens before this problem occurs also look for a memory.dmp file and use drwatson to make a snapshot off of the command line , make another one off of a good box and compare whats different. once you hav these snapshots format the hdd and redo it from their
0
 

Expert Comment

by:TechWar
Comment Utility
Something is corrupting the files and if you have a logon script that runs upon boot, I would check that area as well.  The blue screen is probably happening because the HAL does not match between the Repair Disks and problem pc's. You can replace those files from any bootable CD in its respective OS.

TechWar
0
 
LVL 7

Expert Comment

by:crazijoe
Comment Utility
You could do a repair installation.
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/doug92.mspx
http://www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/WINDOWSXP/home/using/productdoc/en/options_to_use_when_a_system_will_not_start.asp

I am not one to hack on AV programs but we use F-Secure at our shop. We found that F-Secure has found viruses that Norton didn't pickup.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 4

Expert Comment

by:tmireles
Comment Utility
More information would be useful on this.  Like someone else said what was the last thing that was being done when the computer froze.  Since it doesn't seem to be OS specific, you mentioned that it does this in Win 2k and XP then you could have gotten some bad spyware/malware that is freezing your computer.  Is there a common person using these machines.  Could be that he is going to a website that has some of this stuff or something was installed by this person that caused the problem.

The repair option when doing it with XP or WIN 2k can be done without a repair disk.  You just have to read the menu correctly.  One option is to do a repair with a disk and another option is to go to the recovery console.  In there you should be able to run "sfc /scannow" and have a disk handy as it will replace any files that were corrupted/destroyed or replaced by another program.

I am pretty sure you can run this from command line but not real sure.

You could also try and do a "chkdsk /R" which recovers bad sectors and recovers them.

Good Luck.

0
 
LVL 3

Accepted Solution

by:
happythedog earned 500 total points
Comment Utility
sfc cant be used from a command line looked it up in win2k pro resource kit ,
We really need to know what was done , a script is a good start if one exists look it over very carefully for any extra spaces typos invalid paths etc.
if you can get a recovery console type drwatson inthe winnt directory and use that to tell whats not right. I dont know if this utilility comes in xp
0
 

Author Comment

by:mray77
Comment Utility
It turned out to be an issue with a recent change to the login script. It didn't dawn on me that this change was made until it was mentioned to start by examining the scripts. Thank you to everyone for your input, and knowledge!
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
I don't know if many of you have made the great mistake of using the Cisco Thin Client model with the management software VXC. If you have then you are probably more then familiar with the incredibly clunky interface, the numerous work arounds, and …
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now