Computer Won't Restart

[Ausatco]

My friend had a raft of probs with his computer due mostly to kids doing uncontrolled installs of c r a p downloads containing malware, adware, etc. No virii, to the best of my knowledge, tested with VET (http://www.vet.com.au) from Computer Associates. I will have him try Housecall, but I'm pretty confident the machine's clean. I've managed to fix most probs, but one in particular eludes me.

When you do a restart by clicking on a RESTART button in a dialogue, eg after a program install or uninstall, etc, the machine does the shut-down part, but it doesn't restart. If you then CTRL-ALT-DELETE (just once) while it is stalled it restarts ok.

If you press the Restart button on his keyboard, same thing, the computer does the shut down but won't restart without CTRL-ALT-DELETE.

Normal shutdown works ok. Standby works ok. Just re-start won't work.

It's a clone and he says it's been doing it since new but he never chased it up with the supplier and now it's out of warranty.

P4, XP Home updated. Any clues greatly appreciated.

AA

[PretoriaSillyperson]

If it's a laptop then it could be the settings in the Power Control configuration utility - I had a similar problem with a Sony Vaio.

PSP

[mazzy1026]

I know there was a problem like this with Win98 a few years ago - in which there was a patch to fix it. I'm not sure exactley whats going on but it might be worth browsing the microsoft (http://www.microsoft.com) website and running a few searches. Seeing that you are using XP home though I have probably just wasted 2 mins hehe

Regards

Maz:ok:

[fobotcso]

Ausatco, HERE'S (http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q308029) a good read about XP shutdown problems. I've skip read it and didn't see your problem exactly but there may be a clue for you.

"...If you press the Restart Button on his keyboard..." I don't got one of those! If it's a special keyboard, maybe the configuration needs tweaking.

Also, Roxio is often cited as the culprit for these difficulties.

[Lost_luggage34]

Sounds like you may have a process running which a restart can't handle but a Shutdown kills sucessfully.

Worth taking a peek at the Task Manager before shutdown to see what's going on. Could be a worm or adware stuff running there somewhere. It's amazing how much crap can infilitrate a system if it's been used for downloads.

However, I'm not familiar with XP - Win2000 and Win98SE here.

[Naples Air Center, Inc.]

Ausatco,

Lets see what the Virus Scan has to say. It might be worth trying a Repair with the WinXP CD, or even a Fresh Install if his kids have filled it with all that garbage.

Take Care,

Richard

[Ausatco]

Thanks everyone for your replies to date.

Pretoria - It's a desktop, but I have investigated power settings. They seem in order - I made them the same as mine (same OS and CPU). My machine's ok. His remains problematical.

Mazzy - I've checked the MS knowledgebase and found many references to shutdown problems, but none that deal with what this machine is doing - ie, after selecting RESTART it does the shutdown part of the cycle, but doesn't restart.

fobs - an excellent reference from your good self, as usual. I haven't read and digested all the possible links and off-shoots, but on skimming, it does not seem to address this particular fault. More reading required on my part when time permits.

The Restart Button on the keyboard and a "Restart" or "Restart now" button in any dialogue box, including XP's own Restart button in the shut-down dialogue, exhibit the same fault - the machine does the shut-down part of the cycle, but stops short of re-starting.

The PWR OFF and SLEEP buttons on his keyboard work as they should, so I think his keyboard and KB software is ok.

I'm thinking the problem may lie in a registry setting or BIOS setting (both not yet investigated due to lack of knowledge re the registry and I only just thought of the BIOS!!!)

Also, because he says it has been like this from day one of ownership, it could be a hardware (MB) fault, in which case he needs to sort it out with his supplier.

To give him a fighting chance, I thought I'd try to eliminate as many software and setting possibilities before he has to confront his supplier.

LL34 - It's doing the shutdown part of the cycle, so wouldn't that leave a "clean" machine for the restart pert of the cycle to deal with? ie, "restart" doesn't really have to deal with anything because all progs and processes are already stopped because the machine is already shut-down. CTRL-ALT-DELETE instantly commences a re-boot, whereupon the start-up process is quite normal.

Richard - Housecall reported TROJ_ISTBAR.F at C:\SYSTEM VOLUME INFORMATION\_RESTORE{very long string of hex numbers}\A0076694.EXE

I looked up Trend Micro's encyclopedia and found out what to do. As part of my own cleaning up process before I ran Housecall I had already deleted a few folders and files to do with a couple of porn diallers (teenage boys will be boys!!) from the root directory of the C drive and also from My Programs. (There were no uninstall options for them in Control Panel)

According to Houscall the file A0076694.exe is a randomly-named trojan set by a porn dialler. However, it is NOT a running process or application in Task Manager, so it's not loading, so I don't think it's an immediate threat, but I don't like it there. It seems to have gone into System Restore when XP set a System Check Point, would you agree? It would be better removed, but how do I do that from within the restore files? - those files and folders seem inaccessible. Housecall had a delete option for the file, but I didn't want to mess around with files in the System Restore area without seeking advice.

I tried a Repair, not to try to remove the trojan, but simply to try to fix the restart problem, but none of the administrator passwords my friend could remember worked, so I could not pursue that option.

Would an In-Place Upgrade (Re-installation) help, do you think? I've never done that in XP - would I have the same admin password problem as with Repair?

I've warned him about the possibility of a format and re-install, but I'm trying to avoid it in favour of a more diagnostic approach if possible, as much for my own education as his convenience.

TCS - I thought of that, but no, I don't think it goes to Standby mode because it won't wake up with mouse movement or keystrokes. Only CTRL-ALT-DELETE gets it going again.

Cheers all

AA

[PickyPerkins]

Ausatco
======================================
It seems to have gone into System Restore when XP set a System Check Point, would you agree? It would be better removed, but how do I do that from within the restore files? - those files and folders seem inaccessible.
=======================================
Housecall says viruses can get into the Restore area (a hidden partition on the hard drive) via Restore Points. Housecall also says that once there they are not accessible for deletion unless the Restore system is turned off.. Housecall goes on to give the procedure for turning off the Restore System and thereby (they claim) enabling files in the Restore area to be deleted as follows:
1. Log on as Administrator.
2. Right-click the My Computer icon on the Desktop and click Properties.
3. Click the System Restore tab.
4. Select Turn Off System Restore.
5. Click Apply > Yes > OK.
6. Continue with the scan/clean process. Files under the Restore folder can now be deleted.
7. Re-enable System Restore by clearing Turn Off System Restore.

HOWEVER, when I tried to use the above procedure it didn’t work as advertised.
On completing step 5 above I got the following:

http://pickyperkins.home.infionline.net/SR.gif

So one can delete ALL or NO files in the Restore area. One cannot delete selectively.
------------------------------------------------------

I think Restoring to an earlier Restore Point will remove any files which were installed since that date, and I would try this first. Restore back to a date before the downloads occurred and see what happens. You should not lose any text or data files, only the executables and changes in the registry associated with the offending downloads and installs. The Restore process is claimed to be completely reversible, and it has been for me so far.

I have no idea whether any of this will help with the original problem posed, i.e. the computer not re-starting.

========================================
Your Computer Enters Standby Mode When You Try to Restart
This article was previously published under Q312921
SYMPTOMS
When you try to restart your computer, your computer may not restart, and it may enter Standby mode. Note that this problem only occurs when use the arrow keys on your keyboard to set the focus on the Restart button in the Turn off computer dialog box, and then press ENTER.
WORKAROUND
To work around this problem, use your mouse to click Restart.
========================================

QUESTION: In connection with the above Microsoft Note Q312921 posted by TCS, is there a difference on the problem computer between approaching the Restart button on the screen with the arrow keys compared with using the mouse? http://pickyperkins.home.infionline.net/pi.gif

[Naples Air Center, Inc.]

Ausatco,

TROJ_ISTBAR.F is not a destructive Virus so that is not the problem.

Since you mentioned that it had this problem since day one, it could have been a bad install of WinXP to begin with or a hardware issue with the mobo.

If you do a fresh install of WinXP over itself, you will entering a new Administrator Password during the install.

Take Care,

Richard

[E-Liam]

Hi Ausatco,

You're welcome to PM me the logfile from the following program.. (It's my cut and paste, as I usually put this out on forums several times a day..) :D

Please download 'Hijack This!' from here (http://www.thespykiller.co.uk/), unzip, and place it in it’s own folder, (not in the temp folder) doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, click "Save Log", and copy and paste it in a reply.

This will give me a rundown of what’s going on in your PC. I'll be glad to analyse it for you. Don’t fix anything yourself yet, as a lot of the stuff on that list will be harmless or required.

This will show up spy/ad and malware along with most trojans and virii. When sending me it, please switch off smilies though.. strange thing to have a computer forum that turns C: \Windows.. etc. into C:\Windows... :D

Cheers

Liam

[Ausatco]

Picky, Richard, E-Liam,

Thank-you all.

My friend is going away for a week or so, so I won't be able to do much until he returns.

I think first of all I'll try a re-install of XP over the top of the current installation. If that doesn't fix the problem then I'll take up E-Liam's invitation with HijackThis. Much appreciated, E-L.

Happy Easter (or whatever, according to your creed) to all,

AA

[Naples Air Center, Inc.]

Ausatco,

The fresh install should solve the problems. One thing that would help you out before you do the install, download all the Drivers for the Hardware and either burn them to a CD or have them on the Comp's Hard Drive.

Then the install process will go a lot faster. Do not forget to back up email and documents just in case. ;)

Take Care,

Richard

[fobotcso]

Another idea....:D

Depending on the age of the BIOS, there may be an option in Power Management to alter the PC's behaviour after a Power Loss.

My machines offer to :

1. Power Off
2. Power On
3. Resume Previous State.

I had a power outage in the small hours a few days ago. After it was restored, the machine that should have remained OFF came ON and the machines that should have powered ON under a Scheduler Setting for Back-Up purposes stayed OFF! :{

Now they all Resume Previous State.
Could be something here for this enigmatic case.