How to troubleshoot ThinkPad with Windows XP?

[z/svc]

Hi all,

Recently I am experiencing problems with Windows XP SP2 on my Z61m. The problem is that if the system is up and running for some longer time, it hangs.

I don't know why, I have some ideas, but I need to investigate it anyway. But I don't want to discuss it in this thread.

I would like to ask you if you have any ideas about the ways, techniques of troubleshooting Windows hangs, especially on ThinkPads, as I suspect my problem may be hardware or firmware related.

I need to monitor and log activity of all my hardware components, drivers, processes and running applications. I need to find out which one of them is causing the hang. By the way: this is a completely hard hang, system is not responding at all, it freezes completely, so nothing is even in system logs.

Any ideas on that, please?

Many thanks and regards.

[jdhurst]

A hard hang with nothing in the error logs is often hardware-related in my experience. Of course, any number of things could cause this.

You need to start to be aware of the circumstances when the machine hangs and post back here. There is not enough to go on from your first post.

1. Is it heat related?
2. Are you using the same app each time?
3. Is it time related (after so many hours)?
4. Is it a BSOD (don't think so, based on your post)?
5. Are there any noises when it hangs (disk)?
6. Have you thoroughly scanned for viruses and spyware?

It is NOT an endemic Windows problem. Windows XP Pro can run for years on end 24 hours a day without hanging. ... JDH

[z/svc]

A hard hang with nothing in the error logs is often hardware-related in my experience. Of course, any number of things could cause this.

On my case I suspect a driver issue or an application issue.

You need to start to be aware of the circumstances when the machine hangs and post back here. There is not enough to go on from your first post.

I know. I am fully aware of the methodology of problems troubleshooting, but I don't know any tools for Windows, so this is why I post this query.

Anyway, regarding the problem: it looks for me like the system hangs when it is running for a long time (long means more than 24 hours) with a lot of Internet use.

I am running Windows XP Pro, eMule 0.48a, PeerGuardian2 (with an option to log only blocked traffic), Outpost Firewall 1.0, NOD32 (the latest one). On the last hang I used only WiFi connection, no on-board LAN.

I suspect that either eMule, PeerGuardian, Outpost Firewall or WiFi driver could not handle such amount of tcpip traffic for such a long time.

My problem is: what tools and techniques can I use on Windows to narrow down the problem.

To answer your questions:

1. Is it heat related?
2. Are you using the same app each time?
3. Is it time related (after so many hours)?
4. Is it a BSOD (don't think so, based on your post)?
5. Are there any noises when it hangs (disk)?
6. Have you thoroughly scanned for viruses and spyware?

1. No, for sure. I though so on the beginning but when the system hung last time the fan was under the BIOS control.

2. Yes. As I said before: eMule, Outpost Firewall, Peerguardian, NOD32. See, each of these apps has a lot of internal settings, also tcpip related. I need to narrow down which of these applications is causing hangs, then I will be able to investigate these settings.

3. I cannot say that it is hanging on one specific time. But after long time of use without a reboot. Long = around or more than 24 hours.

4. No, it is not a BSOD. And also: no errors in system logs. In the system logs I can only find the last entry from the OS or apps, but it does not gives me even a time WHEN exactly the system hung. It would be good to know date and time.

By the way: is it possible to buid in into the Windows something like a heartbeat? Then I could check in logs when the OS stopped to respond.

5. No, no noises. Hard disk not working, fan working as normal. If I get the lid up - it does not power on. If I try to switch NumLock - it switches BUT if I try to do the same with CapsLock - it does NOT switch. So I think the the NumLock is controlled by the BIOS (note you need to use Fn key to switch it), but the CapsLock is controlled by OS. If it does not switch - OS is dead. The last thing: WiFi LED is blinking like it would be in use. But the OS does not respond to ping.

6. Well, not for a spyware, but this is quite fresh install. Regarding the viruses: I am constantly using NOD32 working in the background with auto-updates enabled. My antivirus config is not usual, I think (I disabled resident scanner for files, BUT everything else is enabled, so everything what goes into my system or out - is scanned), but I wouldn't say it is relevant.

It is NOT an endemic Windows problem. Windows XP Pro can run for years on end 24 hours a day without hanging. ... JDH

I know. I need to investigate my apps and drivers. The question is: HOW?

Thanks for your post!

[jdhurst]

One thing you could try (I would do so myself in your circumstances) is do a fresh (cold) start, go to Event Viewer and clear all the logs. Then use the machine and see on the next hang just what events are being logged. That may provide a clue.

Also, with the Microsoft System Info, try disabling lesser used processes to see if that brings any help. You might wish to try action plan 2 at a different time that action plan 1 in order to maintain sanity over what is going on.
... JDH

[Puppy]

I'd suspect video driver first. Have you tried to update it ? To my experience Software Installer usually does not offer the most recent version. You have to search it on ibm.com and download. Outpost and other software installing kernel drivers (without WHQL) are also candidates to remove.

[z/svc]

@jd: thanks, I will try it later on.

@Puppy: why video driver? Why video driver should freeze whole system to the death?

Anyway: I need to find out a way to see what is going on with the system JUST before it hangs...

[carbon_unit]

I agree with puppy, A video driver can hang the whole system in XP. It can also create "STOP:" errors and cause system reboots. I have fixed a lot of unbootable XP installs (STOP: errors or constant reboots) by going into safe mode, removing the video driver, rebooting into regular mode and reinstalling the video driver.

[z/svc]

@carbon_unit: OK, I'll check the video driver. However, I still do not understand it. Especially that I leave the laptop with lid closed down, when it is powered off. Anyway - I will check video drivers.

By the way: is here any one who is running his ThinkPad for so long, like 1, 2 or more days within reboot? I'd like to know if others are having similar issues.

[Puppy]

No, I run it up to one month just using hibernation.

[GomJabbar]

One idea - you might take a look for memory leaks. Open Task Manager (CTRL+ALT+DEL), then click on the Processes tab. Look for any processes that keep growing in size.

You can run Check disk on your hard drive and have it run all the tests.

You can run PC Doctor diagnostics, either the Windows version or the CD version. Both are available for download from Lenovo.

Check in Control Panel > Scheduled Tasks for any tasks that might run automatically, causing your problem.

You might have a power management problem. By any chance did your computer go into Standby or Hibernation, or did the Screen Saver kick in?. Try disabling these features for a test. Are you operating on AC all the time when this problem occurs?

You might try turning off your firewall and not using the internet for a day or two and see if the problem still occurs.

I see these tools are available, but I have no experience using them.
How to use ADPlus to troubleshoot "hangs" and "crashes"
The Debug Diagnostic 1.1 tool is now available

[tomh009]

By the way: is here any one who is running his ThinkPad for so long, like 1, 2 or more days within reboot? I'd like to know if others are having similar issues.

I usually reboot my X31 maybe once or twice a week, mostly using standby in between, and the system is powered on typically somewhere between 20 and 23 hours a day. Not seeing any hanging symptoms like yours.

[RealBlackStuff]

You should definitely throw out that Outpost Firewall. It is outdated by a number of years and quite a resource hog.
I've used it, then switched over to Outpost Pro in various versions. But each version was worse, to the point that their latest V4 would not even let me update my anti-virus software any more!

Go to http://www.sunbelt-software.com/Home-Ho ... -Firewall/ and download-install their free Kerio firewall instead (after you UNinstalled Outpost).

Further to the 'hanging', you may have dust-bunnies in your CPU-fan which causes it to overheat after a while.

[z/svc]

Hi all,

First of all, thank you for your all posts, that really helps.

To clarify some details:

1. I checked processes within the Task Manager and I don't see anything suspicious. I also don't see any scheduled tasks which could cause this problem.

2. I've done some search on MS pages for subjects like crash dumps, how to analyse it, how to get it, etc. The whole problem is that first I need to have a crash dump. If system is having BSODs - that is no problem. But if system hangs - then the only way is to access the affected system by the serial port and invoke some special commands. Z61m does NOT have serial port.... Lenovo: WHY?

3. Outpost Firewall.
Well, I know it is old. But till this time I could not find anything better for me. And the only version which works for me is 1.0. If I try to install versions 2.x, 3.x, 4.x I am getting a BSOD just after 1st reboot and I need to uninstall it. I am having this problem with this firewall on different systems.

Kerio 2.x also had some issues for me and I had to resign from it.

RealBlackStuff: thank you for pointing me to the Sunbelt firewall! I did not know that someone is still developing the old Kerio Firewall. I will try it later on, for sure.


Now, what I've done:

1. I uninstalled the NOD32 antivirus, as it became out of test time. I don't think the NOD caused the hangs, anyway.

2. Within the Outpost 1.0 I changed logging settings. I set it to keep only 1 kb of logs, nothing more. eMule is making a LOT of connections so that could be an issue.

3. I stopped to use WiFi, I use wired network connection now.

I think that point 3 makes difference. I don't have time now for going deeper (I am leaving for some time), but I can say that my system is up and running perfectly fine for 3 days 22 hours, network port transmitted over 11 millions packets in plus 11 millions packets out, I was using machine in that time for web, movies, music, office and it is stable as a rock now.

Later on I am going to find out where the problem is: with the firewall or WiFi. That may be interesting.

Thanks for your help!