Software Problems: Fixing Problems with Windows XP, Programs and Utilities - Page 4 of 4

	SEARCH THIS SITE:
	Web www.pcbuyerbeware.co.uk

SOFTWARE PROBLEMS: WINDOWS XP, PROGRAMS AND UTILITIES - Page 4

Click the relevant link below to go to that Q&A article. Use your browser's Back button to backtrack.

1. - Shutdown my Windows XP PC takes up to 30 minutes and the task bar and icons have vanished

2. - A swollen C: drive with Windows XP installed

3. - Standby and hibernate modes won't work in Windows XP - and an "Unknown device" is reported at start-up

4. - A typical device-driver problem

5. - A typical software incompatibility issue that causes Windows XP to crash

6. - BIOS-lock protection

7. - How to use the System File Checker (SFC) in Windows XP

8. - Why spyware and adware can make a computer can suddenly slow down very markedly

9. - The System Restore feature in Windows XP stops working after cleaning a virus infection

10. - Why can't the Registry Editor in Windows XP find any entries?

11. - Addressing the "A website has hijacked Internet Explorer's Home page setting" issue - AND other infections

12. - A printing problem caused by a conflict between start-up programs

13. - WinMX can download but cannot share files with remote users

14. - Troubleshooting system lock-up problems

15. - How to repair the System Restore feature in Windows XP

Shutdown of my Windows XP PC takes up to 30 minutes and the taskbar and icons have vanished

Problem

I suspect that my Windows XP Home computer has been infected by a virus, because it takes up to 30 minutes to shut down. AVG AntiVirus showed no infection, so I bought and installed the award-winning Steganos virus scanner. On restarting the PC, Steganos started a scan, but, 15 minutes into it, the taskbar and icons vanished and I couldn't open the Task Manager and had to power down. The same happened during the next restart, so I restarted and aborted the virus scan. Windows XP took about 30 minutes to repeat the cycle without the scan. On the next restart, I stopped the scan and tried using System Restore to restore a restore point that predated the problem, but do that didn't work.

Answer

The problem could have a number of causes. The trouble in running a virus scan and the slow shutdown can be caused by faulty hardware. However, both symptoms could also be caused by a rootkit infection, or it could just be that Windows itself has become corrupt. Alternatively, a device driver or other software could be responsible.

You can start by running a spyware scanner to find out if it has the same problems performing a scan as Steganos and then try eliminating a rootkit infection as the cause. If you don't have a spyware scanner, download the free trial version of AVG Anti-Spyware from http://free.grisoft.com/. While you are there, you can also download AVG's free rootkit scanner. The best-know rootkit scanner is called RootkitRevealer, which you can find the download site for by entering the name in the Google search box at the top of this page (with its Web radio button enabled). Make sure that the spyware scanner is updated.

Rootkits don't usually work in Safe Mode, so start up in Safe Mode by pressing the F8 key repeatedly during the short interval that occurs after the initial BIOS checks and when the first Windows splash screen appears. You can also set Windows to start in Safe Mode by entering msconfig in the Start => Run box and then selecting the option for a Diagnostic Startup. When in Safe Mode, run the updated spyware scanner and the rootkit scanner.

Use your common sense when interpreting the results of a rootkit scan, because not all of the reports reveal genuine rootkits; they can often be genuine Windows files that should, of course, not be removed.

If you have ruled out spyware and a rootkit being the cause, a number of hardware issues could be responsible, such as faulty RAM memory, or a faulty motherboard. However, a hard-disk-drive problem is the most likely cause. The hard drive's file system might be corrupt, it could have bad sectors, or the drive itself might be failing and locking up periodically.

You can try using the hard-drive diagnostic utility provided by its manufacturer's website, or the diagnostic software that comes with many PCs. Click here! to go to the information on hard-drive diagnostic programs on this site. With most Dell computers, pressing the F12 key during startup brings up a menu that includes diagnostics. The diagnostics are then either run from a CD that came with the computer, or from a hidden partition on the hard drive. With Dell's diagnostics, if you choose the System Locks Up option, it runs motherboard tests, memory tests, and thorough hard-drive tests. Your PC might provide similar diagnostics that will be explained in its user manual.

If you need a memory diagnostic program, use Memtest86+ from http://www.memtest.org/.

The Ultimate Boot Disk from http://www.ultimatebootcd.com/ provides a very good collection of free diagnostic utilities that are downloaded as ISO image, which when burned to a CD/DVD creates a bootable CD. The hard-drive utility on the CD is called MHDD, which is not very user-friendly. It can also be downloaded from http://www.hddguru.com/.

Note that it is always advisable to make restorable backups of the system, or, at least, valued data files before you run diagnostic tests on a hard-drive that is suspected of being faulty, because the additional stress placed on it by the tests could make it fail for good. The tests can tell you why the anti-virus software locks up, but might not provide the reason for the slow shutdown.

A slow shutdown is usually caused by a process or service not responding properly, or by problems when Windows attempts to write settings to its Registry.

A buggy device driver is most commonly responsible, but there are a few bugs in Windows that can be responsible on certain systems. To fix the Windows issues, visit Windows Update and choose the Custom option. It includes many patches not rated as Critical, and also provides many device-driver updates.

The Nvidia Driver Helper service can be the cause of an extremely slow shutdown. To disable it, if it is present, enter msconfig in the Start => Run box. Click the Services tab. To make the search easier, enable the Hide All Microsoft Services option. If it is present, disable the Nvidia service by removing the check mark in its box with your mouse.

In Windows XP Professional Edition, to run the Group Policy editor, enter gpedit.msc in the Start => Run box. In the windows that comes up, navigate to Computer Configuration => Windows Settings => Security Settings => Local Policies => Security Options. If you find a setting called Shutdown: Clear virtual memory pagefile, right-click on it and enable the Disable setting, because it slows the shutdown down. Windows XP Home Edition doesn't have the Group Policy editor.

Note that a program that makes a backup at shutdown can be very slow, especially if it hangs when looking for an external drive to back up to that isn't available.

If updating device drivers doesn't work and you can't fix the problem by disabling a startup program or service, check the Event Viewer log. Make a note of the time on the computer's clock before shutdown and note the time that shutdown takes. Then, restart and enter eventvwr.msc in the Start => Run box. Look under Application and System. Click the Time heading and look at the entries for that time period. Error and Warning messages may indicate the cause of shutdown delays.

Don't be concerned about every error you see, because there are warnings and errors produced during a normal shutdown. Only look for entries that might be the cause of a substantial delay. The information in the Source column would provide the source of a delay.

Note that corruption of the log files can be the cause of a delay, so try clearing the log files in the Event Viewer before shutting down by using the Action => Clear all Events option.

A swollen C: drive with Windows XP installed

Problem

You have a computer with a single hard disk drive of 20GB that dual-boots Windows XP Home Edition and Windows Me from different partitions of 10GB (C: drive) and 2.5GB (D: drive) respectively. The E: drive contains the remaining space.

You are running out of space on the C: drive that holds Windows XP, so you try removing as many unused programs from it as possible. Afterwards you look to see how much space you have reclaimed, but soon discover that 1.7GB (1700MB) are unaccounted for. Further analysis reveals that something called System Volume Information, and the Pagefile occupy 1.15GB and 384MB respectively.

You want to know if you can either delete or reduce both of these features, and you also want to know if the Windows XP installation itself, which occupies 1.23GB can be reduced in size.

Explanations and solutions

Pagefile.sys is the name of the Virtual Memory swap file that Windows uses to hold programs it is running when RAM memory runs out. This has to be big enough to handle all of the programs that are usually run, so 384MB is a reasonable size. Indeed, the bigger it is the better. Therefore, you won't be able to reduce it, but you could transfer it to the E: drive to free up space on the C: drive. If you don't know how to do that look up Virtual Memory in the Help files.

If you want to see how much space the Pagefile is using, press the Ctrl + Alt + Del key combination to bring up the Task Manager. The amount of disk space in use is reported under the Performance tab.

Windows XP stores its System Restore files - back-up copies of the system files - under the reserved area of the C: drive called System Volume Information. These can occupy a very large amount of space, and, for the most part, the files it contains are useless.

If you use the right mouse button to click on My Computer, then click left-click on Properties, a tab called System Restore will become visible. You can turn this feature off here. Or you can use the Settings button to specify the maximum percentage of the hard disk drive space that it can use. Windows XP uses 12% of the hard disk drive by default to contain the System Volume Information, which, on a 20GB drive, is 2.4GB, and a huge 4.8GB on a 40GB drive.

How to Gain Access to the System Volume Information Folder: http://support.microsoft.com/?kbid=309531

When you partitioned the hard disk drive, you should have made the C: drive much larger, because even a new installation of Windows XP uses nearly 1GB of storage space. Windows XP is descended directly from Windows NT - a network operating system with a mainframe computer heritage - which has always been large. Many new features have been added to Windows XP, so it is even larger than Windows NT.

If you want to repartition the whole drive without destroying any data, the use of PartitionMagic, or similar program, is required. Otherwise, you will have to delete the partitions with the free DOS utility called FDISK, reformat the drive, and then re-create the partitions with FDISK.

Note that most of the HDD manufacturers provide free downloads of utilities that can partition and format their drives, and there are issues with FDISK and HDDs larger than 64GB. Click here! if you want to go directly to information about this on this site.

Nowadays, thankfully, hard disk drives of 40GB + are cheap, so no one need suffer from a lack of drive space.

See this problem about a virus hiding in the System Volume Information files on Page 3:

Problem: a recurring virus that hides in the system's System Volume Information folders

Standby and hibernate modes won't work in Windows XP - and an "Unknown device" is reported at start-up

Problem

You upgraded your IBM desktop computer from Windows 98 SE to Windows XP Home Edition. Before upgrading you followed Microsoft's advice, and reflashed the BIOS with the latest XP-compliant update, and downloaded the relevant XP device drivers for the system's devices and peripherals from IBM's website.

Everything installed properly, but a mysterious "unknown device" keeps being recognised at start-up, and whenever you try using the standby and hibernate modes the following message comes up:

"The device driver for the 'PC/AT Enhanced PS/2 Keyboard (101/102-Key' is preventing the machine form entering hibernation. Please close all applications and try again. If this problem persists, you may need to update this driver."

XP's Device Manager reports that the keyboard is using the XP driver, and that there is no update available. You want to know how to make the hibernate and standby modes work.

Possible solutions

As is often still the case, the error message is misleading. The device driver for the keyboard is not at fault here, so even if an update is available, it won't help.

The problem is caused by third-party software that has installed a kernel-mode device driver, which has attached itself to the 18042prt.sys keyboard driver - and it is not compatible with XP. The most common culprit is Adobe Type Manager 4.0 (ATM), which installs the Atmhelpr.sys driver.

As a temporary fix, either uninstall ATM, or find the offending file and rename it, say, Atmhelpr.xxx. Doing that disables ATM's font-smoothing effect. If you want to use font-smoothing, you can enable XP's version.

Note that other third-party software can cause the same problem. That is why it is always best to do a clean installation of a new operating system instead of upgrading from one operating system to its successor, because the upgrade doesn't allow you to install and test each piece of software on its own. The upgrading process merely rebuilds the Registry around the installed software, and therefore leaves much of the old operating system in place when it should be removed.

To read a MS Knowledge Base article on this subject called "Unable to Use Power Management Features", click the following link:

http://support.microsoft.com/?kbid=302414

That deals with the confusion surrounding the error message. But you still have to sort out the mysterious "unknown device". To track it down, you can search the Windows Registry.

From Start => Run, enter RegEdit, click on OK, click the + beside HKey_Local_Machine, and click on Enum to highlight it. Press the Ctrl and F keys, and enter "unknown" into the search box. When you press the Enter key the window that comes up should show the entry for a device with class "Unknown". This is the unknown device.

Next, look in the other lines in this Registry entry for clues, which will depend on the device. A plug-and-play printer, for example, will have a hardware ID string that usually states the printer's name. But a PCI adapter card, the key for which shows up in the left-hand window, will have a name such as Ven_11C1&De_0042&Subsys_00401668.

This string identifies the vendor, the device, and the subsystem. The name of the manufacturer is not usually provided, but knowing the manufacturer of the chipset used on the card, which is provided, is usually enough information to make it possible to obtain the latest driver file for the card.

The identification codes used in the string are listed on several Internet sites, and can easily be found by using the Google search box at the top of this page. All you have to do is enter "PCI vendor list".

Once you know the device's manufacturer and model, you can download and install the latest driver file for it from its website, and then the message the shows up at start-up should disappear.

A typical device-driver problem

Question

I have a Samsung ML-4500 laser printer, but whenever I boot the system it is recognised as the ML-5080 model, which is almost identical to the ML-4500, and Windows 98 SE asks me to insert the driver CD. I can click on Cancel and the computer loads normally, but if I forget to turn off the printer, at the next boot Windows wants to reload the wrong driver. Windows refuses to accept the ML-4500 driver, and the Samsung site does not list the ML-5080 as a product, so how can I remedy this problem?

Answer

The problem is probably caused by either a buggy printer driver, or a corrupt key in the Windows Registry.

Assuming that the printer uses the LPT parallel port, at start-up, Windows will assign it a device-identification ID string of this kind - LPTENUM\SamsungML-4500179C. To find out if this device has already been installed, the hardware-detection wizard will look in the Registry under HKEY_LOCAL_MACHINE => Enum => LPTENUM (enter regedit in the Start => Run box to run the Registry Editor and navigate to this location).

Below this, there should be a key for each plug-and-play (PnP) printer that has been installed, and under each key there should be the ID string that identifies the printer.

If there is a message there instead that says, "new hardware detected", then either the key was never created (which usually means a fault in the driver setup program), or the key has somehow become corrupted in a way that prevents the hardware-detection wizard from finding the match that it needs to load the driver.

The Samsung printer driver comes as a self-contained installer program that is supposed to run before the printer is connected. Normally Windows has to detect the actual hardware before it loads the drivers, but this in not the case if the driver is an installer program.

If all went well when the driver was installed, the required Registry entry will have been created and the hardware-detection wizard will therefore not need to ask for a driver, it will load the proper driver that is already installed in the Windows folder. But, in this case, the driver installation is buggy, or was corrupted, so Windows asks for the driver CD, because it does not have the information it requires to load one from its folder. But when you insert the driver CD, Windows cannot find the INF file that contains the device's ID, because the process itself doesn't work properly, or has somehow become corrupt.

Why does Windows wrongly identify the printer as an ML-5080 model? - Because the printer provides the ID string, not the printer's model description, so Windows looks for an appropriate INF file, It obviously cannot find one that contains the ML-4500 description. But it does find one that contains the ML-5080 description. There is no point in finding and deleting that INF file, because Windows cannot locate the correct one, and if you delete the one it does locate, it will install the printer and describe it as an unknown device.

The most likely solution is therefore to download and install the latest printer driver for the relevant version of Windows from the http://www.samsung.com/ site, and it should install the correct Registry entries. Reboot. If Windows no longer detects the printer as a new device, the problem is solved.

But if the problem still occurs, then the Registry is corrupt, and the corrupt key has to be removed.

To do this enter regedit in the Start => Run box, and navigate to HKEY_LOCAL_MACHINE => Enum. Highlight the LPTENUM key, right-click on it, and then click Delete. Run the printer installer program again, and hopefully the required keys will be recreated, and the problem will be resolved.

If the problem still occurs, when you are asked for the driver, don't click on the Cancel button, instead just click Next and Finished, so that Windows does not reinstall a device driver. The printer should then be installed under the Other devices category in the Device Manager that is not normally present. This doesn't matter because Windows doesn't install printers in the Device Manager (they are installer programs), and the correct keys will have been created in the Registry, so Windows should stop detecting new hardware and asking for the driver CD.

Click Fixing device driver problems to go to that item on Page 3. Use your browser's Back button to backtrack.

A typical software incompatibility issue that causes Windows XP to crash

Problem

Your office computer is less than six months old. It has a a fast AMD Athlon XP 1800+ processor recommended for use with Windows XP, a Socket A Gigabyte motherboard, and 256MBs of DDR RAM. The other devices are two IDE hard disk drives, a Hauppauge TV card, a Linksys network card, a SoundBlaster Live! sound card, and an nVidia GeForce2 MX200 video card. You use Office 2000 and Money 2001 to run your office administration and personal finances. The problem is, every time you try to use Money 2001, it brings the system down. There is no blue screen of death of the kind that Windows 98 always shows prior to a crash - just the usual meaningless message that reads, "The system has recovered from a serious error. BCCode..." followed by a long string of letters and numbers. You have tried reinstalling Money, but the system continues to crash every time you try to use it.

Some possible solutions

Firstly, Microsoft has not certified that Money 2001 is fully compatible with Windows XP. There have been many reports on the web, in newsgroups, and elsewhere of compatibility issues between this version of Money and Windows XP. Indeed, Microsoft itself recommends using Money 2002 with Windows XP.

That said, the cause is more likely to be a device-driver incompatibility. When translated by someone in the know, the error message indicates that a Windows kernel error - system crash - stop error - or blue-screen error of the kind that usually provides a message giving details about the error - has taken place.

However, in this case, since Windows XP is set by default to restart automatically for this kind of error, the blue screen is not displayed, and all you see is an error message. The decoded message indicates that it is a memory-access error of a kind that usually occurs when a user upgrades Windows, or installs a new device driver, and it is therefore almost certainly caused by a device driver that is not compatible with Windows XP. In other words, one of the hardware devices in the computer is using a device driver that does not work properly with Windows XP.

The quickest way to find the errant device is to remove or disable all of the nonessential hardware devices, and then re-enable or reinstall them one at a time until you find the offender. Note that you can disable and re-enable hardware devices in the Windows Device Manager. You won't be able to disable the boot hard disk drive, the keyboard, the mouse, the monitor, or the video card, because these are essential devices. But, in this case, the sound card, the TV card, and the network card can be removed from the system or temporarily disabled.

Note that there have been reports that Money 2001 running under Windows XP can cause problems with sound-card drivers, so removing or disabling the sound card is a sensible first step to take.

A good way to find reports on incompatibilities such as this one is to enter a suitable search phrase in the Google search box at the top of this page. In Google Groups you can enter the name of a newsgroup, such as alt.windows98, or alt.os.windows-xp, in order to be able to search through it alone, or all of the other newsgroups. In this case, a suitable search phrase might be, "Money 2001 and Windows XP error", or the same phrase with the word "error" replaced by "system crash", etc.

BIOS-lock protection

Problem

You have a brand-name computer such as a Packard Bell 1100 that comes with a Restore Disk in the form of a CD instead of a Windows XP CD. When you try to use the system's Smart Restore feature to restore the system, a blue screen comes up that says, "BIOS lock - press any key to proceed." You try pressing many keys, but the screen just goes black every time, and stays that way. You press the F2 key that allows you into the BIOS, and, of course, it is not in any way locked.

Solutions

The system could have been provided with the wrong Restore Disk that cannot reference the system, because its "BIOS lock protection" prevents it from doing so - or the motherboard could have been changed and it has a BIOS that is not recognised by the Restore Disk.

"BIOS lock" is an anti-piracy measure designed by Microsoft to prevent a computer with an OEM version of Windows XP installed on it from having its Restore Disks installed on other computers.

Microsoft does not allow (OEM) computer manufacturers to distribute full versions of Windows XP with their computers in case they are illegally installed on other computers, so the OEM manufacturers have to use a Restore Disk that contains a master image of the system as it was when it left the factory. The Restore Disk has what Microsoft calls inbuilt "BIOS lock protection" to prevent the disk from being installed on another computer.

"BIOS lock protection" adds an encrypted signature to the desktop management interface (DMI) area of a flashable BIOS during the manufacture of the BIOS. The Restore Disk is programmed to recognise this signature, and won't proceed with the restoration unless it recognises it.

The signature remains intact after the BIOS has been reflashed with an update. But if you want to upgrade the motherboard, the new one must be supplied by the computer's manufacturer so that it has the same BIOS signature. If you install a new standard motherboard in a new case (because the Packard Bell case only accepts motherboards made for Packard Bell cases), and transfer all of the devices from the old case to the new one, you will not be able to use the Restore Disk.

Fortunately, brand-name (OEM) computer manufacturers usually copy the Windows system cabinet (.cab) files to a folder on the C: drive, the path to which is usually C:\Windows\Options\Cabs - and also often to a separate System Restore logical drive partition. These copies are not BIOS locked, so, if you have a CD writer, it would be a good idea to copy them to a CD-R disk for backup purposes.

When Windows XP wants to install or remove a feature or load a device driver and it asks for its CD to be accessed, you would direct the Browse function to these CAB files.

Moral of the story - don't buy an OEM computer. Build your own, and install a retail version of Windows or Linux on it.

See the Build a PC page on this site for all the information you need to build your own computer.

How to use the System File Checker (SFC) in Windows XP

The System File Checker (SFC) that users of Windows 98 should be familiar with is available in Windows XP. Most XP users probably don't know this because it is hidden.

You have to run it from XP's Command Prompt. You can open it by entering the command cmd in the Start => Run box.

You should have a certified Windows CD - not a System Recovery CD of the kind that comes with many brand-name computers instead of a Windows CD - because the SFC utility makes use of it.

Enter the command sfc /? to be presented with a list of commands and switches that can be used.

Click here! to go to more information on the System File Checker in Windows XP on this site.

Here are the instructions from the Help and Support files on how to make a computer running Windows XP start up at the Command Prompt:

"To start your computer at a command prompt"

"Print these instructions before continuing. They will not be available after you shut your computer down in step 2. Click Start, click Shut Down, and then, in the drop-down list, click Shut down. In the Shut Down Windows dialog box, click Restart, and then click OK. When you see the message Please select the operating system to start, press F8. Use the arrow keys to highlight Safe Mode with Command Prompt, and then press ENTER. If you have a dual-boot or multiple-boot system, choose the installation that you need to access using the arrow keys, and then press ENTER."

However, although the above information is still the only information available in its Help and Support files, this method doesn't work in Windows XP SP2.

You have to click Start => Turn Off Computer => Restart. No Please select the operating system to start message comes up. You are just told that the computer is shutting down. The computer then restarts. All you have to do is press the F8 key after the start-up screen has completed the memory count to bring up the following list of start-up options.

Why spyware and adware can make a computer can suddenly slow down very markedly

The two most common causes of sudden system slowdowns are viruses and spyware.

Note that there is always a lag between new viruses and spyware being issued/used and the ability of updated antivirus and anti-spyware programs to recognise and eliminate them. Therefore, it is always possible for a system to be infected by viruses and spyware that the scanners can't detect. Moreover, once a virus has infected a system, it can use stealth programming techniques to hide itself from virus scanners, and it can also even disable some of the features of the most popular virus scanners. That is why it is a good idea to use a free online scanner such as Trend's at http://www.antivirus.com/ and Trend's Housecall at http://housecall.antivirus.com/ and http://housecall.trendmicro.com/.

By default, Norton AntiVirus will only check its Internet site for updates to its virus definitions automatically once a week. If you clicked on Norton's virus definitions entry on its status screen, it will say that they are up to date. But if you were to click on the Live Update button while online, the program often downloads new definitions, which will often reveal a virus infection that it missed previously.

By the way, if Norton AntiVirus Live Update doesn't automatically download updates, click Why can't I schedule Norton AntiVirus with Windows XP? to read that article on Page 3.

The same goes for the use of the most widely used spyware detector and removal programs: Microsoft's Windows Defender, Spybot S&D, and Ad-Aware.

Disk defragmentation can cause significant slowdowns, but, being very slow to develop, isn't likely to be the cause of a sudden marked slowdown. However, something that gets stuck in the fan of the heatsink and fan cooling unit and a build up of dust (an invasion of dust bunnies) in the unit can also slow the system down because BIOS protection measures can be set to slow the system down if it overheats. This kind of trouble could kick in all of a sudden, so it should be investigated.

Other causes of sudden slowdowns are files installed by new applications, new hardware device drivers, or even from running Microsoft Update.

Look under Add/Remove Programs to find out if a particular update can be removed. Otherwise, with Windows Me and Windows XP, use the System Restore feature to roll the system back to a time that predates the installation of the update. If a Windows update has screwed a Windows 95/98 system up, you might have to reinstall Windows, or restore a backup of it. If you want to know about backups, click here!

If all of the above have been eliminated as the cause, check the DMA mode settings. A bug in Windows XP and Windows 2000 can result in a DMA mode being set that is much slower than the maximum setting that the drive is capable of using.

To enable DMA mode in Windows XP using the Device Manager

"1. Open Device Manager. 2. Double-click IDE ATA/ATAPI Controllers to display the list of controllers and channels. 3. Right-click the icon for the channel to which the device is connected, select Properties, and then click the Advanced Settings tab. 4. In the Current Transfer Mode drop-down box, select DMA if Available if the current setting is "PIO Only." If the drop-down box already shows "DMA if Available" but the current transfer mode is PIO, then the user must toggle the settings. That is: Change the selection from "DMA if available" to PIO only, and click OK. Then repeat the steps above to change the selection to DMA if Available."

This will be Ultra DMA Mode 5 on modern systems running relatively recent hard disk drives (HDDs). This information is confirmed in this article:

DMA Mode for ATA/ATAPI Devices in Windows XP - http://www.microsoft.com/whdc/device/storage/IDE-DMA.mspx

One reader e-mailed to tell me that he had no Advanced Settings tab, only General, Driver, and Resources tabs, which don't have any DMA information. If that is the case with you, try using a free utility such as the Belarc Advisor from http://www.belarc.com/ to reveal the DMA transfer mode of an IDE ATA drive.

If the mode is PIO, or one much slower than the HDD's capabilities, the system will slow down to that mode of operation. Microsoft's Knowledge Base (KB) article number 817472 explains the problem and suggests solutions: http://support.microsoft.com/?kbid=817472.

See the Diagnostics page on this site for information on how to use the MS Knowledge Base.

For a Windows 95/98/Me system, make sure that all of the IDE settings in the BIOS are set to Auto, and have a look under the Performance tab of System Properties by pressing the Windows key and the Pause/Break key. If there is a message there that says that Windows is working in Compatibility mode, read this MS Knowledge Base article - 151911 - MS-DOS Compatibility Mode Problems with PCI IDE Controllers - the NOIDE Registry entry. - http://support.microsoft.com/?kbid=151911

With Windows Me and XP, if the slowdown hasn't been resolved by any of the above steps, you should use its System Restore feature to roll the system back to a time that predates it. You will then have to reinstall anything that you installed after the date of the creation of the restore point that you chose to use.

****

Windows XP: Converting a FAT32 drive that contains data files to NTFS can slow the system down significantly

If a Windows XP user has a drive formatted to use the FAT32 file system, if the drive contains data files and it is converted to use NTFS (New Technology File System) by making use of XP's file-system conversion tool, the drive will have a cluster size of on 512 bytes instead of the usual default of 4KB per cluster for a drive with a volume of 2GB and higher. This slows the system down significantly. The only inexpensive or uninvolved way to change the cluster size to 4KB is to format the drive to use the NTFS file system and lose all of its data.

However, there is an inexpensive method that can be used to get back to a 4KB cluster size from a 512 byte cluster size without having to reformat the drive. This page provides that information: Converting FAT32 to NTFS - http://aumha.org/win5/a/ntfscvt.htm.

How to find out what a drive's cluster size is

To find out what the cluster size is for a particular drive, enter cmd in Windows XP's Start => Run box to bring up the command prompt. Enter the command chkdsk c: to check the C: drive (or any other drive's letter to check that drive). After the quick check has taken place, a message appears that provides information about the drive. Note the number next to the bytes in each allocation unit line.

The bytes in each allocation unit is the drive's cluster size in bytes. To obtain the cluster size in kilobytes (KB), divide the number by 1024. For example, if Chkdsk shows 4,096 bytes in each allocation unit, then the cluster size is 4 KB. (4,096 bytes / 1,024 bytes per KB = 4KB). If it shows 512 bytes, you'll have to format the drive to get it to 4KB. If it's the C: drive and Windows XP is installed on it, you'll have to format the drive and reinstall Windows and all of your software applications. To do that you would boot the system from the Windows CD (the BIOS might have have to be set to use the CD-ROM drive as the first boot drive). You can reformat the drive during the setup process.

The System Restore feature in Windows XP stops working after cleaning a virus infection

Problem

You have been infected with a virus and, according to instructions for its removal, you have turned off the System Restore feature in Windows XP. However, you then discover that you are unable to turn it back on again. An illiterate cryptic message comes up saying: "The procedure entry point remote assistance prepare system restore could not be located in the dynamic link library WINSTA.dll." - You want to know how best to rectify the situation.

Solution

Unfortunately, Microsoft hasn't thought through the way its System Restore feature works. At present it has to be turned off before you remove a virus, but turning it off removes access to previously saved restore points (points at which options that make it possible to restore the system were created). Therefore when you have removed the virus, you couldn't use the feature to restore the system to the state it was on a specific date on which a specific restore point was created.

The cause of the problem is a mismatch between file versions. You most probably repaired the system by using the Windows XP CD, which did not include file updates such as are supplied by XP's Service Pack 1 (SP1) update. This would not have been the case had you been able to use System Restore, because it would have reinstalled the correct files.

You need to reinstall SP1 and any other updates that Microsoft Update (on Microsoft's site) tells you are required. Then go to the Control Panel, click System, click the System Restore tab, and then restart Windows Restore by unchecking the option called Disable System Restore.

Why can't the Registry Editor in Windows XP find any entries?

Problem

All of a sudden, for some unknown reason, when entering the term RegEdit in the Start => Run box in the Home edition of Windows XP to search the Registry, the Find facility is found to be faulty. When conducting a search, a message comes up saying, "Finished searching the Registry".

Answer

For some unknown reason, Microsoft has changed the behaviour of the Registry Editor in Windows XP.

In Windows 95 /98 / Me, when you open the Registry Editor by entering regedit in the Start => Run box, the search position always starts from the top of the list. However, in Windows XP, the Registry Editor remembers where you were the last time it was opened. So, if you finished a search, the next search will begin at the end even if it is weeks or months later. In this case, you aren't offered the option to start a search from the beginning, and the "Finished searching the Registry" message appears immediately.

However, it's easy enough to start a search from the beginning. Simply click on the My Computer heading at the top of the Registry Editor's window, and the search will then run through the whole Registry.

Addressing the "A website has hijacked Internet Explorer's Home page setting" issue - AND other infections

Problem

No matter what you set as the Home page in Internet Explorer, it is only kept as the Home page for that session. Another page automatically becomes the Home page the next time the system is booted. Even changing it via the Windows Registry by using the Windows Registry Editor doesn't stop it from being reset. The offending page is located at http://www.global-finder.com.

Answer

It might be a good idea to read the information on this page before you read the rest of this Q&A.

Browser hijacking and what you can do to safeguard your computer - http://www.microsoft.com/athome/security/online/browser_hijacking.mspx

Plenty of websites are able to hijack your browser (in this case Internet Explorer), and point it to their home pages. No computer that is connected to the Internet is likely to be free of spyware that has been covertly installed by offending websites. To remove the spyware use these excellent free programs Microsoft's Windows Defender - Spybot S&D - Ad-Aware. What one of them misses the other may detect. Make sure that the latest updates have been installed for both programs before you run either or both of them.

Note well that you may have to run Spybot and Ad-Aware in Safe Mode in order to remove some spyware and adware. You can do that by pressing the F8 key just before Windows 98 or Windows XP starts to load at start-up. A boot menu presents itself with several boot options, including Safe Mode.

CoolWebSearch (CWS) spyware comes in several varieties, all of which are difficult to remove. Some variants use two components that can run even when the computer starts in Safe Mode. Each component reconstitutes the other component if a spyware removal tool removes one of them. And, recently, a variant that has three components. Together they use stealth techniques that hide them from the system and from spyware removal tools.

Global-Finder is a variant of CWS, which is a particularly tenacious hijacker of browsers. The creators of this spyware keep changing its code in order to bypass spyware-removal software. That is why you should always update any such software before you use it.

If none of the above programs get rid of it, visit http://www.intermute.com/spysubtract/cwshredder_download.html for the latest version of CWShredder. See the urgent news update below. You can use the Google search box at the top of this page (with its Web radio button enabled) to find alternative download sites if that link doesn't work.

****

At the time of writing (July 3, 2005), CWShredder had not been updated to remove a variant of CWS that has three components which use stealth techniques. However, there are downloads available that can track down and remove the stealth component:

Windows 98/Me - http://derbilk.de/SpSeHjfix109.zip

Windows XP/2000 - http://derbilk.de/SpSeHjfix112.zip

****

Software of this kind most commonly finds its way into a system by exploiting a particular security bug in Microsoft's version of the Java Virtual Machine (JVM).

There is a security patch available to defeat this bug. Read the relevant Knowledge Base article 816093 by clicking this link:

http://support.microsoft.com/?kbid=816093

To make sure that you don't get reinfected, downloading and installing the latest security updates from Microsoft Update would be the quickest way to remove the security flaws in the JVM or in Internet Explorer's JavaScript.

An urgent news update from Spywareinfo.com

Note that I haven't added the date to the following information, because, just in case of developments of this sort, you should always obtain the latest updates for any kind of malware tool before you use it.

Update Your Copies of HijackThis and CWShredder

"If you have ever downloaded HijackThis or CWShredder, it is urgent that you upgrade to the latest versions before using them again. If you mirror these programs on your own site, it is extremely urgent that you update the files.

"Due to a new variant of the CWS Trojan, using either HijackThis or CWShredder on an infected Win98 or WinME computer may lead to severe damage to that computer. You must update to the very newest versions of these programs before using either of them again.

"I don't know what the details of the problem are. I haven't been following the latest postings at the message board. The problem is serious enough that people have had to reinstall Windows on their computers.

"To upgrade these programs, you merely delete the old files and replace them with the new."

There have been distributed denial of service (DDOS) attacks on the Spywareinfo.com site, and it therefore tends to be in an unsettled state, so try visiting the site and then use its search box to look for HijackThis and CWShredder. - http://www.spywareinfo.com/.

You can obtain the latest update for CWShredder here: http://www.intermute.com/spysubtract/cwshredder_download.html. Alternatively, make use of the Google search box at the top of this page (with its Web radio button enabled) to search for cwshredder.

HijackThis

If neither Microsoft's Windows Defender nor Spybot S&D nor Ad-Aware remove a malware problem - in an extreme case only - you should download and run HijackThis by using the link above. This program lists all of the changes that have been made to the standard configuration of Internet Explorer, and it allows you to restore them to the default configurations. The program needs to be used with care, because it can easily remove settings that you want or need to keep.

Here is the best way to use the program. Download HijackThis! Unzip the downloaded file into a new folder that you should create before you start the download. Don't install it on your Desktop. Don't use any of the Temp folders that are presently in your computer. Double-click the HijackThis.exe file and click on Scan. When the scan is finished, the Scan button will change into a Save Log button. Click Save Log (doing this generates a hijackthis.log file) Next, click => Config [button] => Misc Tools [button]. Click Generate StartupList log [button], which generates a startuplist.txt file.

For more information on this subject, please visit: http://www.merijn.org/htlogtutorial.html.

If you are a relatively experienced computer user, first try copying and pasting your HijackThis log file to this web-based HijackThis log-file analyzer - http://www.hijackthis.de/.

You shouldn't rely exclusively on the log-file analyser (US: analyzer), but if you have a reasonable level of technical knowledge, it should help determine which items should be removed.

Sites that have expert volunteers that interpret HijackThis log files are:

1. - http://www.castlecops.com/

2. - http://www.techsupportforums.com/

3. - http://forums.majorgeeks.com/

Locking Internet Explorer's start page setting against user changes

There is an easy way to use Spybot S&D to protect your Home page and other settings in Internet Explorer.

The Spybot Search and Destroy utility can disable several changes being made to the settings under Internet Options, such as changing the Home page, which is shown under the General tab (shown in the image below). This is useful because some spyware can make undesirable changes to Internet Explorer that can be difficult to remove once they are in place.

There are three settings available in the latest version of the free spyware removal tool, Spybot S&D. It's advisable to enable them all, but just remember that if you want to make changes yourself and can't, it's because you have to disable one or more of these settings first. To find the settings, run Spybot and go Mode => Advanced mode. Options appear in the bottom left corner of the window that don't appear if Default mode is enabled. Click on Tools followed by the IE tweaks icon. The following three settings have check boxes beside them that you have to place a check mark in with the mouse to enable:

1. - Lock Hosts file read-only protection against hijackers.

It is possible that changes to your operating system's Hosts files are redirecting traffic to websites commonly used as home pages to malicious ones. You will need to rule out this possibility as well. Visit http://www.mvps.org/winhelp2002/hosts.htm for more information.

2. - Lock IE start page settings against user changes [current user]

3. - Lock IE control panel [Internet Options] from opening within IE [current user] - [You can only access Internet Options from the Control Panel.]

Alternatively, you computer's antivirus or security software might have options that lock Internet Explorer in the same ways. Remember that you will have to unlock the settings if you want to make use of these features yourself.

Porn pop-ups

If you are suddenly plagued by porn pop-ups, these are brought about by adware or spyware, which probably installed itself on your computer when you accepted a free download from an Internet site.

This kind of nuisance software has become very widespread. Moreover, it is the single most frequent cause of sudden system slow-downs and lock-ups.

As usual, to remove the problem, use Spybot S&D and Ad-Aware first. If these fail to do away with the nuisance, try using HijackThis from http://www.spywareinfo.com/.

The Svshost worm causes memory problems

In a Windows XP system, if a message pops up saying that the system is short of memory, and nothing works properly thereafter, and there is a reference to Svshost.exe in the Windows Task Manager (accessed by pressing the Ctrl + Alt + Del keys), then your system has been infected by the Svshost.exe worm, which is also known as the Spybot worm, which should not be confused with the Spybot S&D spyware-removal tool.

In a Windows XP system, the Svshost.exe file keeps increasing in size by about 400 to 500KB per second, and under the Performance tab of the Device Manager, the virtual memory usage (page file usage), the amount of RAM in use, the commit charge, and the kernel memory figures all keep increasing steadily. (In a Windows 9.x system, only the virtual memory is shown under the Performance tab.)

The Svshost.exe file was deliberately named that because of its similarity to a real and often-used Windows XP file called Svchost.exe.

Several worms and Trojan viruses also use the name Svchost.exe.

The real Windows XP Svchost.exe file, about 13KB in size, resides in the C:\Windows\System32 folder. When right-clicking on it, and then clicking on Properties, followed by the Version tab, the file is described as a Generic Host for Win32 Services, and because it is used by several Windows services, it appears in the running task list several times. This fact makes its name attractive to the malware writers who want to hide the presence of their Trojans or worms.

Running Microsoft's Windows Defender, Spybot S&D, and Ad-Aware (always fully updated with the latest malware definitions), will get rid of all of the above-mentioned worms or Trojans.

****

Note well that you may have to run the above removal tools in Safe Mode in order to remove some spyware and adware. You can do that by pressing the F8 key just before Windows 98 or Windows XP starts to load at start-up. A boot menu presents itself with several boot options, including Safe Mode.

A printing problem caused by a conflict between start-up programs

Problem

The system is running Windows XP Home edition, an Epson Stylus C80 printer, and a Kodak CX4210 camera that uses Chadic's EasyShare software. The system won't print colour prints either by using EasyShare or by printing directly through Windows. Only the first inch of a print is printed when a message appears saying that the document failed to print. The printer then churns out sheets of paper until the feeder runs out of them. Epson's support staff suggested that the problem might be cause by a conflict between the TSR (Terminate or Stay Resident) programs that are loaded automatically when the system starts up. The suggested cure was to enter msconfig in the Start => Run box and then disable all of the Startup group items in the System Configuration utility (that can also be accessed in the same way in Windows 98, but not in Windows 95). You discover that doing this cures the problem. But to find the culprit, Epson suggested re-enabling them one at at time until the problem recurred and the offender was identified. There are twenty-two of these start-up programs, so the suggested method would consume a lot of paper and ink. You therefore want to know if there is a more practical method of revealing the offending start-up program.

Answer

It is unlikely that you will need to have all of the twenty-two programs starting up every time you turn on your computer. Therefore, the first action to take is to visit PacMan's Portal at http://www.pacs-portal.co.uk/, and then look up each of the programs listed in the Startup program list.

There may be start-up software associated with a scanner and the camera that can be run by creating a batch file that can be run when you need it. See the first item on the Tips pages of this site for an example of how to create and use a batch file to launch programs after the system has been successfully started.

There are several standard Windows start-up programs that are loaded and which are very unlikely to be the cause of the problem. These include LoadPowerProfile, which should be listed twice (once as a task and once in services), ScanRegistry, SchedulingAgent, SystemTray, and the TaskMonitor. You will also probably want to keep your antivirus software running constantly, although be sure to take care not to install more than one antivirus program.

Try printing with just the above list of programs running. If you can print, you'll be left with a list of unselected programs that you've decided from information gleaned from PacMan's Portal are either definitely not needed or which may be useful to keep running. By this time you will probably only be left with just four or five TSR programs to eliminate. You can do this most quickly by using a technique called a binary chop.

To isolate the problem in the least number of steps, simply divide the list of remaining items into two halves. Test with one group enabled. If printing works, add half of the remaining group and test again. At each step, you will eliminate half of the possible offending start-up programs. If you started out with eight programs left to test, it will take just three tests to isolate the offending program.

WinMX can download but cannot share files with remote users

Problem

You use WinMX to download and share files across the Internet. You have recently upgraded from Windows 98 SE to Windows XP Home edition. You installed and messed around with some utility software and a virus scanner, then all of a sudden found that although you could still download files with WinMX, it wouldn't allow others to download them from your system.

Answer

Most people using WinMX have problems when using it with Windows XP's built-in firewall enabled. Although it is possible to configure the firewall to allow file sharing, doing so can cause dire processor usage problems. Therefore, it is advisable to disable the Internet Connection Firewall (ICF) service in XP.

To disable ICF, use the right mouse button to click on My Network Places and then left-click on Properties => Network Connections (or access the Network Connections icon in the Control Panel). Next, click on Properties for your connection, followed by the Advanced tab, where the ICF should appear. Uncheck its box to disable it.

Alternatively, you can click its Settings button, then Add to add a new service, which you can call WinMX. Enter the IP address 127.0.0.1 (which is for the IP address for the local computer), and for the TCP port enter 6699. Repeat the process for UDP port 6257.

You should also uninstall any other Internet security programs, because both Norton and McAfee Internet security products can cause multiple problems with WinMX, apparently even when they have been disabled instead of being uninstalled.

The ZoneAlarm firewall should work with WinMX, but many users have reported severe processor usage when running the two programs together. It would seem that this firewall is not designed to cope with the very high level of Internet traffic that is generated by a file-sharing network of this kind.

No cable or DSL broadband connection (that is naturally always connected to the Internet) should be left without firewall protection. The best remedy is to use an inexpensive cable/DSL router that has a built-in firewall. See the Networking page on this site for some good examples, the cost of which can be as low as £40.

To configure such a router merely involves running its setup utility, which will bring up a webpage containing the settings. You will have to add the same rules to open the ports listed above for TCP port 6699, and UDP port 6257.

Troubleshooting system lock-up problems

The vast majority of complete system lock-ups are hardware related, but may also be caused by software problems.

The main causes of hardware-related lock-ups are heating problems and faulty power supply units.

To troubleshoot complete lock-ups, start by opening the case, removing devices - the heatsink and fan unit and processor, RAM modules, adapter cards, etc. - and re-seating them. This often solves problems caused by the expansion of interfaces when the system warms up. The cool device doesn't make proper contact with its interface.

Note well that you should always earth yourself before touching electronic components. Click here! to go to information on this site on how to discharge yourself of static electricity, which is harmless to you but can be fatal to electronic components.

Cases are opened in various ways. The most common are by removing screws at the back of the case and sliding the cover backwards and off, or by holding the bottom of the front of the case and pulling the whole front fitting off, and then removing one or more screws in order to slide off the side panels.

Cheap or faked components

Many too many computers are assembled using cheap or badly made components - motherboards that don't carry their manufacturer's name - cheap power supply units - and RAM modules marked with the names of unknown manufacturers. Because the process of manufacture involves very expensive equipment, the RAM chips used to construct RAM modules are produced by only a few companies, and they all mark their chips. Thus, when chips with unknown trade marks are encountered, they must have been remarked. Why? - Probably because they are inferior chips that were intended for non-computer use. RAM has to provide 100 percent error-free performance, otherwise it will be a source of all sorts of system problems.

A good way to discover the well-known RAM chip manufacturers would be to enter the term "RAM manufacturers" in the Google search box at the top of this page. If the name on the chips on your RAM modules doesn't appear in the list of links, enter it within double quotation marks and see what links are provided. Otherwise make enquiries in newsgroups such as alt.comp.hardware.pc-homebuilt.

If you have remarked RAM modules, buy replacements from a manufacturer such as Crucial.

You can also test RAM modules with diagnostic programs. Here are two free programs that work from floppy disks by using DOS. -

Free RAM Diagnostics Software

Microsoft Windows Memory Diagnostic tool - http://oca.microsoft.com/en/windiag.asp

Memtest-86 - This is the best all-round memory testing utility I have come across -

http://www.memtest86.com./ or http://www.memtest.org/

Overheating issues

Due to the very high frequencies they operate at, most Intel and AMD motherboards now have temperature-monitoring capabilities.

If the motherboard doesn't come supplied with monitoring software, look in the BIOS setup program. There is usually a Hardware Monitor page that reports the processor's (CPU's) temperature, voltages, and fan speeds, etc. These are not always 100% accurate. For instance, when you reflash the BIOS file, it is not uncommon to notice a large difference in the reported temperatures. All the same, they are accurate enough to show if the temperature is getting too hot. Most processors can operate properly running at around 60 degrees Celsius, but any higher temperatures should be investigated. In any case, you will be able to find out what the operating temperature range is for a particular processor from Intel's or AMD's websites. If the BIOS is capable of showing temperatures, then the motherboard will usually be able to support temperature-monitoring software such as the Motherboard Monitor (MBM), which runs under Windows. - Use the Google search box at the top of this page to locate download sites.

You should be careful when adding extra fans to the system, because some systems have been found to be overheating because of the arrangement of fans blow air in opposite directions, thereby leaving hot spots. Most power supply units extract hot air from the back of the case, so, to function properly - to draw cool air into the system and pass it over the components - a case fan would have to be positioned at ventilation holes in the bottom area in the front of the case. If another case fan were installed at the back of the case that sucked air out, it would usually be situated in the middle of the back of the case, and the cool air drawn into the case would be sucked out before it could pass over the processor. Consequently, hot air will build up, thereby rendering the fan over the processor ineffective, and result in an overheated processor that may then cause the system to reboot unexpectedly, or lock-up.

A first-class processor cooling unit is essential.

The best manufacturers are CoolerMaster, Thermaltake, and GlobalWin. You should beware of being offered fake units. Buy from a well-known vendor, or better still, purchase a retail boxed processor that will come with an approved cooling unit and instructions on how to install both, which an OEM version will be lacking.

Power supply units also vary widely in quality. A cheap brand with a 350W capacity can easily have a lower reliable output than a unit with a 250W capacity made by a famous brand name. Therefore, only power supply units that have been approved by the processor's manufacturer should be used - unless you have good reasons to use a non-approved unit.

Other hardware causes of system lock-ups

A fancy mouse can be the cause of system lock-ups. Usually it is something like a USB optical mouse. For some reason, USB mice cause far more problems of this kind than PS/2 mice. If you are using such a mouse, try using a bog standard PS/2 mouse instead, or try using different drivers for the fancy mouse, such as the Microsoft Intellimouse 4 drivers, which have an excellent reputation. Moreover, USB mice usually come with PS/2 conversion plugs, so try using the mouse in PS/2 mode.

Microsoft tests all of its drivers thoroughly in its labs on all sorts of systems, so they are often better than the drivers provided by the manufacturers of the hardware.

While experimenting with mouse drivers, as a precaution, you should enable the feature under Accessibility in Control Panel => Windows Setup that allows the numeric keyboard to be used to make the mouse cursor work.

Software causes of system lock-ups

The easiest way to find out if software is to blame for complete system lock-ups is to boot into Safe Mode. In Windows 98, Me, and XP, you boot into Safe Mode by pressing the F8 key just before Windows starts to load at start-up. A boot menu comes up that has several boot options, one of which is Safe Mode. In this mode Windows operates using only the basic DOS compatibility-mode device drivers that all hardware can use. Many utilities such as Microsoft's Windows Defender, Spybot Search & Destroy, Ad-Aware, and most virus scanners, such as AVG, can be run in Safe Mode. If you can run one or more of them for a long time without the system locking up, then the lock-ups are almost certainly caused by a hardware problem.

Another good way to determine if software is to blame for complete system lock-ups is to reinstall Windows in a different folder than its default Windows folder. You do this by creating a new folder using Start => Programs => Windows Explorer. Depending on the version of Windows, name the folder something like Win98, WinXP, etc. Then place the Windows CD in in the CD-ROM drive, and reinstall Windows to that folder. When you have the completely new installation of Windows up and running, you will soon find out if the lock-ups are still happening. If they are, then the problem is almost certainly hardware-related, because the new installation of Windows has no extra software to manage. If the lock-ups stop occurring, then it is almost certainly a software problem, and you can press the F8 key at start-up until the boot menu shows, choose the Command prompt only option, and delete the Win98 folder with the command del c:\Win98. Windows will then revert to booting from the Windows folder of the previous installation, which will still be there.

The following information has to do with the software causes of the problem.

Drivers and patches

If you have a GeForce video card that uses an nVidia chipset, but was manufactured by another company, download the Detonator drivers directly from nVidia's website rather than use the drivers supplied by the card's manufacturer. nVidia provides its chips to many manufacturers of video cards. The nVidia drivers tend to offer much better performance and reliability.

An don't forget to install the latest version of DirectX whenever you update the video card's drivers.

MS DirectX download page - http://www.microsoft.com/windows/directx

There may also be new IDE busmaster drivers and/or software patches that fix specific problems made available from the motherboard's website, or from the motherboard-chipset manufacturer's website. For instance the motherboard might have been made by Asus and the chipset on the motherboard made by VIA. If adding a .com in front of the manufacturer's name to access the website fails to work (e.g., asus.com), look up the website by entering the manufacturer's name in the Google search box at the top of this page.

A start-up program or an application is the culprit

Although hardware issues are responsible for the majority of complete system lock-ups, start-up programs that load with Windows, and that run in the background, are sometimes responsible.

You can use the Windows 98 System Configuration Utility (enter msconfig in the Start => Run box => and click the Startup tab) to troubleshoot these by disabling them all at once, and then re-enabling them one at a time to reveal the culprit, or you can disable them one at a time to do likewise, or you can use third-party utilities such the Startup Control Panel to research/disable each start-up program.

Press the F8 or Control key at start-up to bring up the boot menu, and choose to boot with logging. This produces a bootlog.txt file that you can locate with Find.

Using bootlog.txt as the search term for a search in the Google search box at the top of this page should lead you to articles on it and free utilities that can analyse the file.

Reflash the BIOS

If you have investigated every possible hardware and software cause of system lock-ups without success, then, as a last resort, try reflashing the BIOS setup program with the latest BIOS file, downloaded from the motherboard's website. This can render the computer unusable if it goes wrong, so make sure that you follow the instructions that are provided precisely.

How to repair the System Restore feature in Windows XP

There are several reasons why the System Restore option won't appear in Windows XP.

When you open System in the Control Panel, the only options available are General => Network Identification => Hardware => User Profile => Advanced. There is no mention of System Restore. This could be because you have logged on as a guest user, or limits have been placed on your administrative rights as a user.

You can tell if you have administrative rights by clicking the User Accounts in the Control Panel. If you are an Administrator, you will have access to the User Accounts and be able to change the rights of the other listed users. But if you see a message saying that you need to be an Administrator, you have to log on by entering the Administrator's password at start-up. You will have had the chance to register as the Administrator when Windows XP was installed. Otherwise, the only way to log on as an Administrator is to obtain the log-on password from the person who has administrative rights.

A virus such as the Blaster worm also has the ability to prevent System Restore from working. If you see the following cryptic message when you attempt to open System, there is an excellent chance that the system has been infected with the Blaster worm:

"Rundll32.exe Entry Point Not Found. The procedure entry point RemoteAssistancePrepareSystemRestore could not be located in the dynamic link library WINSTA.dll."

There is information on Microsoft's site on how to deal with the Blaster worm. You can also look up this worm at sites such as Trend's at http://www.antivirus.com.

Another reason why the System Restore tab can go missing is if some system files somehow go missing or become corrupt. Luckily, there is a way to restore the missing or corrupt files.

1. - In the Tools menu in My Computer, choose Folder Options on the View tab, place a checkmark in the Hide extensions for known file types option, and click OK.

2. - From the Start menu, click Run, and in the Open box enter %windir%\inf.

3. - You should see plenty of files. Scroll down the list until you come to one called sr.inf. Right click on this file's entry, and then click Install from the list of options. Windows XP will ask for its CD to be inserted into the CD-ROM drive, and all you have to do is follow the steps and the System Restore feature will be restored.

PC Buyer Beware! Copyright © Eric Legge 2004-2010. All rights reserved.