Networks

Ask something
Question Locked

OK, now it's my turn for needing help........

0 helpful
129 replies

by thumbsup2

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi all,

I've got a doozy of a problem that I'm hoping someone can help me solve so I can avoid a trip to the other end of the state (8 hour drive, one way).

The computer involved is stuck in an endless reboot cycle. I don't think it's hardware related, but can't confirm that just yet. Here's what happened. Please bear with me, it's a long story. ;)

I use a program called GoToAssist Express to remote into some of our field offices and I've never had any problems with it. The program allows me to send a "Reboot" or "Reboot to Safe Mode With Networking" signal to the computer on the other end and, after rebooting, it automatically reconnects that computer back to my remote session. I simply log back into the remote computer as if I was sitting right there. No intervention on the other end is ever required unless I need them to put a CD in the drive.

Yesterday, using GTAX, I had remotely connected to this particular computer, uninstalled some stuff they weren't supposed to be running (MSN and Google Toolbars), ran CCleaner to clean it up, rebooted it, logged in again, installed our GIS software, rebooted again, tried to configure the license manager on the GIS software and failed. This is not the problem though. I ran out of time in the day to finish the rest of what I needed to do, so I disconnected the remote session and went home.

Today, I started another remote session with this computer and tried a few things, including remotely rebooting the computer, in an attempt to get the GIS software to connect to our license server, but was again unsuccessful. Since we've had problems with this particular software before and it's always related to the order things have gotten installed in, I decided to uninstall all of it as well as uninstall Office, reboot, clean the registry (CCleaner), reboot and start the installation process all over again. Here's where the problem really begins, so bear with me. I'm almost there.

I received an error when trying to uninstall the GIS software (unable to uninstall, call the vendor? yuck!), so I was going to reboot to Safe Mode and try the uninstall from there. Using GTAX, I sent the command to "Reboot to Safe Mode with Networking". My screen showed the remote computer shutting down to begin the reboot cycle. As usual, after the remote computer begins the reboot cycle my screen simply showed that it was waiting for the remote computer to reconnect. However, the process took longer than it normally does with no response from the remote computer, so I called the field office to ask what she saw on the screen. She said it showed the typical F8 menu where you select Safe Mode or Normal boot, etc?, but it did not display all of the options which are normally present on that screen (abbreviated menu) and it had a timer counting down. Before she could read me all of the choices and select one of them, the timer expired and it rebooted again, coming up with the same screen. She said it had been doing this several times before I called her.

We let it do this one more time, then I asked her to select "Safe Mode With Networking" and press the enter key. It simply rebooted and came back to the same screen with minimum options. So, the next time it rebooted from the timer, I had her press the F8 key during boot. This time, the computer displayed the entire list of options that it normally shows and had no timer running. Good! We're making progress, right? I had her select Safe Mode With Networking one more time and press enter.
Now, normally one would see a list of OS's to boot into and if there's just one OS, that's all it displays. You simply press enter to continue with the boot. Her computer only has one OS installed, so I would have expected it to say "Windows XP Professional" and waited for her to press enter. This time, it said "GoToAssist Express" and waited. There were no other options to select. I told her to press enter and see where it goes. Well, guess what. After she pressed enter to accept the only option there was to select, it rebooted right back to the smaller screen with the timer running. We went through this process over and over again, trying different options including Reboot to Last Known Good Configuration and even Safe Mode with Command Prompt. Each time, it rebooted and came up with the abbreviated menu and timer. If we went through it using F8 to boot, the "GoToAssist Express" instead of "Windows XP Professional" was eventually displayed and each time, pressing enter simply rebooted the computer back to the abbreviated boot menu with a timer running. I also had her turn the power completely off, disconnect the power cord, disconnect the 2nd monitor, disconnect the network cable, disconnect all peripherals (printer, scanner, etc?) and try booting up that way using all of the various options. No luck.

Thinking that GTAX had gotten itself stuck in a loop and also knowing that every programmer worth a hoot builds a backdoor in to and out of their software (just in case of endless loops), I called the GTAX Tech Support and explained what was happening, hoping they could give me a key combination which would bypass the GTAX reconnection sequence. In a 3-way conference call, their Tech Support had the gal at the other end try all of the same things I had already tried and they were stumped by what was happening. Tech Support said it was impossible and called in one of the Software Engineers who took her through all of these things again. No luck.

The GTAX Tech Support left the call telling me there had to be a hardware problem with the machine because their software couldn't possibly be causing this endless reboot cycle, that it simply wasn't possible given the fact that we had physically turned off the computer and unplugged the network cable thereby terminating the remote session. Yeah, well one would THINK that was what should happen, but the problem still persists. It's stuck in a loop. The computer is trying to reconnect to a remote session which has been terminated and it's not going to do anything at all until it can do what it is supposed to do.

Oh, and did I tell you that, despite what they said, GTAX does in fact allow a session to remain in tact even when the network cable is disconnected, the lid on a laptop is closed and it's put into hibernation and unplugged (although on battery), transported into a different room, plugged back into power and network, opened the lid and logged back in? Yeah! The session doesn't terminate as long as you do it fast enough. I do it every Monday morning for the boss! :-& And yes, I had the user today turn off the computer, unplug it and wait 3 hours, then try it again. No luck.

So, before I make the trip tomorrow, does any one have any ideas how to reset the boot sequence back to normal so this silly thing doesn't try to boot back into a non-existent remote session of GTAX? Remember, I have to talk her through it over the phone AND?. this is the kicker?. she doesn't have a normal WinXP CD to boot into so we can try to use the console. The OEM CD's that come with this particular brand of computers can only be used to wipe the drive and re-image it. There are warnings all over the CD not to use them unless you intend to wipe/re-image. I had to learn the hard way, not to ignore those instructions! :(

129 replies

by the scummy one

have you tried recovery console and a system restore or a boot.ini change?

Also, are you using the same system and does it have the same IP Address (if the SW works from IP). Maybe it is rebooting due to not finding the right address (just a stupid thought).

I will finish reading in a few minutes

by the scummy one

However, if you have an NTFS write boot disk that she can copy and use, I am pretty sure that the boot.ini can be changed (likely the program creates a boot.old from the boot,ini file and puts in a new boot.ini for the app to run). If you can get her into the file system and have her copy a boot.ini file or put the old one back, it may save a long trip.

by the scummy one

add the recovery console to the systems that you support like this remotely.

by thumbsup2

Yeah, wish I had thought of that the last time I made the rounds to all the field offices! ;(

by thumbsup2

The thought of the software creating a a boot.old hadn't even crossed my mind. We can only hope that's what it does. If I could just get her to a command prompt, we should be able to get it back up and running.

First thing tomorrow, I'll see if I can walk her through getting some sort of boot disk created which will allow her to get to a command prompt, even if we have to use another computer and download Linux Live to 'Get 'er Dun! ;)

She's not going to have the slightest clue what to do, so I'll have to walk her through every step of the way. I just hope I can get it all done in an hour or I'll be driving through the last mountain pass tomorrow night and it's currently snowing up there. :(

by the scummy one

you can copy data from a drive, and fix the partition -- but it does not have NTFS write capabilities.
Also, if it is NTFS, a DOS boot disk will not work either, unless you have an NTFS Write DOS disk.

I am glad to have offered at least a little help :)

by the scummy one

does the helpdesk have a process for returning the boot.ini file, maybe a built in command for the SW in case of boot problems that can change this?

by thumbsup2

I asked if they had a way to bypass this type of boot (backdoor), but they said they did not. Of course, they also said they had never encountered any such problems, that it was impossible and couldn't possibly be related to their SW. I informed them that I believed it was indeed related to their SW or it wouldn't be stuck asking about GoToAssist during the boot cycle. I then asked for that 'feature' to be added, but I'm afraid my request fell on deaf ears. :-&

by seanferd

I opened, I'd expect an obvious GTAX reference that might be deleted, or the /safeboot switch could be removed if present.

Replacing with a known good copy might be easier.

by seanferd

I've used several different boot CDs to paly with an NTFS volume. If they have Midnight Commander or similar, and NTFS4DOS or similar, it'll work. I thought I've written to NTFS from the older Knoppix (5.1.1), but any CD that gives you the choice to boot to a * Commander file manager should work.

I'll check.

by thumbsup2

UBCD, among others, will be going with me.

I was just hoping to be able to find a way to avoid the trip this late in the week. I won't have much time in the morning to walk her through some pretty complicated tasks. You and I know what we're looking at and for, but she's hard pressed to learn how to get into OWA with the browser, if you get my drift! ;)

by seanferd

I was thinking of posting a series of screenshots to photobucket as a walkthrough.

I think your're covered with the UBCD, and if you are going anyway - oh, well. Sorry you have to make the trip. Take care.

The Knoppix I used is
KNOPPIX_V5.1.1CD-2007-01-04-EN.iso
I'd guess the newer versions would support writing to NTFS, but I've not used them. I should have known positively that the above version did, as I had it write a small page file to my C: drive. (Duh. Looked right at it when I looked at the boot.ini.)

ftp://csociety-ftp.ecn.purdue.edu/pub/knoppix/
ftp://csociety-ftp.ecn.purdue.edu/pub/knoppix/KNOPPIX_V5.1.1CD-2007-01-04-EN.iso

It automounts all drives and shows them on the desktop, so if you copy a boot.ini to flash or floppy, it will be right there. The only thing to check is that the HDD is writable by right-clicking for properties, ensure Owner has read-write, and on the next tab, that read-only is unchecked.

Edit: Oh, and good luck. Drive carefully, lights on for safety, and all that.

by oh smeg

Not exactly the same as the user was attempting to Ghost the HDD and had restarted with Marking the HDD.

The Boot.INI File was deleted and replaced with a partial of the Ghost which gave you the option to restart Ghost or restart from the HDD but when either choice was selected the system restarted and went back to the same menu.

There I had to copy the Boot INI File from an Identical NB to this with the use of Knoppix to get past the Ghost Boot Fiasco but even then the Partition Tables where so messed up that it was just easier to rebuild the system from scratch.

Hopefully things will not be that bad for you and you will get by with just reestablishing the Boot INI File but just keep that in mind when you begin looking at the Root of the HDD.

Not much help I know but it may be faster to get the NB shipped overnight to you rebuild it as required and ship it back if that is possible. After all we don't want more women drivers on the road than absolutely necessary do we? :D

But as it is so close to the end of the week it just may be better to get it sent to you instead of you going to it. After all by the time you have eventually finished with it in a Worst Case Scenario it will be in the weekend and your Traveling & Accommodation Costs will be very close to the cost of a new NB. Not to mention any Overtime that should be claimed.

Sorry I wasn't here earlier. ;)

Also if you have to go there don't forget to take a suitable USB Caddy Lead to mount this drive on if you have to recover any data off it which you should do before you begining messing with it. Probably would also be a good idea to take another HDD loaded for this NB Model as well and just swap drives don't try to mess with it as speed will be the overriding thing here.

Col

by thumbsup2

Glad to know I haven't found a new problem. At least one other person has experienced it! ;) Usually, I seem to find those 'problems' that nobody has ever heard of! :(

I'll leave it up to the Bosses (hers and mine) to see if I travel or if we ship it. If she's got a mission critical project that needs to be done by the end of the month, I'll be hitting the road. Even overnight takes 2 days where we're at. But, it's certainly cheaper than the $450 I expect the trip to cost them.

If I go, I'll be taking lots of stuff with me, including an identical box for spare parts just in case it IS hardware related. In fact, this particular box has the next serial number, so it was made the same day. It was in use up till a month ago when it was replaced as part of the normal replacement cycle and didn't have any problems when I took it out of service. All I need to do is reset it for a new user and get rid of the old user's 'stuff'. And, I'll also take an extra HDD off of a 3rd system which is already imaged to company spec, although done months ago and will need a bit of updating. I wish I had a USB Caddy, but the PTB's wouldn't buy me one last time I requested it. :( Perhaps NOW would be a good time to request it again! ;) I will, however, take extra SATA power adapters and data cables, so I should be able to just drop it in as long as the PS can handle the extra drive. Some of our older computers couldn't spin up the 2nd drive using these power adapters, so we'll see if this one can.

by oh smeg

http://www.newertech.com/products/usb2_adaptv2.php

As it is a Tool for the IT Pro you shouldn't be required to beg for one. Just depends on the Budget though I suppose. ;)

Col

by rob miners

it may not save you a trip but it may help. It might be hard to get a Boot disk made up onsite. I know that it would also take some time stepping someone through it.

The software could also be running from BootExecute. You may have to boot from an XP Boot disk to run this command as it doesn't appear to be in the Recovery Console commands.

ChkNTFS /D

run the chkntfs /d option to return the system to its normal state or edit the BootExecute value in the registry

Open regedt32 and locate HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\Boot Execute and note the value of the key.

It should be a Multi-String Value and look like this:
BootExecute REG_MULTI_SZ autocheck autochk *

http://technet.microsoft.com/en-us/sysinternals/bb897447.aspx

by seanferd

I was trying to think of what could be starting at boot, but I looked right through autochk. I was looking at the boot execute keys in Autoruns, and was trying to imagine just how the heck the GoTo stuff might change it. Everything else seems a bit late in the bootstrap to matter.

I need to muck around with actual malfunctioning machines more often. Although I have been mucking about with that PE image a bit, I need to do more reading to get into it. Did cheat and made a flash drive bootable with grub4dos, and emptied the iso into it. Fun so far.

by rob miners

autochk is based on API calls. I picked up on it when I was researching autochk. GoToeXpress is relatively new, I think that it only came out in february.

As for the malfunctioning machines try volunteering somewhere that has training rooms. I'm currently working in an environment with donated Systems. Getting paid as well. ;) Anyway I get to test the donated Systems and their BIOS dates, vary dramatically. Played with Win95 today. :D

PE is an interesting environment and there is a lot to learn. But it is extreemly handy for a Tech.

Haven't tested grub4dos I haven't even swung that far yet. :D

by thumbsup2

Another good tip. I'll watch for it as well.

You're correct. I'm afraid stepping a novice through some of this stuff will be beyond their capabilities even IF they were capable of following instructions to the letter. Sometimes, you just gotta see it yourself because they can't describe what they're seeing accurately.

by ic-it

to start the Recovery Console, then a quick Fixboot and then a Fixmbr should do the trick.

by rob miners

been there and done that. Users do vary dramatically. I would be interested in having a look at the boot.ini if you get a chance to copy it. :D

by seanferd

since I already did it:
http://i231.photobucket.com/albums/ee50/NGC224isM31/001.png
http://i231.photobucket.com/albums/ee50/NGC224isM31/002.png
http://i231.photobucket.com/albums/ee50/NGC224isM31/003.png
http://i231.photobucket.com/albums/ee50/NGC224isM31/004.png
http://i231.photobucket.com/albums/ee50/NGC224isM31/005.png
http://i231.photobucket.com/albums/ee50/NGC224isM31/006.png
http://i231.photobucket.com/albums/ee50/NGC224isM31/007.png
http://i231.photobucket.com/albums/ee50/NGC224isM31/008.png
http://i231.photobucket.com/albums/ee50/NGC224isM31/009.png

by thumbsup2

... However, I helped BETA test it for 6 months prior to the official release. :D

Of course, nothing of this nature ever surfaced during testing! :-& Being a CITRIX product, I would have expected a work-around being built in... but NO! :(

by the scummy one

I would think that they would have a small program for just this sorta thing. I mean erally, how hard would it be to write

ren boot.ini boot.ol_
ren boot.old boot.ini

LOL

by the scummy one

I coulda swore that linux could not write to ntfs without a 3rd party tool. But once you mentioned changing permissions in knoppix -- a bell started ringing in my head and it all started coming back -- lol

by shasca

What do you think was causing the original problem with GIS not being able to find the License manager? There seems to be networking issues in play here too??

Is this a common problem with your License Manager?

This is the part of your problem I find intriguing.

by thumbsup2

... but, we suspect a bad install.

HQ had copied the installation DVD and mailed it out to several of us. For some reason, I've never been able to get the DVD itself to install smoothly when all I've got to use is a copied one, even on previous versions. I personally suspect the DVD copier at HQ is flaky, but I can't convince them of that. They claim they've never had any problems with the copies. Of course, they forget the time we were all sent to HQ with our own computers and their DVD install of the classroom files wouldn't work, they had to revert to a network install while we were there. Convenient memories, don't you think? ;)

Anyway, I ended up requesting them to send me a 2-CD set of the install disks instead of that silly DVD, uninstall any of the attempted DVD installs and put it all back in again using the CD set. I now just avoid using the DVD and everything works great.

Even though I've never seen the License Manager bomb like it has on this latest computer, the DVD install has never created the same problem twice in a row for me. There's always some sort of problem, but never the same one, different error messages each time. So, it's entirely possible that it's just a bad DVD install down there once again, since that's what she used to do the original attempt before calling me. The error she gets when trying to connect is that the License Manager is an older version. HQ had mailed a new set of CD's to the field office, which arrived late Monday afternoon and, of course, this is where I was left. Neither her or I could uninstall the bad install in normal mode and I had remoted in (two days in a row) and was headed for Safe Mode/Administrator when it all went South on me. :-&

by the scummy one

something that was uninstalled, that the program needed (like a shared .dll) or a dependancy.

by shasca

I assume you see a complete rebuild in your future!! Thats way too many issues on one Pc to just fix.

I just created ten password protected CD copies of Office 2007. We have remotely located Fish Hatcheries (boonies). We decided we would just send them out a copy to let em install themselves. Just like you suspect in your case, one of the copyies was honked up and wouldn't finish the install without erroring out. So it does happen.

by rastor9

If you download and install the Windows Automate Install Kit, this will install software that will allow you to create a WinPE boot CD, that will launch a command line session where you can diagnose your NTFS drive and other hardware/software issues on this computer.

You have to make sure you follow the instructions to add the drivers for your various computers, and it isn't something you can "learn" on the fly but in prepping a recovery process for next time you could leave a copy of this disk at each of your remote sites so you can walk them through these processes for some of the basic needs.

You can also create WinPE boot images for USB Drives, Flash Keys etc...Google WinPE to start, and you might even choose to use BartPE, a third party provider that has some great additions to the product.

BartPE is not WinPE but still a very useful tool if you don't meet Microsoft's licensing requirements for WinPE, which requires you have a Microsoft Volume License installation disk and codes. Technet also has lots of hints/tools for WinPE.

by thumbsup2

I was just reading up on both last night (WinPE/BartPE) trying to decide just what would be the best tool, or combination of several, to send to the field offices to have on hand for the next time this happens. Of course, Murphy lives with me you know. No matter what I send, it'll be the wrong tool! Maybe I'll just copy my entire toolbox and send it to all 21 field offices! ;)

by the scummy one

then when needed, grant permission and let them copy burn the ISO file and ready to follow instructions.

by seanferd

Are more likely to write to NTFS. I don't remember if RH9 did, and I've been playing with most distros as VMs lately. I don't know if a lot of them come with the capability or not.

by the scummy one

I usually use another live cd (PCLOS) but I do have a knoppix cd as well (for some time now). I rarely use it though. Last time I did was several months ago, and I do recall (once you mentioned to change permissions) that I was able to write to copy something to a non booting disk with it.

Sorry for the scare T-Up2

by seanferd

I was hoping they were good enough to guide a technophobe. ;)

by seanferd

or creating or editing files: It creates a second/backup copy on the NTFS drive as well. I thought that was pretty cool.

by thumbsup2

... if they had a boot disk on site. But, they don't and none of them would have the slightest clue how to locate/build one.

I've been on the phone with my counterpart on the other side of the state. Seeing as how both of us may be without a job in a couple of months, it's time to outfit these field offices with tools they can use in an emergency, even though they would have to be walked through it every step of the way. If the budget cuts we've been warned about happen, he may be bumped and my job might get the axe. The field offices may be on their own real soon.

by thumbsup2

... although, during any uninstall I watch the shared DLL's carefully and only let it uninstall the ones in it's own folder.

... plus, this GTAX is supposed to only be an ActiveX thing which isn't supposed to leave any footprint behind when the session ends. So, if there's a DLL for it, it should be in it's own temp folder. At least I would think so.

But, I'll have a look when the machine arrives. She shipped it today instead of me making the trip. :D

by thumbsup2

... but only after I satisfy my curiosity as to what caused the GTAX thing! ;) You know, for future reference! ;)

Yep, the honked up CD's/DVD's do happen, although I can't quite figure out why it's always either me that gets the bad one or it's the office on the other side of the state that gets it. I tell ya... Murphy lives at my house! ;)

by oh smeg

Murphy not only built the house that you live in but you are sharing it with him while he adds the next extension that he is thinking about in 10 years time.

Col

by thumbsup2

Yes, it sure seems like it, especially lately! Geeze! Give me a break Murphy! ;)

by thumbsup2

The people in HQ have access to the PC Support folder on the company share. The field doesn't currently have FTP access into that folder, so we're looking at what would be the best way to share it to all... given that they're undergoing a complete server restructure/rebuild to allow VPN and we're also working on building a hosted SharePoint portal. Not sure which way they'll go yet, but I've laid it on the table for them to chew on.

---

edited to add: Some of these field offices are one-man operations, so there is no spare computer to use as a means of accessing company share/FTP. So, whatever solution we come up with will need to keep that in mind.

by thumbsup2

Whew! They let me out of making the trip. She's shipping the box to me. I'll let all of you know what I find once it gets here and I've had time to look at it a bit.

by seanferd

Yes, please do tell us what you find. I'd definitely be interested.

And if there is a temp file called at boot, I'd check through Autoruns or search the reg for a value calling the file from the temp dir.

I've never seen really good documentation on how the GoTo services actually work. Maybe time to search again.

Cheers.

by thumbsup2

... you don't seriously think they're going to tell anybody how it works, now do you? ;)

As far as I know, it's similar to a VNC except it's running through the CITRIX servers securely. I have the client installed on several of my machines. When I start a session on any one of them, it connects to their server which generates a session number. The person on the other end uses their browser and navigates to a certain web site where they enter their name and the session number I give them over the phone into a login screen, then click connect. That installs a small ActiveX on their system which allows me to have remote control. I can even reverse share so they can see my screen if I let them. I can transfer files either direction too. The best part is being able to reboot and/or log into any account on the remote computer. I can even remotely set up the machine for a new user. Once the session is terminated, it's not supposed to leave any tracks behind on their system and so far, I haven't been able to find any actual traces of it ever having been run. Of course, maybe I haven't looked deep enough yet! ;)

Another option of the program though is to install unattended access on the remote computer. Now THAT has to leave something, because it allows me to connect any time I want to without them being there to let me in. I haven't tried using that feature yet though. It might be interesting to install it somewhere and then dissect where and what it installs. ;)

by oh smeg

Good thing that you didn't need to drive all that distance for what is in all likelihood nothing more than a rebuild to get going quickly.

At least this way you can pull the HDD and play with it latter in another Box when you have time to waste.

Col

by the scummy one

Really, I was actually hoping to hear news that it got fixed without the trip! My brain went to work just for this cause, but it was wasted effort :(
I am now sad that I used what little brainpower I had left -- all for not :(

But seriously -- good to know the status, even if it wasnt what I wanted to hear

by thumbsup2

... so begging is practically an every day occurrence! ;)

Nice find though! They've come way down in price from the last time I looked for one and begged for it! So, maybe I can slip it through! :D

by oh smeg

If you are expected to do any PC Trouble Shooting and Repairs. These things pay for themselves on the first job.

But if that place is anything like one place where I worked and had to beg for every tool you'll need to hide it after you get it as Management will come down and break it then expect you to repair it because that's what you are there for to repair things that break. :^0

Anyway Lets know how you get on.

Col

by thumbsup2

Don't you know? I'm female! I'm expected to fix things with bailing wire, bubble gum and spit wads. Never TOOLS! Women don't need no stinkin' tools ya know! And, what few replacement tools I am able to purchase disappear again as soon as the guys find my hiding place! X-(

I know all about Management (and others) breaking things then expecting me to repair it! I get everything from Cell Phones to Xerox machines (which are under maintenance contracts) to the specialized electronic measurement tools the guys use in the field. I just play dumb and tell them I don't even know how to turn them on! :^0 ]:) 0:-)

Yes, budget is in the toilette. I think we're down to counting reams of paper and tearing stickies in half to double them so we can see if we can make it through the end of the budget cycle which ends June 30th. :_| ;)

by seanferd

Then I'll come back.

>>>>>>
Right. The problem with the info I read is that there is no real troubleshooting or technical information, like what reg keys may be written, if it hooks anything, or any of the down and dirty info I've come to expect even from MS. I guess you'd have to get it up and running, then spend time with a lot of different utilities just to get an idea.

by the scummy one

on the unattended access? If not ]:)

Edit, because my keyboard switched a few keys on me when I wasnt looking

by thumbsup2

... on their server. I have to log into my account to see them. :(

by the 'g-man.'

that's how it can reconnect. It is not possible to get the GTAX people to find that session and end it?

Thus when the system try's to find the session, it fails and starts normally.

by thumbsup2

Their screen showed it had indeed ended and that they could not issue an END because it was already in that status.

I logged into my account and could also see the old session start AND end times as well as the IP's involved in the session, mine and hers.

They claimed it was nothing to do with their software/activex and that the computer was not trying to reconnect.... I disagreed of course...

The computer arrived in my office just before lunch, so in about 15 minutes (when lunch is over) I'm going to attack it head on.

Wheeee!!!!!!!!! It's PLAY TIME!!!!! ;)

by thumbsup2

Geeze! I had to fix dinner when I got home. Gimme a break! A woman's work is never done! ***sigh*** ;)

(Secret Answer: It's fixed... solution to follow.)

by rob miners

is killing me. ;)

Just as an aside you could have orderd home delivery. :p

by rob miners

a womans perogative to do as they please. ;) TORMENT!

My dear old Mum used to say that patience is a virtue. It's often found in women but never found in man. :D

by the scummy one

WHAT IS THE ANSWER??? Ahh C'mon now -- did I not tell you earlier that, that, that, I used actual Brainpower on this???
That means that there is Less to go around for other things!!!

by the scummy one

since I asked, I finished at the workplace, drove home, had countless cigarettes, had dinner, watered the front lawn, started watching the back lawn die (decided not to keep it), looked over countless seedlings, zoned out a bit, AND posted on TR!!!
You couldnt get dinner ready by then???

Geez,

by thumbsup2

THE GOOD
It's back up and running, no rebuild required. :D <:o)

THE BAD
I'm absolutely positive GoToAssist Express caused the reboot loop. X-(

THE UGLY
I have no idea how or why. :_|

-----

When I got the machine on the bench, I of course tried to boot it normally to see if the problem still existed and it did. Loop central! :(

So, the first thing I did was to reboot with a WinXP Emergency Boot floppy which had been created on an identical machine. It booted immediately to the little mini-menu where it had been stuck before and the timer was running. (Uh oh!) So, I chose a normal boot and crossed my fingers. It booted to the login and then on to the desktop, bypassing the reboot loop! Yipeee!!!! <:o)

The first thing I noticed once it got booted was that the GoToAssist icon was still running in the system tray under the user's account. That meant something fired it up. So, the search began. Here's what I found, or didn't, depending on how you want to look at it.

(1) boot.ini on the box was identical to the one on the floppy. Nothing strange inside of it and I never had to replace the one on the box to fix it. There was no boot.old or any other form of a backup boot.ini on the box.

(2) ntldr and NTDETECT.COM were both identical in size and date to the ones on the floppy.

(3) Autoexec.bat and config.sys were both empty and untouched since system build.

(4) Win.ini and system.ini had nothing unusual in them.

(5) Task Manager and SysInternals Process Explorer both showed the GTAX Customer tray icon running, as expected since I could see it, but nothing else obviously related to GTAX was running. Of course, this might be due to the fact I've booted with the Emergency Boot Disk... who knows.

(6) Mousing over the tray icon itself said the session had been interupted. Right clicking it had an option to exit.

(7) Nothing in the registry under HKLM or HKCU Run or Run Once or any other form of run. However, there was a CITRIX folder and GoToAssist Express sub-folder under HKLM Software which contained several keys obviously related to a session. And, there was another group of CITRIX folders, keys and values under HKLM System ControlSet001 and ControlSet002. One of the keys in both was named something like CurrentFileRenameProcess and it's value was \??\c:\Program Files\Citrix\GoToAssist Express\gtax_winlogon.dll ... so, I looked and that dll was indeed present at the path specified and it was dated yesterday when this all began.

(8) HiJackThis didn't show anything out of the ordinary running, at least not obviously related to GTAX, except the tray icon. Again though, this may be due to having booted with the floppy.

OK, at this point I decided that I wasn't finding much, so let's see what happens if I right click the GTAX tray icon and choose exit, then reboot the machine normally without the floppy.

Guess what!!! It booted just fine! No silly mini-menu's with timers or anything else, no reboot loop, nothing out of the ordinary, and the GTAX tray icon was not there.

I went back through the entire process again, looking at everything mentioned above a second time and found pretty much the same thing, except the tray icon wasn't present. However, the registry keys that I found were all left behind and, as far as I could tell, hadn't changed from when I had booted with the floppy.

So, I'm left with a pretty hollow feeling. I never did determine why it went into the reboot cycle. The only thing I did to actually change anything while booted with the floppy was to right click the tray icon and exit GTAX. Whatever that does to tell the program/activex/whateveritis that the session had ended, did the trick.

Oh, and by the way, the GIS problem with it not connecting to the license server, which was why I originally remoted into the system in the first place, was gone too. It connected just fine from our office. In fact, absolutely everything is working as expected. I checked a few things to make sure she was keeping her system in tip-top shape and called it a day.

And, the worst thing of all is that, even though the box is ready to be shipped back tomorrow, this is going to drive me nuts until I can figure out what happened. :_|

by the scummy one

So the program didnt alter the boot files, it just ran very early (before Windows).

Then it appears that the solution for a future issue resides in just a boot disk. And it also appears that their SW was the problem!

by thumbsup2

Since even booting with the floppy presented that abreviated boot menu with very few options and a timer running... it came after the boot.ini was read off of the floppy but before Windows was started...

So, where did they hide it? :_|

I'll find it, some day though! ]:)

by rob miners

glitch? I am glad to see that it was a relatively painless repair. Mind you the leadup wouldn't have been much fun. Without a BSOD there is probably no minidump to check or for that matter event viewer. Ah well, only time will tell. ;)

by thumbsup2

Could have been any number of glitches.

I looked briefly today for dumps/logs, but only found one log in the windows/temp folder and all it contained was a session start successful entry. Perhaps that's the key. I'll look a bit more at it tomorrow when I remote back into it comparing that log before, during and after a session.

by thumbsup2

Then, of course, I had to get out of my work clothes and into... ummmm.... something 'more comfortable' ;) ... then feed the dog... and... and...

Of course... while I was typing... Survivor came on, so my attention was diverted just a bit! ;)

by the scummy one

5 days in a row -- forgot dishes.
now thanks for bringing it up dammit! :^0

And since you are in something more comfy -- turn on the webcam

by the scummy one

when it would be bad to happen.

The real question is why did it discontinue/terminate the connection, without finishing the process and closing the program and/or -- why did it send the termination signal in the first place???

by thumbsup2

Why? That would ruin the effect!

Can't you just use your imagination and 'see' a 54 year old fat woman in a flannel nightie and sloppy sheepskin slippers? :-& ;)

by seanferd

I'd check under the Winlogon entries (Autoruns makes it easy), although they may be gone now.

CurrentFileRenameProcess and it's value was \??\c:\Program Files\Citrix\GoToAssist Express\gtax_winlogon.dll

This bugs me. Quacks like a rootkit. Similar behavior to AV, but a little more invasive.

Thanks for the feedback - it was worth every bit of suspense. :)

by thumbsup2

Especially since it was left behind in both the registry and the physical file location when the system did reboot normally. But, then again, since it was left behind after exiting the tray icon and rebooting normally, wouldn't that indicate it didn't have any control?

I don't know. I think I'll run a little test on it tomorrow and remote into it again, then end the session normally. I'll then look to see what's left behind in the registry, reboot and look again.

Of course, that may be playing with fire! Murphy may come for another visit and blow this thing up again. I guess we better find out though, before I ship it back.

by thumbsup2

You go ahead and keep thinking like that! I would hate to spoil your mental image of me! ;)

by thumbsup2

I thought he got his start by sitting next to me at the age of 6, at my first violin recital, and made me forget everything including my name! ;)

by rob miners

been invoked with the Registry Key RunServicesOnce. I'm sure that's how Spybot works when it asks to be rebooted. :D

by thumbsup2

I checked RunServicesOnce under both Windows and Windows NT (you know how some things like to hide under the Windows NT folder) and both under HKLM and HKCU, but found nothing. Of course, the system had been booted once even though it was from a floppy, so the key could very well have been gone by the time I got in.

You would think though, that if it was indeed a service, it would have showed up under Task Manager, HiJackThis or SysInternals Process Explorer, althought it may have been there and just wasn't obvious to me.

In any case, I'm pretty well satisfied that whatever it was, however it got itself started, it WAS related to GTAX even though their people claim that it was impossible. ;)

by oh smeg

Without Windows running?

There may very well be a file there that has been corrupted to set the Boot Order to restart this app after a reboot. You know like run from Whatever the remote service is or the Win.ini

If there is a file there that would explain this and it wouldn't show up under Windows. ;)

Col

by seanferd

before he was actually incarnated. His Law was, anyway. But rocketsleds and fire go together like ... two things that go together really well. Analogy failure - colorful simile not found.

And yes, that is just the kind of stunt he'd pull!

http://en.wikipedia.org/wiki/Murphy%27s_law#Association_with_Murphy
has a bit on this

by oh smeg

Why or the next time that this happens. X-(

Can you recreate the situation again?

Col

by thumbsup2

Now, if I can just force it to fail again! ;)

But, I'm afraid I probably can't recreate the exact set of circumstances. When this happened, the whole system was acting flaky anyway (couldn't connect to GIS license server, couldn't uninstall a program, etc...) and now it's not acting that way. So, whatever caused the flakyness to begin with has already disappeared and unless I can cause it to get flaky in exactly the same way again, I probably won't be able to make GTAX fail again.

That's not to say that I'm not going to try though! I have an identical system sitting on the bench ready to play with. All I need is time. ;)

We know that when this happened in the field office, the GIS software install didn't quite go right (bad DVD). So, I'm going to have her mail me that DVD and try to recreate the scenario on the tester first and then remote into it and try to make it fail.

This will be a fun project to play with in my spare time! :D

by the scummy one

interfering.
Also, run a checkdisk to see if any of the programs files were in a bad cluster.

by thumbsup2

I thought I was going to be able to send the system back Friday, but that didn't happen. It's looking more and more like a rebuild is inevitable.

After unsuccessfully poking around to see if I could find the reboot loop problem then getting the GIS license manager problem solved, I decided to see if I could recreate the GoToAssist reboot loop problem. I did and I each time I did, I got out of the reboot loop using the WinXP Emergency Boot floppy, booting to the desktop and ending the GoToAssist program.

Prior to trying to recreate the reboot loop, I had booted to safe mode and run a full system sweep for virus/malware/trojans coming up clean. I had then uninstalled and reinstalled the GIS software and got that working (must have been a bad install). Then, I uninstalled the anti-virus software and installed our newer version, a process we're going through on every system anyway. I then tried to recreate the reboot loop problem and did so successfully.

Thinking that I had nailed GoToAssist for the problem, I called them and told them what I found. They had me check a few things and found nothing out of the ordinary (according to them).

So, they then asked me to reboot the system in safe mode manually. It failed, going into the reboot loop WITHOUT GoToAssist running. :(

After once again getting out of the loop and rebooting the system normally a couple of times, they asked me to use MSCONFIG to set it to reboot in safe mode. This is when we discovered what is probably at the root of the problem. I got an error saying the user account didn't have permission to change the MSCONFIG settings. OK, so we rebooted again and went into the Administrator account and tried it there. Even that account received the same error saying it didn't have permission to change the MSCONFIG settings, although it DID change them and allowed an attempt to reboot in safe mode. But, the reboot loop started all over again. I got out of it once again with the boot floppy and went back to the Administrator account and changed MSCONFIG back to normal, received the permission error (but it changed it), then rebooted without the floppy back to normal mode again.

I had other things I needed to get done, so I left it that way Friday night. Today, I'll go back to work on it. :-&

.

by the scummy one

run chkdsk, then run sfc.exe /scannow
see if any system files are bad or needing replaced.

Uninstall the app and manually remove entries in the registry, and files that may have been left behind.

reboot
try re-installing again.

I hope this helps, however, after all of this you could likely have rebuilt it a few times :0 :^0

Oh, also, does this machine run any apps or running any services that are not standard on the other systems?

by rob miners

that you have to spend on this but you could try resetting the security settings and permissions.

Solving setup errors by using the SubInACL tool to repair file and registry permissions

http://blogs.msdn.com/astebner/archive/2006/09/04/739820.aspx

How to reset security settings back to the defaults

http://support.microsoft.com/kb/313222

by seanferd

If going with Scummy's bit, check for any config files not removed by uninstall as well, which could be in multiple odd places. (You are probably doing this already, but I had to add something to "Yikes".)

Good luck.

by thumbsup2

I just looked with Windows booted. I'll check today with Knoppix and see if I can find anything. I've got to ship this thing back though, so I can't spend too much time on it.

I did look inside the Win.ini yesterday though and I looked at the date/size of the file through the command prompt. The date was way prior to this happening and the file size was identical to the one on the sister machine next to it.

by the scummy one

with special commands for it's use listed in the registry. If there is a value or string after the path/filename, this tells XP to do some custum thing when loading Win.ini or even Winlogon.

Since you have limited time before sending back, it may do you good to clone the drive for further testing.

by thumbsup2

Sorry for the late reply, but it suddenly dawned on me that I forgot to come back here and tell you guys what caused the whole mess, just in case anybody else has the same thing happen.

During my testing on the bench, I thought I could briefly see a BSOD immediately before it started the reboot loop. I couldn't be sure though, as it went by so danged fast that it could have been me blinking. Intuition told me it was there though. ;)

I tried to turn off the 'Automatically Restart' feature of System Failure in the System Properties, Advanced tab. Everything was grayed out and couldn't be changed. Not knowing exactly what had hosed the settings (I had my suspicions), the first thing I uninstalled was Office 2007 Compatability Pack because that was one of the last things added to the system. After reboot back to normal, I was indeed able to turn off the Auto Reboot option, then try a restart in Safe Mode. :D

It failed with a BSOD, as I had suspected, and halted so I could finally read the darned thing. :0 I researched the codes and found they were caused by InCD, a module installed by NERO which allows writing to rewritable media (CDRW/DVDRW). Knowing we weren't doing any kind of 'rewriting', I uninstalled InCD, then tested again.

I successfully rebooted to Safe Mode with Networking without any BSOD. I then rebooted normally and remoted into the machine with GTAX and tested. The reboot to Safe Mode worked fine. I rebooted back to normal, disconnected the remote session, reinstalled Office 2007 Compatibility Pack and rebooted. The Auto Restart feature was not grayed out like it had been before, AND I could still reboot to Safe Mode. I turned feature back on and continued to test both locally as well as remotely. Not once did it fail to restart by going into a reboot loop. I turned the feature back off and finished reinstalling everything, testing at each step, without so much as one failure.

So, it turns out that the culprit was NOT the GTAX program after all, as I had originally suspected. I don't know why Office 2007 Compatibility Pack would have anything to do with System Recovery features being grayed out because reinstalling it didn't mess with it, but uninstalling it had freed up the feature so I could change it. So, perhaps the original install was corrupt.

InCD was the actual culprit, so I've been busily uninstalling it from every system I get my hands on because none of our people use rewritable media. :D

by rob miners

I have had problems with that software before. I think from memory you have to install it seperately when you are installing and a lot of people add it just because it's there. I normally ask the clients if they are using it and when they say no it's gone. It can cause reboot/shutdown problems in XP along with a few others.

Thanks for the detailed explanation and I will have to try and remember to ask what software is installed on the System next time. Glad that you found the culprit.

Rob

by the scummy one

I dont see why the compat pak did it either, but hey, it's MS SW so who knows why much of it works (or how) :^0

by oh smeg

Since you like the detective work perhaps you would like a Domestic system that I got dropped into.

It too has something causing it to freeze that was installed after I delivered it. I've just had it running on a Live Linux for 12 hours without a problem but when I boot with Windows XP it may run for up to 20 minutes before either rebooting to freezing.

And no I don't install InCD either. To me it's the most useless piece of software out there. ;)

Not sure what was going on with the Office Compatibility Pack though as that is [b]WEIRD[/b] perhaps you would like to speak to M$ on this one. But as Office 2003 is now on Extended Support somehow I don't think that M$ will be overly interested. ;)

Col

by seanferd

InCD? LOL is right.

Compatability Pack? What? Huh? Something seriously wrong there.

And yes, I'm glad to see that you've sussed it all out. This may be an interesting thing to remember for future reference...

by rob miners

used to cause problems way back in Win98 and it hasn't improved. :D