Mysterious Computer shutdown

**Gordon Moore** · 13 February 2003, 15:11 Thursday

Check your event viewer to find out the time of the unexpected shutdown. Search your logs as to what might have been running at the time. You definately Blue-Screened but it must be set to jsut restart rather than sit there with the debug info.

Do you have a virus scan set to run nightly? We found at work that if we are running a software raid system (RAID 5 in this case) Norton will periodically Blue-Screen the OS, puke, die, and then restart.

This is Norton Corporate Ed mind you but it's the same engine.

Sounds like you definitely need to reload Norton. If you are leery as to whether you have a virus or not try one of the online scanners mentioned in the Freeware post...I recommend Panda.

Worse comes to worse, fire an email off to Symantec Support....give them all the details and see what they come back with.

**P-Dub** · 13 February 2003, 15:46 Thursday

How should I reconfig to debug instead of restart?

I don't have the virus scan set to nightly, just weekly, and that wasn't even the day of the scheduled scan.

Oh, when you say search my logs, is that throught the event viewer? When I look at that I see the "System Log" and the last error was on Feb 5, 03 and it said:

Source: Service control manager
Event ID: 7000
Time 10:43 am
Description: The NAVEX15 service failed to start due to the following error: The specified driver is invalid.

Now the funny thing is the computer crashed sometime between Feb 11 and early Feb 12.

Okay I'll be reloading Norton.

Paul

There are three kinds of people in this world; those that can count, and those that can't.

**Gordon Moore** · 13 February 2003, 15:56 Thursday

Hey Paul,

Don't worry about the debug message...staring at a bluescreen is annoying at best...it does alert you that something went wrong but you don't get much value out of it....well... sometimes you do but the info is usually recorded as an event and the debug info can be dumped to a file. I wouldn't get hung up on it or bother with it.

I'll bet that a reload of Norton will fix things. It was probably chugging away trying to go on with the corrupted driver and then finally gave up and brought everything down with it.

**Gordon Moore** · 13 February 2003, 16:00 Thursday

From Symantec:
Situation:
After running LiveUpdate and then restarting your computer, you see the error message "C:\progra~\common ~\symant~\virsd~1\20011026.021\navex15.sys device driver could not load...." The numbered folder may be different. The computer continues to start, but the Norton AntiVirus (NAV) Auto-Protect icon indicates that Auto-Protect is disabled, and the computer runs very slowly.

Solution:
This problem has been reported to Symantec Technical Support, but we have not been able to reproduce the problem. The cause is unknown, and there is no solution at this time. We will continue to track this problem, and this document will be updated if new information or a solution is found.

In some cases, the following instructions have fixed the problem:

1. Restart the computer in Safe mode by following the instructions in the document How to start Windows 2000 in Safe mode.
2. Start NAV. If NAV was installed as a part of Norton SystemWorks (NSW), then start NSW, and then click Norton AntiVirus.
3. Click Options.
4. Click Auto-Protect.
5. Uncheck "Start Auto-Protect when Windows starts."
6. Click OK, and then close NAV.
7. Restart the computer in Normal mode.
8. Update the virus definitions by following the instructions in the document How to update virus definition files using the Intelligent Updater.
9. Repeat steps 2 through 4, but this time check "Start Auto-Protect when Windows starts."
10. Click OK, and then close NAV.
11. Restart computer.

AND

Error: "Windows unable to load device driver" when starting Windows 2000

Situation:
You are running Norton AntiVirus 2000 (NAV) under Windows 2000. When you start Windows, after running LiveUpdate, you see the error message "Windows unable to load device driver." A path and file name is shown; the file is either Navex15.sys or Naveng.sys. Your only option is to click OK.

When Windows starts, the NAV Auto-Protect icon in the system tray has a red X over it, which indicates that it is disabled. You cannot reenable it.

Solution:
Symantec is aware of the problem and is investigating it. We suspect that a Windows permissions setting is restricting the file updates. One possible cause is that Service Pack 1 was installed while someone was logged on other than the local computer's administrator. Another possible cause is that the permissions for the Symantec Shared folder (C:\Program Files\Common Files\Symantec Shared) are not set to Full Control for the Everyone group. Please see your network administrator for help in accessing and changing any of these settings.

How to solve the problem

To obtain the information needed to fix the problem:

1. Restart Windows and allow the error message to appear.
2. Write down the path and file name of the file that failed to load. It should reside in a subfolder of the VirusDefs folder; the VirusDefs folder contains subfolders that contain current, and in most cases, past virus definitions. You will see the short file name path, for example:

C:\Progra~1\Common~1\Symant~1\VirusD~1\20000817.01 8\Navex15.sys

In this example, the short file name path refers to the Navex15.sys file that is located in the virus definitions subfolder, \20000817.018, that is itself contained in the C:\Program Files\Common Files\Symantec Shared\VirusDefs folder.
3. Go on to the next section.

To ensure that the referenced folder actually exists, and that it is the most recent one:
1. Start Windows Explorer.
2. Navigate to and open the C:\Program Files\Common Files\Symantec Shared\VirusDefs folder. You will see numbered subfolders, for example, \20000817.018. Ignore the named subfolders, such as BinHub, Incoming, and TextHub.

NOTE: These numbered subfolders are named with the virus definition date, and are in the format YYYYMMDD.xxx, where Y=year, M=month, and D=day. xxx is simply a reference number. For example, the folder 20000817.018 refers to virus definitions dated August 17, 2000.

3. Look for the numbered folder whose name you wrote down in the previous section.
If the folder does not exist, then it may have been moved or deleted. In most cases, the easiest way to recover from this is to uninstall NAV, delete the \VirusDefs folder, and then reinstall NAV:
1. Click Start, point to Programs, point to Norton AntiVirus, and then click Uninstall Norton AntiVirus.
2. Step through the Uninstall wizard, clicking Yes or Yes to all when prompted.
3. Restart the computer.
4. Open Windows Explorer, and then delete the C:\Program Files\Common Files\Symantec Shared\VirusDefs folder; click Yes to confirm
5. Make sure that you have Windows permissions set correctly as mentioned at the beginning of this document.
6. Reinstall NAV, and then run LiveUpdate.
If the Navex15.sys or Naveng.sys file that was reported as missing is pointing to an older definitions folder, then it is likely that the Usage.dat file was not updated, or that a registry key is not pointing to the correct location. This would be the case, for example, if the error message pointed to the folder \20000817.018 but the \VirusDefs folder also contains a folder that is dated later than \20000817.018, such as \20000828.032.

Check the registry keys
CAUTION: We strongly recommend that you back up the system registry before making any changes to it. Incorrect changes to the registry may result in permanent data loss or corrupted files. Please make sure that you modify only the keys specified. For information on how to save registry keys, when you open the Registry Editor, click the Help menu, and then click Contents. On the Index tab, type saving and then open the "saving to files" help item.

We also recommend that you update your Emergency Repair Disk (ERD). See your Windows documentation for information on how to do this.

1. Click Start, and then click Run.
2. Type regedt32 and then click OK.
3. Click the title bar of the HKEY_LOCAL_MACHINE on Local Machine window to bring it to the foreground, and then maximize it.
4. Double-click the SYSTEM folder to display its subkeys.
5. Double-click CurrentControlSet.
6. Double-click Services.
7. Click the NAVENG folder to select it.
8. In the right pane, locate the line that begins with ImagePath. Make sure that the line points to the most recent definitions folder. For example, if ImagePath points to C:\Progra~1\Common~1\Symant~1\VirusD~1\20000817.01 8\Naveng.sys, then ensure that \20000817.018 is the most recently dated folder, as noted previously.
If the folder is the most recent, then go on to step 9.
If it is not the most recent, then you need to edit the ImagePath value:
1. Double-click the ImagePath value.
2. Click anywhere in the String Editor box to deselect the text.
3. Replace the incorrect folder with the most recent one as noted previously. For example, change:

C:\Progra~1\Common~1\Symant~1\VirusD~1\20000817.01 8\Naveng.sys

to

C:\Progra~1\Common~1\Symant~1\VirusD~1\20000828.03 2\Naveng.sys

9. In the left pane, click the NAVEX15 folder to select it.
10. In the right pane, locate the line that begins with ImagePath. Make sure that the line points to the most recent definitions folder. For example, if ImagePath points to C:\Progra~1\Common~1\Symant~1\VirusD~1\20000817.01 8\Navex15.sys, then ensure that \20000817.018 is the most recently dated folder, as noted previously.
If the folder is the most recent, go on to step 11.
If it is not the most recent, such as--for example, the most recent definition folder \20000828.032--you need to edit the ImagePath value:
1. Double-click the ImagePath value.
2. Click anywhere in the String Editor box to deselect the text.
3. Replace the incorrect folder with the most recent one as noted previously. Using the example previously given, you would change:

C:\Progra~1\Common~1\Symant~1\VirusD~1\20000817.01 8\Navex15.sys

to

C:\Progra~1\Common~1\Symant~1\VirusD~1\20000828.03 2\Navex15.sys

11. When you verify that these keys correctly reflect the location of the most current NavEng.Sys and NavEx15.Sys files, then exit the Registry Editor, and go on to the next section.

To make sure that the file Usage.dat is pointing to the correct location:
1. Click Start, and then click Run. The Run dialog box appears.
2. Type--or copy and paste--the following text in the Run box:

Notepad "C:\Program Files\Common Files\Symantec Shared\VirusDefs\Usage.dat"

3. Click OK. The text file Usage.dat will open in Notepad. The text will look similar to the following:

[20000817.018]
NAVNT_50_NAVW=1

[20000828.032]
NAVNT_50_AP1=1
NAVNT_50_AP2=1
NAV_50_QUAR=1

4. The numbers in brackets correspond to the numbered virus definition folders. Note under which of the folders the lines NAVNT_50_AP1=1 and NAVNT_50_AP2=1 (which utilize the NavEng.Sys and NavEx15.Sys files) are located. They should be under the most recent folder, as discussed previously. The example shown in step 3 is what they should look like, with the two lines located under the most recent folder, in this example, [20000828.032]. (You can ignore the other file entries.)
If the lines NAVNT_50_AP1=1 and NAVNT_50_AP2=1 are in the correct section and you did not need to make any changes in the previous section, then it is likely that something else in NAV has become damaged. You must uninstall and reinstall NAV, following the instruction in step 3 of the section To ensure that the referenced folder actually exists, and that it is the most recent one.
If they are not in the correct section--for example--the Usage.dat file looks similar to the following:

[20000817.018]
NAVNT_50_NAVW=1
NAVNT_50_AP1=1
NAVNT_50_AP2=1

[20000828.032]
NAV_50_QUAR=1

(the lines NAVNT_50_AP1=1 and NAVNT_50_AP2=1) are located under the older definition folder, then you will need to cut and paste them to the correct location. Follow these steps:
1. Select the lines of text that need to be moved.
2. Click the Edit menu, and then click Cut.
3. Press Delete to close up the now empty line.
4. Place the cursor just to the right of the closing bracket of the section to which you want to paste the text, and then press Enter.
5. Click the Edit menu, and then click Paste. The file should now look similar to the example shown in step 3, with the lines NAVNT_50_AP1=1 and NAVNT_50_AP2=1 under the section that corresponds to the most recent virus definitions.

NOTE: If you make a mistake doing this, the easiest way to undo any changes is to exit Notepad and click No when prompted to save changes, and then start over from step 1 of this section.

6. When you have finished, and are certain that NAVNT_50_AP1=1 and NAVNT_50_AP2=1 are under the correct section, click File, and then click Save.
7. Exit Notepad.

5. Close all programs, and then restart the computer.
6.

YOIKES! 8O

**P-Dub** · 14 February 2003, 05:35 Friday

Thanks for the info Gordon.

Well I got NAV reloaded. But since then I'm still having some wierd problems.

Now when I've rebooted, I've lost my pagefile.sys, and I have to reinitiate my pagefile size, about 490M.

Well since this afternoon, my computers shut down twice with no warning. There's a nice pop as if there's a short and everything starts to reboot. It just happened a few hours ago and I can see that there's like 3 files that look like older pagefile.sys, the file size is like 490M but the names are xxxm.file.sys, where the xxx are wierd characters.

Now I'm really :??

My gut is telling me that this is more hardware related than software, but I don't know. Funny enough, now is not the time for me to be having computer troubles. And guess what, I'm having computer troubles.

I think I'll just start looking to pickup a new PC. Even then that'll take me a couple of weeks before I decide what I want/afford.

Paul

There are three kinds of people in this world; those that can count, and those that can't.

**Kevin P** · 14 February 2003, 10:57 Friday

That pop doesn't sound good. Your power supply might be on its way out. Perhaps a component is arcing in the power supply, causing the power drop and the reboot. If this continues it may damage other components in your PC. If you want to try and salvage your PC, rather than buying a new one, I'd put a new power supply in.

Your file corruptions are likely caused by the dropouts and the resulting "improper" shutdown/reboot. Also, if the P/S is putting out dirty power you could be experiencing dropouts in memory, which will corrupt or crash things.

I'd drop in a new power supply and see what happens. If it doesn't help and you decide to build a new PC, hey, you'll have a new power supply to put in it!

KJP

Official Computer Geek and Techno-Wiz Guru of HTGuide - Visit Tower of Power
My HT Site

**Gordon Moore** · 14 February 2003, 11:23 Friday

Like Kevin said....and if you're looking for a recommendation I can whole-heartedly recommend ANTEC TruePower series...well made....SILENT even with dual fan. If you're looking to save a buck or 2, I hear the Enermax P/S are a good build as well and come in cheaper than ANTEC.

Mysterious Computer shutdown

Mysterious Computer shutdown

Comment

Comment

Comment

Comment

Comment

Comment

Comment