Section 6.2. STARTUP AND SHUTDOWN

6.2.1. Windows Won't Start

THE ANNOYANCE: I turned on my computer this morning, and all I got was a black screen and the rather unhelpful message "Operating system not found" in little white letters. Is my PC trying to tell me that my hard disk has crashed?

THE FIX: When you turn on your PC, the first thing it does after completing its Power On Self Test (POST) is to scan your hard disk for something called a master boot record (MBR), a pointer to a program on your hard disk that tells your PC which partition contains your operating system. This error message means that your PC can't find Windows XP's boot information, because the MBR is corrupt, the entry for Windows in the MBR is absent or corrupt, or any of a half-dozen other reasons. But don't panicthe solution is often a simple one.

First, eject any disks from your PC's floppy and CD drives, and then reboot. Some computers check these drives for boot information before moving on to your hard disk, and display the above error message if no boot records are detected.

If that doesn't help, determine whether your PC is detecting your hard disk at all. During the self-test, your PC displays a bunch of information about your system, including details about the processor, memory, and hard disks. (Many new PCs display a large logo while this is happening, but you can usually hide the logo and display this information by pressing the Esc key.) If the screen blows by too quickly, or you don't see any hard disk information, enter your system BIOS setup screen, as described in "Boot with the Windows CD," and peruse the information there.

If your hard disktypically identified by manufacturer and model numberis not listed, your PC is not detecting it. There are about 50 things that can cause this problem, but it's often nothing more than a bad data cable. Crack open your PC's case, and make sure the IDE, SATA, or SCSI cable connecting your hard disk to the motherboard is firmly attached at both ends. If the problem persists, replace the cable with a brand new one. You could also unplug every drive other than your hard disk (e.g., CD and DVD drives, Zip and tape drives, etc.) to see if one of them is causing the problem.

If your PC is detecting your hard disk but Windows still won't load, fire up the Windows Recovery Console (WRC) and attempt repairs there. To get into the WRC, insert your Windows XP CD in your CD drive and turn on your computer (see "Boot with the Windows CD" if this doesn't work). After Setup loads all of its drivers, press the R key to start the Windows Recovery Console.

When the WRC starts, you'll see a screen titled "Windows NT™ Boot Console Command Interpreter." If you're asked "Which Windows installation would you like to logon to," type the number next to your Windows XP folder (usually 1…c:\Windows), and then type your administrator password (see Chapter 5). Once you've logged in, the WRC looks and feels a lot like the Windows Command Prompt (a.k.a. DOS), but it supports only a handful of DOS commands.

At the prompt, type dir and press Enter to display a listing of the files and folders in the root folder of your hard disk (usually c:\). If you see a bunch of garbage characters or you get a strange error, stop immediately and take your hard disk to a data recovery expert.

Otherwise, if the listing looks normal (i.e., you see the WINDOWS and Program Files folders), type fixmbr and press Enter. Then type fixboot and press Enter. When the two commands finish, press Ctrl-Alt-Del to restart your computer and see if Windows loads properly.

If Windows still won't boot, your hard disk needs more help than I can provide in these pages. If your drive contains any valuable data, try a recovery utility such as SpinRite ($89.00, http://www.grc.com) or, if you don't want to risk doing more damage, take it to a data recovery expert and hope for the best.

6.2.2. Desktop Never Appears

THE ANNOYANCE: Windows just won't finish loading. I stare at the Windows logo for what seems like an eternity, and then the pulsating progress bar stops pulsating. That's it; Windows never loads. What's going on?

THE FIX: When Windows boots, it loads all of its drivers, initializes its network connections, and loads its high-level components (Explorer, fonts, etc.) into memory. These things are loaded in order; if one task cannot completebecause of a corrupted file or network error, for instancethe next task cannot begin and the boot process stalls.

If the problem started happening as soon as you added a new hardware device, check the device manufacturer's web site for a driver or BIOS update. Otherwise, first unplug your network cable and try again. If Windows loads, there's something wrong with your network connection, Internet connection, router, or whatever else is on the other end of that cable.

Still stuck? Unplug all the USB and FireWire devices connected to your PC. If Windows loads, reconnect them one by one, restarting Windows after each reconnection, until you find the culprit that hangs the system. Really stuck? Start disconnecting any non-USB peripherals (e.g., keyboard, mouse, parallel printer) attached to your PC and, if necessary/applicable, PCI or PCMCIA cards and any other nonessential devices inside your PC.

If the above steps don't work, there may be a problem with your hard diskbut if you're getting as far as the Windows logo, it's probably not too serious. To investigate, restart your computer, and just after the beep but before the Windows logo appears, press the F8 key. From the Windows Advanced Options Menu, use the arrow keys to highlight Safe Mode, and press Enter.

Safe Mode allows Windows to load without network support, hardware drivers, some services, and a handful of other components that can sometimes cause this problem. If Safe Mode works, open Windows Explorer, right-click your hard disk (e.g., drive c:), select Properties, and choose the Tools tab. In the "Error-checking" section, click the Check Now button. Check the boxes next to both options in the "Check disk" section and click the Start button, and ScanDisk will open and check your drive for errors. When it's finished, restart Windows normally.

6.2.3. Un-Hobble the Windows Recovery Console

THE ANNOYANCE: There's a virus-infected file on my hard disk that I can't delete, so I'm trying to use the Windows Recovery Console to excise it. But the WRC apparently will only let me delete files in the root directory and in c:\Windows. What gives?

THE FIX: The WRC does more than repair master boot records (see "Windows Won't Start"); it provides access to the files on your hard disk when Windows isn't running, allowing you to copy, delete, or rename them as you see fit. However, it won't let you do this until you release a restriction that's in place by default.

Return to Windows, go to Start Run, type secpol.msc, and press Enter to start the Local Security Settings editor. Navigate to \Security Settings\Local Policies\Security Options in the tree on the left, and double-click the "Recovery Console: Allow floppy copy and access to all drives and all folders" entry on the right. Select Enabled, and click OK.

Next, return to the WRC and type:

	set AllowAllPaths = true

Make sure to include the spaces before and after the equals sign, and press Enter. Thereafter, you can delete any file in any folder. Although the change you made in the Local Security Settings is permanent, you'll have to issue the above set command once each time you use the WRC.

You may have noticed a Catch-22 of sorts in this fix. If Windows won't boot and you're using the WRC to effect repairs, you won't be able to release the Local Security Settings restriction. In this case, you'll either have to live without the ability to delete files in other folders, or install a second copy of Windows XP on another partition (see "Set Up a Dual-Boot System") and delete the file from there.

6.2.4. Windows Won't Shut Down

THE ANNOYANCE: When I try to shut down Windows, it hangs at the "Saving Settings" screen. Why can't Windows even handle a simple shutdown?

THE FIX: Every time you shut down your PC, Windows attempts to close all running applications, stop all active services, and unload all drivers in memory. If just one of these components stops responding, Windows will wait until it can be closed successfully. As you can probably guess, all it takes is one crashed program or one stubborn driver to prevent Windows from shutting down.

The most common culprit is a power management bug found in many PCs. If you ever put your PC to "sleep" by pressing the power switch or closing the laptop lid, Windows may not be able to complete a formal shutdown thereafter. Unfortunately, there's not much you can do about this, other than checking your PC manufacturer's web site for a BIOS update (see "Setup Hangs Before It's Finished").

If you never hibernate or sleep your PC, the problem may be spywarewhich can be adequately described as "stubborn"that refuses to be unloaded. (See "Put an End to Pop-ups" in Chapter 4 for tips on how to rid your system of such parasites.)

If an antispyware scan doesn't solve the problem, the errant program is likely a legitimate software component, and it may take a bit of sleuthing to track it down. Close all open applications, and then right-click an empty area of the Windows Taskbar. From the menu that appears, select Task Manager. Then choose the Processes tab to see a list all the programs running on your PC, including those running in the background; click the Image Name column header to sort the list alphabetically (see Figure 6-3).

Figure 6-3. Use the Task Manager to find out what programs are running in the background and mucking up your system.

Note: For an alternative to the Task Manager that allows you to see the full paths of the processes in memory, fire up the System Information tool (go to Start Run and type msinfo32.exe), expand the Software Environment branch on the tree, and select Running Tasks.

Your goal: find the programs that are causing your shutdown problem. Although the Task Manager won't give you this information directly, it will let you close almost any running program, one by one. Any program that you close with the End Process button in the Task Manager won't be running when you shut down, and thus can't prevent Windows from shutting down properly. (This isn't foolproof, but it works pretty well most of the time.)

Most of the programs listed in the Task Manager's Processes tab are Windows components necessary for the operating system to function (e.g., csrss.exe, inetinfo.exe, rundll32.exe, svchost.exe, winlogon.exe, etc.); the rest are either applications you've started or malware (viruses, spyware, etc.). A few processes will be self-explanatory, such as explorer.exe and firefox.exe, but odds are that you'll recognize very few others. So how do you tell the difference between the good processes and the bad?

The best way to research a particular process is to look up the filename in an online database of "known" processes, such as http://www.neuber.com/taskmanager/process/. If you need more information, search for the filename with Google. However, there are two big complications that make identifying your running processes more difficult.

First, some forms of malware use the same filenames as common Windows components to disguise themselves. For instance, csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem, a Windows component, but it also can be a virus (the W32.Netsky.AB@mm worm or the W32.Webus Trojan, specifically). The good news is that such ambiguities are almost always chronicled in the online process databases.

The other complication is that some entries in the Task Manager's Processes list are simply loader programs for background processes. Case in point: each instance of svchost.exe corresponds to a running service, but the Task Manager won't tell you which ones are which; all you'll see are multiple entries labeled svchost.exe. To see which services are running, and to stop, restart, or configure any services on your system, go to Start Run, type services.msc, and click OK.

When you've closed a handful of suspect programs, go ahead and shut down (or restart) Windows. If Windows shuts down normally, one of the programs you just closed was indeed the cause of the problem. Try updating or uninstalling the offending program or driver, and your shutdown problems should vanish.

6.2.5. Unattended Shutdown

THE ANNOYANCE: I thought I shut down my computer before leaving the office, but when I got back the next day I saw that it was still running. On the screen was a window that said an application had stopped responding. Why didn't Windows just close the program and shut off my PC?

THE FIX: As noted earlier in "Windows Won't Shut Down," Windows tries to close all running applications, stop all active services, and unload all drivers each time it shuts down. Often, Windows just sits and waits if one of those programs won't cooperate and close. All it takes to grease the wheels and change how Windows treats hung applications is a few quick changes to the Windows Registry.

Open the Registry Editor (go to Start Run and type regedit), and navigate to HKEY_CURRENT_USER\Control Panel\Desktop. Double-click the AutoEndTasks value in the right pane, type 1 (one) in the "Value data" field, and click OK. Next, double-click the WaitToKillAppTimeout value, type 1000 in the "Value data" field, and then click OK. Close the Registry Editor when you're done, and restart Windows so the changes can take effect. Thereafter, Windows will close stubborn programs automatically and with all due haste (whenever possible) when it's time to shut down.

6.2.6. Faster Application Startups

THE ANNOYANCE: Sometimes it seems to take an eternity for programs to load. I stare at an hourglass while listening to the hard disk thrash about, and then the application's window finally appears. There's got to be a way to speed this up.

THE FIX: Before Windows can load an application, it must set aside enough room in your PC's memory. If you have a lot of applications already loaded, you'll probably run out of memory, at which point Windows will use part of your hard disk called virtual memory to make up for the deficiency. Since hard disks are much slower than RAM, this technique (called swapping) slows down your computer considerably. You can temporarily alleviate this problem by closing unneeded programs before opening any new ones, but a better long-term solution is to install more memory (RAM) in your PC.

Of course, no matter how much memory you have, Windows will still use your hard disk to some extent. To keep your hard diskand thus your systemrunning optimally, run Disk Defragmenter routinely (go to Start Run and type dfrg.msc). Also, the more space you set aside for virtual memory, the more efficiently Windows can utilize it. At a bare minimum, make sure you have half a gigabyte (500 MB) of free hard disk space at all times.

6.2.7. Faster Windows Boot

THE ANNOYANCE: Why does Windows take so long to load? Is there anything I can do to speed it up?

THE FIX: All the software and hardware devices you add to your PC eventually take their toll, creating more for Windows to load each time it boots. The most effective way to combat this bloat is to routinely format your hard disk (see "Wipe Your Hard Disk Clean") and reinstall the operating system and all your applications. Unfortunately, reinstalling can be a time-consuming and frustrating process, and when all is said and done, it'll only be a matter of time before Windows once again becomes bogged down. Instead, optimize a few key areas of your PC to effect a more permanent performance increase.

First, add more memory (RAM) to your system. You should have a minimum of 384 MB of RAM to run Windows XP, but 512 MB or even 1 GB is better. The more memory you have (up to a point), the easier it will be for Windows to find space for all those drivers and programs during boot time. The rest of the time, that extra RAM means Windows will use slower virtual memory less often (see "Faster Application Startups").

One of the biggest contributors to a slow bootup is the long list of programs configured to load at boot time. Not only do these programs take time and processor cycles to load, but they eat up memory and even more processor cycles while they're running, further sapping your PC's performance. Most of the startup programs you can control are listed in your Startup folder and in the Registry.

The Startup folder (Start All Programs Startup) is merely a collection of shortcuts to programs that load every time Windows boots. This folder is empty by default; anything you see in your own Startup folder has been addedpresumably by you or by an application you installedsince Windows was installed, and thus none of them are actually required by Windows. To stop a startup item from loading with Windows, just drag it into another folder for safekeeping (or straight into the Recycle Bin if you want to delete the shortcut).

So how do you tell what belongs and what doesn't? The names of most of the shortcuts in your Startup folder should be self-evident; the Microsoft Office Startup Assistant, for instance, is a component of Microsoft Office that's supposed to help Office applications start faster. Delete the Startup Assistant from your Startup folder, and you likely won't notice any difference… except that Windows will load slightly faster. Deleting other shortcuts here may disable some (typically noncritical) features, so be sure to check the program's documentation for the purpose of the shortcut.

Note: If you want to see all your startup programs in one place, whether they're listed in the Registry or your Startup folder, open up the System Information tool (go to Start Run and type msinfo32.exe), expand the Software Environment branch, and select Startup Programs.

Programs configured in your Registry to start with Windows are typically listed in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. (Use the Favorites menu in the Registry Editor to bookmark these locations, making it easy to return to each key and clean out any unwanted programs as they appear.)

To remove an unwanted program from either Registry key, just highlight it and press the Delete key. You'd be wise to back up both keys before making any changes, though: to create a backup, just highlight a key, select File Export, and type a filename for the .reg backup file. Then, if you need to reinstate a deleted value, just double-click the .reg file to merge its contents with the Registry.

Programs listed in these Registry keys are typically less self-descriptive than their counterparts in the Startup folder, so you may need to do some research before you remove anything (the research processes is described in "Windows Won't Shut Down").

While you're at it, open the Services list (go to Start Run and type services.msc) to see some other programs Windows loads at startup. Any service that says "Automatic" in the Startup Type column is set to load when Windows starts, and ones that say "Started" in the Status column are currently running. (Click either column header to sort the list to make these services easier to find.) If you double-click a service, you can stop it by clicking the Stop button, or prevent it from loading the next time Windows starts by selecting Manual or Disabled from the "Startup type" drop-down list. Be warned, though: most services listed here are essential Windows components. Read the description shown to learn more about any particular service.

Aside from startup programs, sometimes having too many files in your Temp folder can not only slow Windows startup but, in extreme cases, prevent Windows from loading at all. Windows and your applications use this folder to temporarily store data, usually from documents you have open. When you close applications (or when applications crash), temporary files are often left behind, and these files can proliferate faster than rabbits in spring. To clean out this folder, open Windows Explorer, navigate to \Documents and Settings\{username}\Local Settings\Temp, and delete any files with modification dates earlier than the last time you started your PC. (You can use Creative Element Power Tools, available at http://www.creativelement.com/powertools/, to clean out this folder automatically.)

If you have hundreds of fonts installed on your system, they may be adding to boot time as well. If you can survive without 400 different decorative typefaces (especially if all you ever use is Times New Roman), thin out your fonts to speed Windows bootup. Open the Fonts control panel and uninstall any unwanted fonts by dragging them to another folder (or to your Recycle Bin to delete them permanently). Be careful not to delete any Windows fonts, though, such as Marlett, Fixedsys, MS Sans Serif, or any other fonts that start with "Microsoft" or "MS" (you can find a list at http://www.kayskreations.net/fonts/fonttb.html). If you do delete a system font by mistake, don't sweatXP's Windows File Protection system will restore it.

If you periodically need a lot of fonts, invest in font-management software such as Adobe Type Manager, which can remove and reinstall fonts in groups at the click of a button.