Escaping system lockups by using Process Explorer

Once in awhile an errant app can lock up the system, and I've at least found
one way out of this predicament (short of unplugging the computer), by using
"Process Explorer". (I'm talking about cases where "End Task" fails to do
anything, and ditto on using Ctrl-Alt-Del).

You can select "services.exe" in Procees Explorer, and then use "Kill
Process". This forces a reboot in 60 seconds ("system will shutdown in 60
seconds...". (Sometimes selecting "svchost.exe" instead will do it, but it
seems killing "services.exe" is better, since it seems to be the main root
of the tree (encompassing the various instances of svchost).

Is there any other way (or some even simpler app) others have used to get
out of a system lockup (short of pulling the plug)? It would be nice
having a simpler way for those rare cases of system freezes due to some
errant program. Again, this is for those extreme cases where Task Manager
is unable to do it (by selecting End Task or Reboot or whatever in there).

On Dec 25, 5:14*pm, "Bill in Co"
wrote:
Once in awhile an errant app can lock up the system, and I've at least found
one way out of this predicament (short of unplugging the computer), by using
"Process Explorer". * (I'm talking about cases where "End Task" fails to do
anything, and ditto on using Ctrl-Alt-Del).

You can select "services.exe" in Procees Explorer, and then use "Kill
Process". * This forces a reboot in 60 seconds ("system will shutdown in 60
seconds...". * (Sometimes selecting "svchost.exe" instead will do it, but it
seems killing "services.exe" is better, since it seems to be the main root
of the tree (encompassing the various instances of svchost).

Is there any other way (or some even simpler app) others have used to get
out of a system lockup (short of pulling the plug)? * It would be nice
having a simpler way for those rare cases of system freezes due to some
errant program. *Again, this is for those extreme cases where Task Manager
is unable to do it (by selecting End Task or Reboot or whatever in there)..

I condensed one small piece of a Mark Russinovich webinar on
troubleshooting performance issues and system lockups into the
following process.

Since Mark is one of (or maybe the sole) MS developers of such things
as Process Explorer, this gives him some credibility regarding how to
effectively troubleshoot malfunctioning Windows based systems.

Here are my standard copy/paste instructions for how do figure out
what is going on when a system hangs or stops responding:

If your system stops responding, hangs or freezes and you can't figure
out why, you can force a Blue Screen of Death (BSOD) which will create
a crash dump file that you can analyze and see what is running at the
point of the freeze and get some ideas that do not involve guesswork.

While it may seem odd to think about purposely causing a Blue Screen
Of Death (BSOD), Microsoft includes such a provision in Windows XP.
The feature is built in to XP specifically to diagnose the problem
when a system hangs, freezes or stops responding.

This will eliminate trying things or guessing about what might be
happening maybe. You will know what is happening.

When the system hangs, there will often not be any indication or clues
in the Event Viewer logs, but feel free to look and see if there are
any significant event around the time of the failure.

Here's how to force your system to create a BSOD:

First make sure your system is not set to automatically restart on a
system failure and is set up to create a crash dump file when a Blue
Screen of Death (BSOD) occurs.

Right click My Computer, Properties, Advanced, Startup and Recovery,
Settings.

In the System failure section:

Put a check mark in the "Write an event to the system log" box
Put a check mark in the "Send an administrative alert" box
Uncheck the "Automatically restart" box

In the Write debugging information section, choose:

Small memory dump (64 KB)

Set the Small dump directory to:

%SystemRoot%\Minidump

Click OK twice to save the settings.

Now enable the XP feature to generate a crash dump on demand.

Before making registry changes, backup your registry with this popular
free and easy to use tool:

http://www.snapfiles.com/get/erunt.html

For PS/2 keyboards, launch the Registry Editor (Start, Run,
regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters

For USB keyboards, launch the registry editor (Start, Run,
regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\kbdhid\Para meters

Click Edit, select New DWORD Value and name the new value:

CrashOnCtrlScroll

Double-click the CrashOnCtrlScroll DWORD Value, type 1 in the Value
Data text box to enable the feature, and click OK.

Close the Registry Editor and restart Windows XP for the changes to
take effect.

When you want to cause a BSOD (when your system has stopped
responding), press and hold down the [Ctrl] key on the right side of
your keyboard, and then tap the [ScrollLock] key twice. Now you should
see the BSOD and you will have a crash dump file to analyze.

You may not see the information about your problem on the BSOD screen,
but you will find the answer in the crash dump file. You may need
help interpreting your crash dump file if you have never seen one
before.

You can read about the feature he

http://msdn.microsoft.com/en-us/library/ff545499.aspx

There is no harm in leaving the feature enabled (mine is always on),
but if you are compelled to remove it, just undo the change you made
in the registry.

Launch the Registry Editor (Start, Run, regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters

or

HKLM\System\CurrentControlSet\Services\kbdhid\Para meters

Select the CrashOnCtrlScroll value, click the Edit menu, and select
the Delete command.

Close the Registry Editor and restart Windows XP.

Go ahead and test the new manual crash dump on demand feature to be
sure it works as expected, then wait for the system to hang again.

When you have some crash dump files accumulated, you can learn how to
figure out what is going on with the system when it is hung or not
responding and then you can decide what needs to be done to fix it.

Jose wrote:
On Dec 25, 5:14 pm, "Bill in Co"
wrote:
Once in awhile an errant app can lock up the system, and I've at least
found
one way out of this predicament (short of unplugging the computer), by
using
"Process Explorer". (I'm talking about cases where "End Task" fails to do
anything, and ditto on using Ctrl-Alt-Del).

You can select "services.exe" in Procees Explorer, and then use "Kill
Process". This forces a reboot in 60 seconds ("system will shutdown in 60
seconds...". (Sometimes selecting "svchost.exe" instead will do it, but
it
seems killing "services.exe" is better, since it seems to be the main
root
of the tree (encompassing the various instances of svchost).

Is there any other way (or some even simpler app) others have used to get
out of a system lockup (short of pulling the plug)? It would be nice
having a simpler way for those rare cases of system freezes due to some
errant program. Again, this is for those extreme cases where Task Manager
is unable to do it (by selecting End Task or Reboot or whatever in
there).

I condensed one small piece of a Mark Russinovich webinar on
troubleshooting performance issues and system lockups into the
following process.

Since Mark is one of (or maybe the sole) MS developers of such things
as Process Explorer, this gives him some credibility regarding how to
effectively troubleshoot malfunctioning Windows based systems.

Here are my standard copy/paste instructions for how do figure out
what is going on when a system hangs or stops responding:

If your system stops responding, hangs or freezes and you can't figure
out why, you can force a Blue Screen of Death (BSOD) which will create
a crash dump file that you can analyze and see what is running at the
point of the freeze and get some ideas that do not involve guesswork.

While it may seem odd to think about purposely causing a Blue Screen
Of Death (BSOD), Microsoft includes such a provision in Windows XP.
The feature is built in to XP specifically to diagnose the problem
when a system hangs, freezes or stops responding.

This will eliminate trying things or guessing about what might be
happening maybe. You will know what is happening.

When the system hangs, there will often not be any indication or clues
in the Event Viewer logs, but feel free to look and see if there are
any significant event around the time of the failure.

Here's how to force your system to create a BSOD:

First make sure your system is not set to automatically restart on a
system failure and is set up to create a crash dump file when a Blue
Screen of Death (BSOD) occurs.

Right click My Computer, Properties, Advanced, Startup and Recovery,
Settings.

In the System failure section:

Put a check mark in the "Write an event to the system log" box
Put a check mark in the "Send an administrative alert" box
Uncheck the "Automatically restart" box

In the Write debugging information section, choose:

Small memory dump (64 KB)

Set the Small dump directory to:

%SystemRoot%\Minidump

Click OK twice to save the settings.

Now enable the XP feature to generate a crash dump on demand.

Before making registry changes, backup your registry with this popular
free and easy to use tool:

http://www.snapfiles.com/get/erunt.html

For PS/2 keyboards, launch the Registry Editor (Start, Run,
regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters

For USB keyboards, launch the registry editor (Start, Run,
regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\kbdhid\Para meters

Click Edit, select New DWORD Value and name the new value:

CrashOnCtrlScroll

Double-click the CrashOnCtrlScroll DWORD Value, type 1 in the Value
Data text box to enable the feature, and click OK.

Close the Registry Editor and restart Windows XP for the changes to
take effect.

When you want to cause a BSOD (when your system has stopped
responding), press and hold down the [Ctrl] key on the right side of
your keyboard, and then tap the [ScrollLock] key twice. Now you should
see the BSOD and you will have a crash dump file to analyze.

You may not see the information about your problem on the BSOD screen,
but you will find the answer in the crash dump file. You may need
help interpreting your crash dump file if you have never seen one
before.

You can read about the feature he

http://msdn.microsoft.com/en-us/library/ff545499.aspx

There is no harm in leaving the feature enabled (mine is always on),
but if you are compelled to remove it, just undo the change you made
in the registry.

Launch the Registry Editor (Start, Run, regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters

or

HKLM\System\CurrentControlSet\Services\kbdhid\Para meters

Select the CrashOnCtrlScroll value, click the Edit menu, and select
the Delete command.

Close the Registry Editor and restart Windows XP.

Go ahead and test the new manual crash dump on demand feature to be
sure it works as expected, then wait for the system to hang again.

When you have some crash dump files accumulated, you can learn how to
figure out what is going on with the system when it is hung or not
responding and then you can decide what needs to be done to fix it.

Thanks for the info, Jose. I've looked before at some of the crash dumps
in the past (for another problem), and it wasn't all that easy to debug, to
put it mildly.

But in this particular case, I'm not so much interested in the why's as much
as having an easy way out. Process Explorer and killing "services.exe"
works in these rare cases, but I was just thinking there might be even a
simpler app that's just dedicated to getting the same end result.

You know, like someone could have made an app (analogous to End Task) that
could actually work when Task Manager can't. (It must be possible, since
killing "services.exe" in Process Explorer DOES work in these rare cases,
and bringing up Process Explorer seems a bit overkill for just doing that).

"Bill in Co" wrote in message
...
Once in awhile an errant app can lock up the system, and I've at least
found one way out of this predicament (short of unplugging the computer),
by using "Process Explorer". (I'm talking about cases where "End Task"
fails to do anything, and ditto on using Ctrl-Alt-Del).

You can select "services.exe" in Procees Explorer, and then use "Kill
Process". This forces a reboot in 60 seconds ("system will shutdown in
60 seconds...". (Sometimes selecting "svchost.exe" instead will do it,
but it seems killing "services.exe" is better, since it seems to be the
main root of the tree (encompassing the various instances of svchost).

Is there any other way (or some even simpler app) others have used to get
out of a system lockup (short of pulling the plug)? It would be nice
having a simpler way for those rare cases of system freezes due to some
errant program. Again, this is for those extreme cases where Task Manager
is unable to do it (by selecting End Task or Reboot or whatever in there).

Bill,

Maybe the following would work to your satisfaction. It requires the
ability to start Task Manager when your system is "locked". You can start
Task Manager by right-clicking on the taskbar or pressing Ctrl-Shift-Esc .

From the 'Processes' tab in Task Manager, select 'explorer.exe' -- End
Process. Your desktop will disappear when you do this but Task Manager
should still be present. Then (still in Task Manager), click File -- New
Task (Run) and type "explorer.exe" (without the quotes) -- OK. If you
happen to lose Task Manager after ending explorer.exe, then click
'Start' -- Run -- "explorer.exe" -- OK.

I don't have Process Explorer installed on the computer I am using at the
moment but there is likely a similar way to do it using Process Explorer.

Cheers,
MB

On Dec 25, 7:03*pm, "Bill in Co"
wrote:
Jose wrote:
On Dec 25, 5:14 pm, "Bill in Co"
wrote:
Once in awhile an errant app can lock up the system, and I've at least
found
one way out of this predicament (short of unplugging the computer), by
using
"Process Explorer". (I'm talking about cases where "End Task" fails to do
anything, and ditto on using Ctrl-Alt-Del).

You can select "services.exe" in Procees Explorer, and then use "Kill
Process". This forces a reboot in 60 seconds ("system will shutdown in 60
seconds...". (Sometimes selecting "svchost.exe" instead will do it, but
it
seems killing "services.exe" is better, since it seems to be the main
root
of the tree (encompassing the various instances of svchost).

Is there any other way (or some even simpler app) others have used to get
out of a system lockup (short of pulling the plug)? It would be nice
having a simpler way for those rare cases of system freezes due to some
errant program. Again, this is for those extreme cases where Task Manager
is unable to do it (by selecting End Task or Reboot or whatever in
there).

I condensed one small piece of a Mark Russinovich webinar on
troubleshooting performance issues and system lockups into the
following process.

Since Mark is one of (or maybe the sole) MS developers of such things
as Process Explorer, this gives him some credibility regarding how to
effectively troubleshoot malfunctioning Windows based systems.

Here are my standard copy/paste instructions for how do figure out
what is going on when a system hangs or stops responding:

If your system stops responding, hangs or freezes and you can't figure
out why, you can force a Blue Screen of Death (BSOD) which will create
a crash dump file that you can analyze and see what is running at the
point of the freeze and get some ideas that do not involve guesswork.

While it may seem odd to think about purposely causing a Blue Screen
Of Death (BSOD), Microsoft includes such a provision in Windows XP.
The feature is built in to XP specifically to diagnose the problem
when a system hangs, freezes or stops responding.

This will eliminate trying things or guessing about what might be
happening maybe. *You will know what is happening.

When the system hangs, there will often not be any indication or clues
in the Event Viewer logs, but feel free to look and see if there are
any significant event around the time of the failure.

Here's how to force your system to create a BSOD:

First make sure your system is not set to automatically restart on a
system failure and is set up to create a crash dump file when a Blue
Screen of Death (BSOD) occurs.

Right click My Computer, Properties, Advanced, Startup and Recovery,
Settings.

In the System failure section:

Put a check mark in the "Write an event to the system log" box
Put a check mark in the "Send an administrative alert" box
Uncheck the "Automatically restart" box

In the Write debugging information section, choose:

Small memory dump (64 KB)

Set the Small dump directory to:

%SystemRoot%\Minidump

Click OK twice to save the settings.

Now enable the XP feature to generate a crash dump on demand.

Before making registry changes, backup your registry with this popular
free and easy to use tool:

http://www.snapfiles.com/get/erunt.html

For PS/2 keyboards, launch the Registry Editor (Start, Run,
regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters

For USB keyboards, launch the registry editor (Start, Run,
regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\kbdhid\Para meters

Click Edit, select New DWORD Value and name the new value:

CrashOnCtrlScroll

Double-click the CrashOnCtrlScroll DWORD Value, type 1 in the Value
Data text box to enable the feature, and click OK.

Close the Registry Editor and restart Windows XP for the changes to
take effect.

When you want to cause a BSOD (when your system has stopped
responding), press and hold down the [Ctrl] key on the right side of
your keyboard, and then tap the [ScrollLock] key twice. Now you should
see the BSOD and you will have a crash dump file to analyze.

You may not see the information about your problem on the BSOD screen,
but you will find the answer in the crash dump file. *You may need
help interpreting your crash dump file if you have never seen one
before.

You can read about the feature he

http://msdn.microsoft.com/en-us/library/ff545499.aspx

There is no harm in leaving the feature enabled (mine is always on),
but if you are compelled to remove it, just undo the change you made
in the registry.

Launch the Registry Editor (Start, Run, regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters

or

HKLM\System\CurrentControlSet\Services\kbdhid\Para meters

Select the CrashOnCtrlScroll value, click the Edit menu, and select
the Delete command.

Close the Registry Editor and restart Windows XP.

Go ahead and test the new manual crash dump on demand feature to be
sure it works as expected, then wait for the system to hang again.

When you have some crash dump files accumulated, you can learn how to
figure out what is going on with the system when it is hung or not
responding and then you can decide what needs to be done to fix it.

Thanks for the info, Jose. * I've looked before at some of the crash dumps
in the past (for another problem), and it wasn't all that easy to debug, to
put it mildly.

But in this particular case, I'm not so much interested in the why's as much
as having an easy way out. * Process Explorer and killing "services.exe"
works in these rare cases, but I was just thinking there might be even a
simpler app that's just dedicated to getting the same end result.

You know, like someone could have made an app (analogous to End Task) that
could actually work when Task Manager can't. *(It must be possible, since
killing "services.exe" in Process Explorer DOES work in these rare cases,
and bringing up Process Explorer seems a bit overkill for just doing that).

It takes a little practice and some set up.

There are tools like BlueScreenView to help with the unexpected BSODs,
but the manually initiated one will always show the same cause
(manually initiated), but then using the MS tools, you can see what is
loaded into memory at the time and see what else is in memory at the
time. You can easily spot a video, sound or network driver for
example.

It is really very interesting if you like figuring these things out.
The MS tools are sometimes intimidating until you get the hang of
things by actually doing a few.

I usually just get folks to email me the recent forced crash dumps
generated when their system is locked up and and look at them myself.

I'll see if I can find the link to the webinar from Mark and post it
up...

Jose wrote:
On Dec 25, 5:14 pm, "Bill in Co"
wrote:
Once in awhile an errant app can lock up the system, and I've at
least found one way out of this predicament (short of unplugging the
computer), by using "Process Explorer". (I'm talking about cases
where "End Task" fails to do anything, and ditto on using
Ctrl-Alt-Del).

You can select "services.exe" in Procees Explorer, and then use "Kill
Process". This forces a reboot in 60 seconds ("system will shutdown
in 60 seconds...". (Sometimes selecting "svchost.exe" instead will
do it, but it seems killing "services.exe" is better, since it seems
to be the main root of the tree (encompassing the various instances
of svchost).

Is there any other way (or some even simpler app) others have used
to get out of a system lockup (short of pulling the plug)? It would
be nice
having a simpler way for those rare cases of system freezes due to
some errant program. Again, this is for those extreme cases where
Task Manager is unable to do it (by selecting End Task or Reboot or
whatever in there).

I condensed one small piece of a Mark Russinovich webinar on
troubleshooting performance issues and system lockups into the
following process.

Since Mark is one of (or maybe the sole) MS developers of such things
as Process Explorer, this gives him some credibility regarding how to
effectively troubleshoot malfunctioning Windows based systems.

Here are my standard copy/paste instructions for how do figure out
what is going on when a system hangs or stops responding:

If your system stops responding, hangs or freezes and you can't figure
out why, you can force a Blue Screen of Death (BSOD) which will create
a crash dump file that you can analyze and see what is running at the
point of the freeze and get some ideas that do not involve guesswork.

While it may seem odd to think about purposely causing a Blue Screen
Of Death (BSOD), Microsoft includes such a provision in Windows XP.
The feature is built in to XP specifically to diagnose the problem
when a system hangs, freezes or stops responding.

This will eliminate trying things or guessing about what might be
happening maybe. You will know what is happening.

When the system hangs, there will often not be any indication or clues
in the Event Viewer logs, but feel free to look and see if there are
any significant event around the time of the failure.

Here's how to force your system to create a BSOD:

First make sure your system is not set to automatically restart on a
system failure and is set up to create a crash dump file when a Blue
Screen of Death (BSOD) occurs.

Right click My Computer, Properties, Advanced, Startup and Recovery,
Settings.

In the System failure section:

Put a check mark in the "Write an event to the system log" box
Put a check mark in the "Send an administrative alert" box
Uncheck the "Automatically restart" box

In the Write debugging information section, choose:

Small memory dump (64 KB)

Set the Small dump directory to:

%SystemRoot%\Minidump

Click OK twice to save the settings.

Now enable the XP feature to generate a crash dump on demand.

Before making registry changes, backup your registry with this popular
free and easy to use tool:

http://www.snapfiles.com/get/erunt.html

For PS/2 keyboards, launch the Registry Editor (Start, Run,
regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters

For USB keyboards, launch the registry editor (Start, Run,
regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\kbdhid\Para meters

Click Edit, select New DWORD Value and name the new value:

CrashOnCtrlScroll

Double-click the CrashOnCtrlScroll DWORD Value, type 1 in the Value
Data text box to enable the feature, and click OK.

Close the Registry Editor and restart Windows XP for the changes to
take effect.

When you want to cause a BSOD (when your system has stopped
responding), press and hold down the [Ctrl] key on the right side of
your keyboard, and then tap the [ScrollLock] key twice. Now you should
see the BSOD and you will have a crash dump file to analyze.

You may not see the information about your problem on the BSOD screen,
but you will find the answer in the crash dump file. You may need
help interpreting your crash dump file if you have never seen one
before.

You can read about the feature he

http://msdn.microsoft.com/en-us/library/ff545499.aspx

There is no harm in leaving the feature enabled (mine is always on),
but if you are compelled to remove it, just undo the change you made
in the registry.

Launch the Registry Editor (Start, Run, regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Pa rameters

or

HKLM\System\CurrentControlSet\Services\kbdhid\Para meters

Select the CrashOnCtrlScroll value, click the Edit menu, and select
the Delete command.

Close the Registry Editor and restart Windows XP.

Go ahead and test the new manual crash dump on demand feature to be
sure it works as expected, then wait for the system to hang again.

When you have some crash dump files accumulated, you can learn how to
figure out what is going on with the system when it is hung or not
responding and then you can decide what needs to be done to fix it.

I did not know about the forced BSOD. Thank you for posting that; I can see
where that would be very useful.
--
SC Tom
-There's no such thing as TMI when asking for tech support.