locked
Strange shutdown dialog problem RRS feed

  • Question

  • I have a user on a laptop running Windows XP SP3.  Starting sometime last week, he says that his machine will just randomly display a shutdown dialog.  He can cancel out of it, but he says sometimes he had to do it three or four times in a row, and other times it might be long periods between appearances.  The shutdown dialogs also appear when he is away from the machine.

    I've checked his machine for spyware/malware/viruses and found nothing identifiable.  I've checked his keyboard for any stuck keys and his keyboard appears to be working normally.  I've also checked to see if the power button could be the culprit, but if the power button were glitchy, the machine would just shut down without a shutdown dialog.

    After a couple of hours, I've come to only two possible conclusions.  One, the machine is erroneously thinking that the sleep button is being pressed.  In the power options, it is set to prompt "What should I do?" when the sleep button is pressed.  Only problem is that the laptop does not have a separate sleep button, and sleep mode appears to only be triggerable with a keyboard combination, but as I said before, the keyboard appears to be working normally and these dialogs are appearing even when he is away from the computer.  Second, in my research, I found that a single line of Javascript can cause the shutdown dialog to appear.  I am thinking that one of the websites he visits may be compromised and has this Javascript in it somewhere, or possibly could be caused by a bad ad in the site's advertising rotation.

    Has anyone else seen this or have any other possibilities?

    Monday, July 25, 2011 9:03 PM

Answers

  • Well, on my day off, someone went to the user grabbed the machine, worked with it for a while and through trial and error, removed Flash and Java.  After that, the machine seemed stable and was returned to the user.

    Later in the day, the problem resurfaced, and they started reloading the OS on the machine.  When I got to it the next day, the machine was asleep.  I woke it up, and it went right back to standby.  I brought it out of standby again and worked with it for a few minutes, but in the middle of downloading a driver, it went to standby again.  After that, each time I tried to bring it out of standby, it went straight back into standby.

    At this point, I got on HP chat support, and they had me do another OS reload on yet another hard drive.  I got Windows XP loaded, three drivers, and was working on the fourth, when it put itself into standby.  I woke it back up and HP support poked and prodded the machine remotely for about an hour, but could not get it to do it again.  They left it for me to monitor.

    The user of this laptop was also to get the hard drive replaced with an SSD drive, so I swapped the drive yet AGAIN, and started an OS reload.  I got about to the same point as the previous reload when the machine put itself into standby.  I got back on with HP, told them what happened, and they determined the problem to be motherboard and/or video card.  They scheduled an on-site tech the next day.

    The tech arrived, replaced the motherboard and video card, and as the tech was turning it over to us as "done", it went into standby by itself several times.  For a while after that, we all brainstormed about the problem, when I brought up the "|?" problem again.  This led us to believe the keyboard may have been sending random signals to the motherboard.  The tech removed the internal keyboard, plugged in a USB keyboard, and left the machine running all weekend.  (Power management was set to not put the machine into standby, period.)  When I came in this morning, the machine was still on and running.

     

    At this point, the problem does in fact appear to be keyboard and the tech is returning tomorrow with a new one.  Hopefully this fixes it.

     

    After replacing the keyboard, the machine has worked flawlessly since.  No random logoff dialogs or standby's.


    • Marked as answer by Brett242 Tuesday, September 13, 2011 5:26 PM
    • Edited by Brett242 Tuesday, September 13, 2011 5:27 PM
    Monday, August 1, 2011 8:44 PM

All replies

  • It certainly is possible that some sort of ad is displaying this look-a-like shutdown window, it could also be a flash file or something like that. A third party program with a specific setting activated... it could be several things.

    I'm assuming you've not seen this window, right?

    I would use process explorer's "Find Window's process" to see if It's a known process (or not) and what that process is hosting. If you won't be servicing his machine, then you could instruct the user on how to find the process involved in showing this window with process explorer, then start from there your research for a fix.

    Monday, July 25, 2011 9:34 PM
  • OK, here's some additional information and symptoms:

    The laptop is made by HP and the user is running the HP ProtectTools, primarily because he likes the password-saver feature (a feature that will automatically log him into certain web sites or services after he enters his credentials once).  HP ProtectTools also integrates itself somehow into the login process because it replaces Windows XP's normal "CTRL-ALT-DEL to log in" with one that permits either typing credentials or swiping his finger over a fingerprint scanner.

    I mention this because he reported some odd things again today, centered around this problem.  He got a message about an error with winlogon.exe that prompted him to send crash data to Microsoft.

    The other odd symptom he's getting is that whenever he types a question mark, the pipe character has begun to appear in front of the question mark, but he's only typing the question mark.  In other words, he's typing "?" but it's coming out "|?".  I checked his keyboard yesterday and could not replicate this problem.

     

    Any additional ideas?  Am I looking at some new, unidentified malware, or some software problem or hardware problem, or some combination of both?

    Tuesday, July 26, 2011 12:32 PM
  • One thing for sure is that something is really misbehaving on the system but to say if it's malware, software or hardware with such odd symptoms and little relevant data is difficult.

    Why don't you try a clean boot? (http://support.microsoft.com/kb/310353) That should help you discard Windows own services. Then you could just activate a few services from third party apps to verify general behaviour. If the clean boot is not something you want to try (or tell the user to try), then there's also Safe Mode.

    Is there any update to the HP Software running on the system that you know off (ProtectTools or others)? If so, try updating. OEM Software can be a real issue for a system sometimes (either for incompatibilities with other software installed by the user or damage to core files, registry keys or configuration options)

    Again, malware, while is a possibility, there's not enough data to confirm that, you should see the list of running processes or use Autoruns to know what's loaded in the system and see if there's something suspicious.


    Tuesday, July 26, 2011 1:27 PM
  • Well, on my day off, someone went to the user grabbed the machine, worked with it for a while and through trial and error, removed Flash and Java.  After that, the machine seemed stable and was returned to the user.

    Later in the day, the problem resurfaced, and they started reloading the OS on the machine.  When I got to it the next day, the machine was asleep.  I woke it up, and it went right back to standby.  I brought it out of standby again and worked with it for a few minutes, but in the middle of downloading a driver, it went to standby again.  After that, each time I tried to bring it out of standby, it went straight back into standby.

    At this point, I got on HP chat support, and they had me do another OS reload on yet another hard drive.  I got Windows XP loaded, three drivers, and was working on the fourth, when it put itself into standby.  I woke it back up and HP support poked and prodded the machine remotely for about an hour, but could not get it to do it again.  They left it for me to monitor.

    The user of this laptop was also to get the hard drive replaced with an SSD drive, so I swapped the drive yet AGAIN, and started an OS reload.  I got about to the same point as the previous reload when the machine put itself into standby.  I got back on with HP, told them what happened, and they determined the problem to be motherboard and/or video card.  They scheduled an on-site tech the next day.

    The tech arrived, replaced the motherboard and video card, and as the tech was turning it over to us as "done", it went into standby by itself several times.  For a while after that, we all brainstormed about the problem, when I brought up the "|?" problem again.  This led us to believe the keyboard may have been sending random signals to the motherboard.  The tech removed the internal keyboard, plugged in a USB keyboard, and left the machine running all weekend.  (Power management was set to not put the machine into standby, period.)  When I came in this morning, the machine was still on and running.

     

    At this point, the problem does in fact appear to be keyboard and the tech is returning tomorrow with a new one.  Hopefully this fixes it.

     

    After replacing the keyboard, the machine has worked flawlessly since.  No random logoff dialogs or standby's.


    • Marked as answer by Brett242 Tuesday, September 13, 2011 5:26 PM
    • Edited by Brett242 Tuesday, September 13, 2011 5:27 PM
    Monday, August 1, 2011 8:44 PM
  • Ah you got love those dark days at work :P

    Well I hope the new keyboard ends all this, the time lost because of a key malfunction isn't good for anyone.

    Monday, August 1, 2011 9:05 PM