Dr. Watson when shutting down WIN XP home

When I shut down windows I get a quick message that some file related to Dr. Watson, like drwtsn32.exe or drwtsn32.log or dwwin.exe can not load. Is there some way to stop this message from appearing?

 

Have you checked your event logs to see if there is more detail available?

From a run line,

Code:

sfc /scannow

to let the system file checker locate and replace any damaged or missing system files - and the Dr. W. files certainly are among those.

How about trying a cmd prompt and chkdsk /f or chkdsk /r on the system drive/partition?

 

Hmm. i saw this scenario once a while back.. When a machine shuts down, there comes a point when new applications cannot be started. Lets say that on the way down, one of your background programs crashes, the system will try to start the drwtsn32 debugger to make a crash dump file. If the machine is past the point of no return, you'd see a brief flash of a dialog box saying something like DRWTSN32.EXE Failed to initialize, 0x10000c132 the system is shutting down or something like that and then it would dissapear as the machine powered off. Does this sound like this is whats happening? Can you try hard to get the EXACT text of the dialog by shutting down a couple times in a row and watching close?

I like newt's idea as a good first step to ensure the machine is healthy and checking the event log.

 

Thanks fellows. Yes, Joe it is as you say. This happened a couple of weeks ago and then it fixed itself. Today when I shut down, I received a message that something in windows was trying to repair something. I suspect when I shut down tonight, the problem will have disappeared. but if not I will try to catch the line exactly.

 

You can turn off the Dr Watson Postmortem Debugger, as it really doesn't do anything but cause problems when it crashes. You have to disable it from the registry. I suggest you save a copy of your registry before making any changes.

Navigate to this key:

Hive: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
Name: Auto
Type: REG_DWORD
Value: 0 disable
Value: 1 enable

And just set it to 0 to disable it. Restart the computer, and it should be gravy.

 

You can turn off the Dr Watson Postmortem Debugger, as it really doesn't do anything but cause problems when it crashes

if i may strongly disagree with this statement. This information is innaccurate. Please see the 200 or so user mode dumps i have analyzed on this board for why you shouldnt disable it.

I'm not sure what bad experience you had to draw you to that conclusion, but if folks followed this advice, and come to ask for help, the first thing i have to do is tell them to reenable it and wait for another occurance, rather than just looking at the data from the crash.

 

The bad experience I've had involve the instability of the program. I've had it crash on many systems more than the system itself. I kill the debugger, and it regularely solves my stability issues. Once in a blue moon, it comes in handy, but it's as simple as going into the registry and turning it back on at need.

 

Joe,
The box flashes by so fast that I can hardly read it. But what I see is this:
The application failed to initialize............
can not read dots but there are no numbers.
When I run the eventvwr.msc and look at what happens as it shuts down we find this:
"Application popup drwtsn32.exe-dll
Initialization failed. The application failed to initialize because the window station is shutting down "
The event before this one was the same except that drwtsn32.exe... is replaced by dwwin.exe-dll and the rest of the info is the same.
Looks to me like Dr. Watson is attempting to initialize--not sure why.

 

DJ_Mittens- dont want to hijack this thread... if you want to explore options for determining why drwtsn was crashing, i have some ideas.

ackerberg- Well, now we have a real pickle. Somethings crashing on shutdown. Have you tried doing a LogOff instead of a shutdown, does the phenomenon occur then?

If not, there are only a couple of ways to troubleshoot this.
option 1
1) open task manager, on the processes tab.
2) View->select columns. Add User Name
3) sort by your username. You can safely kill anything running as you.
4) try killing the first one, shut down. did it do it?
5) try killing the second, shutdown.. repeat until we know which process is doing it

option 2
microsoft support has a tool called userdump that can install as a service and monitor exceptions. It runs all the time, and avoids the problem of process init sometimes

option 3
Enable Process Tracking auditing using Local Security Settings and try to match the process that exits around the same time as you get your watson popup.

 

I have never logged off. I never registered as a user, only as the owner. If I logged off, how would I log on?
I hit Ctrl-Alt-Del, brought up task manager->processes tab->view->columns and 3 things are checked:
CPU usage
Memory usage
user name

I unchecked CPU and memory usage. There are a many entries left called user, with the others called system. This would take me long time to kill each one and reboot.
Where do you find the tool userdump?
How do you enable process tracking?

 

You can right click on my computer and choose manage, and in there you can set your passwords to make sure everythings set to something you remember before you logoff.

The amount of junk you have installed on this machine is what put you into this situation. Its going to require some time and effort. If you did two or three at a time, you should be able to narrow it down quicker.

you'd need to open a ticket with microsoft support to obtain userdump.

process auditing is in administrative tools->local security policy

 

Joe,
I am one of the most conservative people you will ever meet about loading junk on my machine. The only junk is what Compaq put on the machine during manufacture. I only add things I use like Adobe Acrobat, Dreamweaver, Photoshop CS, etc. and not much else except for NAV, Ghost, and Partition Magic. In looking for a crack I did pick up a trojan horse, a worm and a virus, all found by NAV and removed. Perhaps there is a remnant from that experience that was not removed even though I have run NAV and MS Antispyware (previously Giant Spyware) many times since. This problem on signoff does not bother me and surprisingly enough does not occur every time.