intranet slows down and needs reboot at 6pm

[zenusa]

i have this unique problem with the network at a friend's work place. All his computers (4) running different Windows OS (2000 and XP) slows down and then hangs between 6 to 7pm everyday. Mostly they use MS Word and type documents. One has to reboot the system and then it work fine. all the machines are connected to a central server. I applied latest Noton antivirius definitions and did a comprehensive virus check on the server. didnt find any virus or trojan. Any clues as what may cause this or how I can proceed to get to the root of this problem. Any experience or suggestions shall be greatly appreciated.

[NooNoo]

Welcome to Windrivers zenusa

If it's always the same time then look for scheduled jobs - antivirus checks, backups, indexing etc...not just on the server, on all the machines.

[zenusa]

Welcome to Windrivers zenusa

If it's always the same time then look for scheduled jobs - antivirus checks, backups, indexing etc...not just on the server, on all the machines.

Thanks so much NooNoo. Due to some reasons so far I didnt get chance to revisit the place ( they are very busy I guess). but I am going tonight and will exactly look for the thing you suggested and will get back to your advise again if couldnt crack. regards.

[bcvanbell]

Thanks so much NooNoo. Due to some reasons so far I didnt get chance to revisit the place ( they are very busy I guess). but I am going tonight and will exactly look for the thing you suggested and will get back to your advise again if couldnt crack. regards.
Also consider checking the event viewer. Always useful information there.

[zenusa]

thanks once again,
i checked into all the options like backup log (there is no backup), sceduled tasks (no tasks scheduled), indexing (none), antivirus (nothing scheduled, it runs whenever the system reboots). I looked into the event viewer (log) and find these two events occuring somewhat the same time - EventID 1053 and 1054. these, when I checked on Internet gives an explainantion "A network connectivity or configuration problem exists. Group policy settings can not be applied until the problem is fixed." I apperently couldnt find anything wrong the way Network properties are configured.

The other day, when this problem occured again, I made me friend to do a ctrl+ALt+del to go to task manager and we find "MsgSYS.exe" running over winword.exe. it shows
CPU usage =0, MemUsage=2060K, VM size=748K

when we do end task to this process, machine freezes completely and needs a reboot. before all this machine (actually only Word) slows down.

Any more ideas or feedback please. Do you think reinstalling MS Word can be helpful?

Thanks again to everyone who can be of help.

[imaeditedbysowulo]

thanks once again,
i checked into all the options like backup log (there is no backup), sceduled tasks (no tasks scheduled), indexing (none), antivirus (nothing scheduled, it runs whenever the system reboots). I looked into the event viewer (log) and find these two events occuring somewhat the same time - EventID 1053 and 1054. these, when I checked on Internet gives an explainantion "A network connectivity or configuration problem exists. Group policy settings can not be applied until the problem is fixed." I apperently couldnt find anything wrong the way Network properties are configured.




Any more ideas or feedback please. Do you think reinstalling MS Word can be helpful?

Thanks again to everyone who can be of help.


What's the exact error description that is given in the event viewer? WWW.eventid.net has a pretty decent database of event errors, but knowing the exact text that comes with the error code would help narrow it down. I don't think reinstalling Word will help, it sounds like a problem with the server's network configuration or a 3rd party software application on the server which is causing the problem.

Was there any Intel LAN management software running on the server? That's the only mention of msgsys I could track down, but it's possible that it has nothing to do with your problem.

What's the biggest hammer you have in your toolbox?

[zenusa]

Thanks Imaedited....

That event id link is helpful. I cant recall the exact message of the events (1053 and 1054) but definitely its source is "usrenv" or user environment and talks about group policy settings. usrenv talks about "not being able to apply group settings". Now one thing I am not sure about is if this event occurs when the system slows down or this happens when the machine is rebooted (both things happen one after the another). Can there be something wrong with the group policy setting assignements when the computer is booting up? again rest other programs like Internet explorer and net browsing seems to be working fine. this happens only with Word.

I have exhausted all my hammers except ofcourse laying the whole network right from reinstallation of OS and step by step working with each machine on the network. Unfortunately, given the circumstances, this hammer is not to be lifted at all :)

Please give me some more clues to look into.

Zen

[bcvanbell]

I looked into the event viewer (log) and find these two events occuring somewhat the same time - EventID 1053 and 1054. these, when I checked on Internet gives an explainantion "A network connectivity or configuration problem exists. Group policy settings can not be applied until the problem is fixed." I apperently couldnt find anything wrong the way Network properties are configured.

when we do end task to this process, machine freezes completely and needs a reboot. before all this machine (actually only Word) slows down.

Any more ideas or feedback please. Do you think reinstalling MS Word can be helpful?

Thanks again to everyone who can be of help.
I have a similar problem at one of my sites. At mine it also shuts down the NIC. NIC starts back up after 20 minutes and all is fine. In the meantime the network connections are lost. I have traced it down to the IP refresh cycle (from the router), but I don't know why the new IP address is not implemented. My problems started when I switched from a Linksys router to a Freesco firewall.

[Six Eyed Smily]

could be spyware that reports back to source at 6pm - try adaware.

is the server running active directory?


- EDIT also check DCHP lease times - try extending them to a few days.

[imaeditedbysowulo]

could be spyware that reports back to source at 6pm - try adaware.

is the server running active directory?


- EDIT also check DCHP lease times - try extending them to a few days.


I agree with this. Run spybot and adaware on the server and all the client pc's.

I would also delete the Normal.dot template from the Word directory. I forget what problem this actually fixes, but it's worth a shot as well.

I would also make sure that every computer is completely up to date with their windows versions AND their office versions. Other than that I can't think of any other suggestions, but get the actual error message along with the error code next time you go back.

[zenusa]

Hello again folks,

I have now some concrete clues to the root of the problem which I am sharing here with you and would appreciate if I can get a solution to it.

I checked on to the event viewer - applicationand find this error message "application hang", Event :1001 followed by "Application Hang" Category:101, Event 1002. Sorry I am unable to attach the screenshot or any attachment. I can email it to any of you.

In its description it says
************************************************** ****
Hanging application WINWORD.EXE, version 11.0.5604.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Fault bucket 57586923.
************************************************** ****
Doing some search on that I found some more clues

http://www.eventid.net/display.asp?eventid=1001&eventno=1629&source=Application%20Hang&phase=1

AND

http://www.tech-archive.net/Archive/Word/microsoft.public.word.application.errors/2004-06/0614.html

The above link discusses the same problem and clues for a possible conflict between Norton AntiVirus and MS Office application. Now the solution suggested by one of the members does not work for me either.

The environment on the target machine is
WindowsXP prof ver2002 SP1, MS office 2003 and 2002 on others, Norton AntiVirus (NAV Corporate edition 7.60.926)

I have also run spybot on the machine and there is no adware or spyware on the machine. Also I havent updated the said machine for SP2 for XP though the machine is always updated for latest updates.

Please give your inputs and help me crack this.

[gizmo1_1]

Try this

Disconnect from the internet (first)

Temporarly disable Norton Antivirus on the workstations.
There are certain aspects of NAV that are redundant. I havn't used Norton for years, but know that if left at default. It will scan on read, write, and execute of a file.