Windows Defender shuts down XP Laptop after latest update.

[Guest]

After I allowed the latest update to Defender, XP shuts down Windows citing
the following file: IDEChnDr.sys. I have to pull the battery on my laptop
to reboot. When I reboot, it last 5 to 10 minutes and shuts down again. I
removed my access point (internet) and it still shuts down. I uninstalled
Windows Defender and it does not shut down. Each time I reinstall Defender
and accept the update, it shuts down in 5 to 10 minutes. Luckily this gives
me time to uninstall before it shuts down. I have used Microsoft AntiSpyware
since it was introduced and was very happy with the results, and would like
to be able to use Windows Defender. Does anyone have a suggestion how I can
be protected again? Has anyone else had this problem?

 

[NoOp]

After I allowed the latest update to Defender, XP shuts down Windows citing
the following file: IDEChnDr.sys. I have to pull the battery on my laptop
to reboot. When I reboot, it last 5 to 10 minutes and shuts down again. I
removed my access point (internet) and it still shuts down. I uninstalled
Windows Defender and it does not shut down. Each time I reinstall Defender
and accept the update, it shuts down in 5 to 10 minutes. Luckily this gives
me time to uninstall before it shuts down. I have used Microsoft AntiSpyware
since it was introduced and was very happy with the results, and would like
to be able to use Windows Defender. Does anyone have a suggestion how I can
be protected again? Has anyone else had this problem?

http://www.google.com/search?hl=en&q=IDEChnDr.sys&btnG=Google+Search

Perhaps the device driver(s) needs to be updated?

 

[Guest]

I just installed Service Pack 2 and updated drivers. Defender ran with no
problem about 2 weeks until the latest update for Defender was installed. To
me that says that the problem is with the Defender update. Are you saying
that you have taken the update and everything still works?

 

[NoOp]

I just installed Service Pack 2 and updated drivers. Defender ran with no
problem about 2 weeks until the latest update for Defender was installed. To
me that says that the problem is with the Defender update. Are you saying
that you have taken the update and everything still works?

No. I use Win2KP (SP4) and all works. However, I have installed WD on
WinXP Home SP2 for a customer and it is working. My suggestion to look
at the drivers is due to the Google posts regarding IDEChnDr.sys and
problems that have occurred with it for the past several years. Could be
that you have a hardware problem, could be IDEChnDr.sys needs to be
updated, etc., could be that WD is now attempting to access something
that it didn't previously[1] etc.

The difference is that I don't use IDEChnDr.sys on any of my systems.
You might try renaming the file to IDEChnDr.old and testing. If that
works, then try downloading the lastest from Intel:

http://downloadfinder.intel.com/scripts-df-external/Product_Filter.aspx?ProductID=663

and see if that corrects the problem.

[1] Given the latest news that WGA (required to run WD) accesses BIOS
and hard drive serial numbers, perhaps WD has a conflict with your
hardware and/or bios:

http://www.microsoft.com/genuine/downloads/FAQ.aspx#Question1Label
Information collected during validation

Q: What information is collected from my computer?
A:
The genuine validation process will collect information about your
system to determine if your Microsoft software is genuine. This process
does not collect or send any information that can be used to identify
you or contact you. The only information collected in the validation
process is:

* Windows product key
* PC manufacturer
* Operating System version
* PID/SID
* BIOS information (make, version, date)
* BIOS MD5 Checksum
* User locale (language setting for displaying Windows)
* System locale (language version of the operating system)
* Office product key (if validating Office)
* Hard drive serial number

 

[Guest]

There is a known malware that uses this file name, which may be why Defender
is now scanning the file, however, I don't believe that's your real problem.

IdeChnDr.sys is part of the Intel® Application Accelerator, which was a hard
disk performance enhancing driver for certain Intel chipsets. It hasn't been
updated since late 2002, and has had known issues with the Windows XP Service
Pack 2 update which released two years later.

The only dependable way to fix the problem is to switch back to the default
Windows drivers, which in some cases reduces performance, but makes the
system stable again. This is done by removing the Intel® Application
Accelerator in Add/Remove Programs per the instructions below.

************************************************************
* 8. UNINSTALLING THE SOFTWARE
************************************************************

NOTE: This procedure assumes that the above installation
process was successful. This un-installation procedure
is specific only to the version of the software and
installation file included in this package.

1. Click on the Start button. Open the Settings menu.
Click on the Control Panel icon to open the Control
Panel window.

2. Click on the Add/Remove programs icon.

3. Select Intel(R) Application Accelerator and click OK.

4. Click on Yes when the script prompts for confirmation.

5. The uninstall script will prompt you to restart the
system.

The following link is to a thread in the Spybot Search & Destroy forums
where someone else had exactly the same sort of problem with that program.
Skim the later posts for more about the severe issues the accelerator
created. I'd get rid of it as quickly as possible.

http://forums.spybot.info/showthread.php?p=19639#post19639

Bitman

 

[Guest]

NoOp,

I tried what you said, renamed idechndr.sys to idechndr.old. I would advise
no one else try this. It took me most of the day yesterday to be able to get
back into the system to rename it back. If you rename it, the computer will
continue to run until you reboot, because it is still in memory. When WD
scanned the computer and found it in memory, AP shut down the computer as it
had been doing. Then I couldn't even boot into the operating system. After
much searching, I found a free utility that allowed me to rename the file
from DOS (NTFS4DOS).

My final determination is that it was not the update that caused the
problem. I was able to accept the update without the shutdown, but it was
the new definition that causes XP to shut down. I was able to continue
without a shutdown after I updated, but when I did a scan with WD and it sees
idechndr.sys in memory, it somehow causes XP to shutdown. I don't want an
antispyware program to have that much control, so I will not use WD unless
they put it back to the way it operated when it was Microsoft Antispyware. I
was able to see many instances when MA blocked access attempts, but I haven't
seen any blocked instances with WD running in real time, except for my Intel
Accelerator, which has always been there.

I just installed Service Pack 2 and updated drivers. Defender ran with no
problem about 2 weeks until the latest update for Defender was installed. To
me that says that the problem is with the Defender update. Are you saying
that you have taken the update and everything still works?

No. I use Win2KP (SP4) and all works. However, I have installed WD on
WinXP Home SP2 for a customer and it is working. My suggestion to look
at the drivers is due to the Google posts regarding IDEChnDr.sys and
problems that have occurred with it for the past several years. Could be
that you have a hardware problem, could be IDEChnDr.sys needs to be
updated, etc., could be that WD is now attempting to access something
that it didn't previously[1] etc.

The difference is that I don't use IDEChnDr.sys on any of my systems.
You might try renaming the file to IDEChnDr.old and testing. If that
works, then try downloading the lastest from Intel:

http://downloadfinder.intel.com/scripts-df-external/Product_Filter.aspx?ProductID=663

and see if that corrects the problem.

[1] Given the latest news that WGA (required to run WD) accesses BIOS
and hard drive serial numbers, perhaps WD has a conflict with your
hardware and/or bios:

http://www.microsoft.com/genuine/downloads/FAQ.aspx#Question1Label
Information collected during validation

Q: What information is collected from my computer?
A:
The genuine validation process will collect information about your
system to determine if your Microsoft software is genuine. This process
does not collect or send any information that can be used to identify
you or contact you. The only information collected in the validation
process is:

* Windows product key
* PC manufacturer
* Operating System version
* PID/SID
* BIOS information (make, version, date)
* BIOS MD5 Checksum
* User locale (language setting for displaying Windows)
* System locale (language version of the operating system)
* Office product key (if validating Office)
* Hard drive serial number

 

[Bill Sanderson MVP]

I've got to say that I continue to feel that getting an updated version of
that driver from Intel is what's needed on your system. If you can tell me
you are seeing this behavior with the current version of this driver from
Intel, then I would be worried.

I've got a number of systems using this Intel application and running
Windows Defender, and haven't seen this symptom, but I tend to be pretty
careful about updates.

These drivers are not too hard to find at www.intel.com and I know that the
older versions had problems that might go beyond the conflict you are
seeing.

I believe what you are seeing is fundementally an application compatibility
issue--not designed behavior of Windows Defender. However, in this case, I
believe that the update needs to be made to the Intel driver, rather than
Windows Defender.

Noop's second message in this thread gave the correct download location from
Intel for an updated driver--version 2.3 from that location (which dates
from 2002) should be the newest.

--

NoOp,

I tried what you said, renamed idechndr.sys to idechndr.old. I would
advise
no one else try this. It took me most of the day yesterday to be able to
get
back into the system to rename it back. If you rename it, the computer
will
continue to run until you reboot, because it is still in memory. When WD
scanned the computer and found it in memory, AP shut down the computer as
it
had been doing. Then I couldn't even boot into the operating system.
After
much searching, I found a free utility that allowed me to rename the file
from DOS (NTFS4DOS).

My final determination is that it was not the update that caused the
problem. I was able to accept the update without the shutdown, but it was
the new definition that causes XP to shut down. I was able to continue
without a shutdown after I updated, but when I did a scan with WD and it
sees
idechndr.sys in memory, it somehow causes XP to shutdown. I don't want an
antispyware program to have that much control, so I will not use WD unless
they put it back to the way it operated when it was Microsoft Antispyware.
I
was able to see many instances when MA blocked access attempts, but I
haven't
seen any blocked instances with WD running in real time, except for my
Intel
Accelerator, which has always been there.

I just installed Service Pack 2 and updated drivers. Defender ran with
no
problem about 2 weeks until the latest update for Defender was
installed. To
me that says that the problem is with the Defender update. Are you
saying
that you have taken the update and everything still works?

No. I use Win2KP (SP4) and all works. However, I have installed WD on
WinXP Home SP2 for a customer and it is working. My suggestion to look
at the drivers is due to the Google posts regarding IDEChnDr.sys and
problems that have occurred with it for the past several years. Could be
that you have a hardware problem, could be IDEChnDr.sys needs to be
updated, etc., could be that WD is now attempting to access something
that it didn't previously[1] etc.

The difference is that I don't use IDEChnDr.sys on any of my systems.
You might try renaming the file to IDEChnDr.old and testing. If that
works, then try downloading the lastest from Intel:

http://downloadfinder.intel.com/scripts-df-external/Product_Filter.aspx?ProductID=663

and see if that corrects the problem.

[1] Given the latest news that WGA (required to run WD) accesses BIOS
and hard drive serial numbers, perhaps WD has a conflict with your
hardware and/or bios:

http://www.microsoft.com/genuine/downloads/FAQ.aspx#Question1Label
Information collected during validation

Q: What information is collected from my computer?
A:
The genuine validation process will collect information about your
system to determine if your Microsoft software is genuine. This process
does not collect or send any information that can be used to identify
you or contact you. The only information collected in the validation
process is:

* Windows product key
* PC manufacturer
* Operating System version
* PID/SID
* BIOS information (make, version, date)
* BIOS MD5 Checksum
* User locale (language setting for displaying Windows)
* System locale (language version of the operating system)
* Office product key (if validating Office)
* Hard drive serial number

 

[NoOp]

NoOp,

I tried what you said, renamed idechndr.sys to idechndr.old. I would advise
no one else try this. It took me most of the day yesterday to be able to get
back into the system to rename it back. If you rename it, the computer will
continue to run until you reboot, because it is still in memory. When WD
scanned the computer and found it in memory, AP shut down the computer as it
had been doing. Then I couldn't even boot into the operating system. After
much searching, I found a free utility that allowed me to rename the file
from DOS (NTFS4DOS).

My sincere apologies. I left out:
*Uninstall* the driver

1. Click on the Start button. Open the Settings menu.
Click on the Control Panel icon to open the Control
Panel window.

2. Click on the Add/Remove programs icon.

3. Select Intel(R) Application Accelerator and click OK.

4. Click on Yes when the script prompts for confirmation.

5. The uninstall script will prompt you to restart the
system.

[Ref: http://downloadmirror.intel.com/df-support/4857/ENG/readme.txt]

and then rename idechndr.sys to idechndr.old.

If that works, then try downloading the lastest from Intel:
http://downloadfinder.intel.com/scripts-df-external/Product_Filter.aspx?ProductID=663

Before doing anything else, you might want to check to see if the driver
is the latest (albeit 2002) version 2.3:

C. Microsoft* Windows* XP

* Run 'Start' then 'Control Panel'
* Double-click 'System' Control Panel Application
* Select the 'Hardware' tab
* Select 'Device Manager' button
* Expand the 'IDE ATA/ATAPI Controllers' entry
* Right-click on the 'Intel 82801xx Ultra ATA Controller'
listing, where xx in 82801xx represents the
controller identified by the 'System Requirements'
section of this document
* Select 'Properties'
* Select the 'Driver' tab
* The software version should be displayed after
'Driver Version:'

Intel links for this driver:

http://www.intel.com/support/chipsets/storagedrivers/ultraata/
[End of Interactive Support Announcement]

http://www.intel.com/support/chipsets/iaa/
http://www.intel.com/support/chipsets/iaa/sb/cs-009293.htm
Do I need the Intel® Application Accelerator?
The Intel® Application Accelerator replaces the ATA drivers that come
with Windows* with drivers optimized for desktop and mobile PCs using
select Intel® chipsets. It reduces the storage sub-system bottleneck,
enabling the processor and other system level hardware to be more
productive and efficient. It is not a requirement for your operating
system to work properly.

http://www.intel.com/support/chipsets/sb/cs-015001.htm
[http://www.intel.com/support/chipsets/sb/cs-015001.htm]

http://www.intel.com/support/chipsets/storagedrivers/ultraATA/tti013.htm
[Windows* XP Upgrade Notification]

My final determination is that it was not the update that caused the
problem. I was able to accept the update without the shutdown, but it was
the new definition that causes XP to shut down. I was able to continue
without a shutdown after I updated, but when I did a scan with WD and it sees
idechndr.sys in memory, it somehow causes XP to shutdown. I don't want an
antispyware program to have that much control, so I will not use WD unless
they put it back to the way it operated when it was Microsoft Antispyware. I
was able to see many instances when MA blocked access attempts, but I haven't
seen any blocked instances with WD running in real time, except for my Intel
Accelerator, which has always been there.

It could be a problem with WD; however, it could be that WD simply
caught a hardware/driver problem that has been hiding on your system
without you realizing it. I had a similar problem on a older laptop a
few months ago which I ignored; the hard drive died about a week later...
I'd recommend uninstalling WD for the time being *and* then exploring
the idechndr.sys problem further, particularly if the IAA is already up
to date and at v2.3. Boot to safe mode, run scan disk, chkdsk, (or XP
equivalents) memory diags, antivirus, etc., to make sure that your
system is clean, up to date (all drivers & patches).
After that, if you're still willing to help beta WD, try WD again to
see if it is still causing problems.