Windows XP Rescue

[SquirrelDip]

My boss came to me today with problems on his home machine. Says it keeps rebooting - even when he tries safe mode...

My first assumption is that he's got the Reboot-R virus that came out a while back.

Shy of reinstalling I'm looking for a (couple of) Live CD virus scaners - hopefully something easy to use.

Tried LinuxDefender Live!, MutaGenix and Knoppix Live - but seem a little involved for a newbie. Also using Trinity Rescue Kit which seems to be the simplest so far (just type "virusscan" when loaded). Maybe a small distro on a USB thumb drive???

Any suggestions? (with links appreciated)

What have you guys used?

[ozymango]

Ugh, where to start. Any way he can bring you the machine so you can just pop out the hard drive from his machine and run a chkdsk/f on it on your own PC as a secondary drive?

I'll assume Windows XP; can you boot from an XP CD and try the recovery option? I've encountered a few machines that just got a freaked out NT loader and restoring them from the CD fixed things. Wouldn't that be a nice and easy fix!

Plus when you recover his drive make sure to keep a copy of all the incriminating stuff he's got on it for when your job review comes up!

[Faustus]

I've found the vast majority of "windows rebooting itself" issues do not usually turn out to be anything so unusual as a virus. Most times some update just jacked up windows hard.

Sometimes safe mode works and a restore fixes it, sometimes you have to do recovery console and chkdsk, and sometimes you got no choice but to backup and flatten the thing.

[SquirrelDip]

Both good posts... He's tried safe mode with no luck.

I gave him the Trinity Rescue so I'll find out tomorrow if it found anything. If not I'll get him to yank the drive and I'll run a chkdsk.

Most likely will be a re-partition/format/install...

[Jeremiah58]

The common reason for rebooting could be PCU overheating, so it would be wise to check the CPU temperature.
If CPU is overheating, a fan (a CPU fan) should be checked.

[fatbloke88]

also check the power supply as this can cause the pc to reboot

[painkiller]

I had a Windows 2000 machine do that, too.
Turned out to be a memory stick (SDRAM) fault.

[Nelson37]

Beep codes or error messages? Any difference if PC has been off for some time?

What recent changes to software or hardware?

Safest course after chkdsk is to do a repair installation, this keeps all files and settings and generally solves OS-related software issues. Also points strongly to hardware if it does not work.

Too many possibilities to narrow it down with no additional information.

A linux boot disk and ntfs reader will allow scans for recent dll files, delete temps, etc.

[ViRaL1]

Around 1/2 of the PCs I've seen with this error can be fixed with either the first or second repair option that you get when you boot from the windows XP CD (best if you're using the same version of the CD; OEM, upgrade, full version, etc.), but I would try those first before reinstalling. Try the first recovery / repair option, running

chkdsk /r

when you get to the command prompt.

[SquirrelDip]

Don't think it's CPU temp. Happens when cold. But will ask if fan is spinning all the same.

Don't know about beep codes but I believe it gets beyond post - XP has started loading. No new software - this is an older machine, I believe, used mostly for just internet.

Will find out today (hopefully) what the result of the virus scan and if it didn't solve his problem then I will ask him to yank the drive and bring it in for a chkdsk.

[Bjs]

Puppy linux + avgfree for linux = usb flash drive capable , been there , it works .
Will have to check for sata update .

Other linux distros should be current with support for sata for newer p4 motherboards , check , I have one , think it was a bootable debian with avgfree , though cranking that onto a usb flash drive would required one with greater capacity than 1 gig .

Problem is that it will not actually beable to cure any serious bugs within the xp systems os , as this can only be done in xp while the os is active .

----

Hardware side .

1:

Replace mouse and keyboard , retest .
Works = Not all devices are made equal , you got dud's .

Just because they look the same , dosent mean they will function the same , I have come across junk that cause's similar problems .

Buy quality units .

2:

Replace pcs power cord with known working unit .
Works = failing power cable (it happens on rare occassions) .

3:

Remove reset button switch cable from motherboard , then power up system .
Works = Failed reset switch (this one drove me nutts years ago) .

4:

Remove power cable from motherboard to power on button on front of case .
With system power on , short across those two pins with a small metal object .
Works = power on button , on case is faulty .

5:

Disconnect all other drives except for hard drive , and power up .
Works = other drives , check for faulty unit causing conflict .

6:

Above failed to recover system

Time to remove all none essential cards from internal pc slots .
If no onboard video , turn system off , remove power cord , remove gpu , clean , and firmly reinsert gpu .
Reconnect power to system , and repower .
Works = addon card at fault / possible conflict with shared resources .

Theory :

Onboard agp / agp slot / pci 1 = share resources (only one can be used or fitted)
Pci2 / Pci3 = only one may have a card installed (shared resources)
Pci4 / Pci4 = only one may have a card installed (shared resources)

Incorrect placement / organization , can cause resource conflicts / damage to devices .

7:

Psu , check with replacement unit of known quality .
Works = poor quality / failing psu (happens often) .

8:

If all others above failed , close examination of motherboard components (capacitors - little metal cans) required to identify faulty units .

Changed colour when compared to similar types .
What appears to be a tar substance on top of capacitor .
Removal of mother board may be required to check for capacitors with blown out bottoms (it happens) .

Any issue with capacitors on mother board will cause erratic behaviour of system startup .

Motherboard replacement advised (done a few lately) .

9:

Faulty memory = hardly the cause .

10:

Faulty cpu heatsink = rare , but in extreme case's it is possible .

Watch out for "friday" pc specials from unreliable sources .

Modern pcs required thermal tape / replacement (artic silver "5") , on a few occassions , people have used the older types , which will fail within a very short time causing motherboard damage as it evaporates .

11:

Check how many external devices are connected at the same time , its another possibility that usb current is being overdrawn , which would cause reset .

If this happens , the apic controller on the motherboard will nolonger function at 100% , and external usb devices may become problematic (dissappear for no reason) . If this ever ocurs , and system use's addon agp gpu , rip it out asap , as it will eventually fail due to overheating .

Symptom : Sudden lose of display , unable to switch back on unless entire system is restarted .

Systems using onboard video may display no video symptoms other than random errors from connected usb devices and poor thoroput to / from .

[ntscuser]

Corrupted boot sector. This is one of those occasions when your boss will wish he'd made a boot sector rescue disk before the problem occured. As a general rule, OEM versions of XP won't let you boot directly from a CD.

[SquirrelDip]

Thanks guys.

He still hasn't ran the scan - I'm also thinking this machine may be older than I first thought.

Best option is probably going to be yanking the drive and getting his data off it. He can afford a new machine...

[TBoneit]

Lots of times a corrupt hard drive will give a blue screen and reboot. Running chkdsk from a install Cd may fix it.

[Des]

I've had this issue with a Compaq laptop. Turns out the bios needed to be updated after a Windws XP update. Updating the bios fixed the problem.

You can also downlaod and create a BartsPE disk to start the machine up frm a CD and run some diagnostics, spaware check, etc. Might help:

http://www.nu2.nu/pebuilder/

http://www.tweaksforgeeks.com/Setup_Barts_PE.html

Good luck.

--dES