WinXP died, virus or what?

[bevills1]

Multi boot system running Win98SE, Win2k and WinXP Pro with SP3 boots and runs normally in Win98SE and Win2k but not WinXP on 2 different PCs. WinXP boots okay when booted normally and things seem to work for about 30 seconds after boot at which time no programs including StartMenu respond to mouse click, and Task Manager isn't opened when Ctrl-Alt-Del is pressed. Boot WinXP to SafeMode with Networking works as expected which is how I'm posting here. This problem began 9-13-13 on both PCs which lead me to suspect possible virus, but I've found no report from Google searches of this kind of virus recently and am running Avast anti-virus, Spybot Search and Destroy plus Zonealarm. All of the following have been tried, but the problem persists:
1. Ran disk cleanup and defrag
2. Ran chkdsk /r
3. Ran msconfig and unchecked all programs under the startup tab
4. Ran System Restore and restored system to 2 available restore points
5. Restored recent backup image
6. Did repair install
This is the first time I've had an identical problem occur on 2 different PCs simultaneously and the first time I've had the restore of a recent backup image fail to fix any Windows problem. I now wonder if even a fresh install will fix the problem. Both the PCs were originally setup with IDE hard drives and ran without issue for several years, but both PCs were upgraded to sata drives within the past 6 months. Could sata drives be an issue on some systems, and would reverting to IDE drives fix the problem? Does anybody know of possible cause or fix for this problem?

[Gramps]

Try installing Malwarebytes and run a full scan with it in Safe Mode. See if it finds anything.

[aedipuss]

since a backup image fails to clear it up i would suspect a boot sector trojan. it's at least something to check, but i've never tried it on a multi-boot drive. after that i would run a self booting cd with av on it like kapersky's rescue disc.

1. Insert the Windows XP CD-ROM into the CD-ROM drive.
2. Restart the computer from the CD-ROM drive.
3. Press R to start the Recovery Console when the "Welcome to Setup" screen appears.
4. Select the installation that you want to access from the Recovery Console.
5. Enter the administrator password and press Enter.
6. Type the following command and press Enter:
fixmbr
7. Following the onscreen instructions to restore the Master Boot Record.
8. Type exit
9. Press Enter. The computer will now restart automatically.

[vhelp]

[edit]nevermind, just reread your initial post.
if i may ask.. what exactly is the symtom, "died" ?

does the bootup fail ?
does it go into an endless loop of booting up, and just near the end, where you see a list of files showing, it hangs or reboots again, endlessly like this ? [/edit]

i ask because i had a nasty problem like this about three years ago on my netbook. nothing worked to restore. at the time i did not have an image. in the end, i ask an IT friend if he could do something for to fix it. when he was done, i asked what he did to fix. he said he restored one of his images to the netbook. i was back in business. from that time forward, i've since imaged it, using norton ghost, the 2003 version.

[jman98]

What a shock. Windows crapped all over itself and you can't boot. I wish I could get paid for every time I had this happen to me. Seriously. EVERY time it required a complete reinstall. I will admit that in the past I wasn't using a UPS and I do now believe that this had something to do with my problems (if you aren't using a UPS, this may be why it happened to you too). I live in an area with unreliable power and just about every month I will briefly have a brown out. I think the brown outs just took their toll. I haven't had this problem at all since I started using a UPS.

Maybe the recovery console will work for you, but I NEVER, not even once, was ever able to fix the "Windows won't boot" problem with it. I tried everything too.


If your PC lost power without being shutdown properly, it can cause this issue. Sometimes the only "fix" is to reinstall Windows. Try the suggestions you get, but based on your post I'm pretty sure that in the end you're going to do a reinstall.

[bevills1]

Running fixmbr from Recovery Console didn't help. Windows does boot fine and works normally for around 30 seconds and then stops responding as stated in initial post. The really strange thing to me is that it happened simultaneously on 2 different PCs!

[jman98]

Yep. Been there and had that happen to me too. That's why I warned you that a complete reinstall was very likely your only solution.

If Windows wasn't such a complete and utter POS operating system this kind of thing would be a lot rarer. I'm not telling that such is impossible under Linux or OSX, but it definitely happens less.

[nic2k4]

That's interesting, can you think of what you did on both PC just before this happened? If you installed some program and still have the installer, take it to Virus Total.

Your problem started on a Black Tuesday patch week and there was some bad patches this month, but only Office was affected. It gets worse, the same thing happened in August! Who knows you could be one of the few with an odd enough configuration that is affected by an update that most have no issue with. That's why I wait a week before updating and manually download the updates.


I've seen something a lot like that on older PC's (single core < 2.5GHz) running XP SP3, the PC boots to the desktop and within a minute it seems to be frozen except the hard drive is going like crazy and if you manage to get task manager up, the CPU is at 100% and a SVCHost process is hogging 99% of it. If you kill it everything goes back to normal, but you lose Windows Firewall and the internet. It turns out it's a bad Windows Update Agent service; Windows Update Agent 3.0 fixes it.


This might help you more, go to the Microsoft Fixit Center and follow the instructions. There's a portable version if internet access is a problem. You'll have to download the installer from another PC and run it to get the actual Fixit tool.


Vhelp does make a good point, your best protection is to image your drive regularly. Everybody knows it and most don't do it until they get bit in the rear. I like Acronis True Image, it has network access and can use any external drive, it can add a boot manager that lets you run it from the hard drive so it's only one keystroke away. Paragon has something similar and every once in a while you can get if free from the giveaway of the day.

[Mephesto]

NEVER use Spybot S&D, it did something to my registry last time I ran it and I couldn't connect to the net at all and there was no way to fix it until I found an old backup of the registry I replaced it with. I was so pissed.

However it didn't lock up my OS so I doubt that's the issue but I wouldn't trust Spybot not to **** up anything TBH.

Like the guy above me asked, explain in detail what the last thing you remember doing before this happened. It is likely that something is taking up 99.99999% of the CPU, this happened to me before with services.exe after installing a CD emulator program. Does your computer have only one core?

[classfour]

malwarebytes in safe mode won't harm a thing - use it with rkill.

Spybot can trash the registry - so it takes knowledge and a light hand.

You can also use avast free antivirus - run a boot scan.

[bevills1]

When the problem started, I had been just checking email and visiting forums I normally visit and nothing unusual. At the Microsoft Fixit link in reply #8 I'm unsure which category to select there. However, if the problem were caused by Windows update, shouldn't restoring an image from an earlier time fix such a problem since there'd be no recent updates installed?

[aedipuss]

try mbar. it's malwarebytes anti-rootkit beta. if it happened while online you are most likely infected with something nasty. stealth installs happen all the time without you having to do anything.
http://www.malwarebytes.org/products/mbar/

another good one is the self booting kapersky rescue disc, but it's no longer developed and getting a bit old. it will still update virus defs though.

[Nelson37]

Describe drives and/or partitions used for multi-boot. If done on a single drive, this is a bad idea and will complicate the repair.

Describe in detail procedure for restoring backup image. Partition or drive image? A drive image restore failing to solve this problem is extremely unlikely and damn near impossible if done properly. Was the drive formatted during this process?

Msconfig, you must check ALL tabs, just the startup area is pretty much worthless. It works OK in safe mode, the answer should be in here somewhere. MSCONFIG with all options disabled is almost the same thing as Safe Mode. Not quite, but damn near.

MANUALLY clean all temp directories. You cannot rely on a program to do this properly.

Install, update, and run MalwareBytes. Report results.

[bevills1]

Step 5 of my initial post which was restore recent backup image was done on just 1 of the 2 PCs. Uninstalling Avast on the PC which did not have an image restored got the system to where Task Manager does launch, and mouse click works albeit very slowly. Finally a Java update was installed although it took about 20 minutes due to slow response. Then Windows updates were installed which returned that PC to normal function. This seems to indicate that Avast update may have been the cause of problems. Now should Spybot be used on that PC, and is there a good free Avast alternative to use for anti-virus?

Then I tried same steps on the PC to which an image was restored which succeeded through the step of Java update, but Windows update doesn't run while all mouse click response remains very slow. Trying to run Windows update it gets to the "Checking for the latest updates for your computer..." screen and stays stuck there. Is there any other way to try to get Windows update to run?

[aedipuss]

sometimes going into msconfig and unchecking everything non-essential in the startup tab will free up the computer.

[nic2k4]

Step 5 of my initial post which was restore recent backup image was done on just 1 of the 2 PCs. Uninstalling Avast on the PC which did not have an image restored got the system to where Task Manager does launch, and mouse click works albeit very slowly. Finally a Java update was installed although it took about 20 minutes due to slow response. Then Windows updates were installed which returned that PC to normal function. This seems to indicate that Avast update may have been the cause of problems. Now should Spybot be used on that PC, and is there a good free Avast alternative to use for anti-virus?

Then I tried same steps on the PC to which an image was restored which succeeded through the step of Java update, but Windows update doesn't run while all mouse click response remains very slow. Trying to run Windows update it gets to the "Checking for the latest updates for your computer..." screen and stays stuck there. Is there any other way to try to get Windows update to run?

What kind of specs are we looking at on that PC? Avast is killing it, is it a P4? I just went through the same trouble you described on a P4 2.8. I can tell you that you need to remove a number of the "shields" in the new versions of Avast just so older PC's can keep up. Your best free choice is MS Security Essentials.

Open task manager and click on the process tab, click the view process from all user box, then click on CPU column header twice, that will list the process in order of CPU usage. If the PC is not doing anything, the top process should be system idle process (99). If you see SVCHOST steady at the top, you probably have that problem with update agent. Download the new version, install it and let it run.

You can force the windows update service to run instead of using the web based one, just open automatic updates in control panel and change the scheduled time and day to everyday and to a time within the next hour, apply and wait. That P4 was slow at first, but when I came back later it was fine and the SVCHOST has not shown up since. I wonder if it's not something MS did to push more people off XP before next April.

[bevills1]

The PC is AMD Athlon 2600+. In task manager it shows svchost fourth on the list at 3,508. I'll try setting the time for update and wait as suggested to see if that works. If I'm unable to get updates to run I may have to try a fresh install to fix this on the second troublesome PC.

[nic2k4]

Those old PC's are starting to have a hard time keeping up with modern software (especially AV's). It doesn't help either to have a bunch of useless stuff loading at boot time; all those icons that never get used next to the clock. Most of them have an option to disable them, you may have to dig deep in the program's preferences or use Ccleaner.

There are some services you should disable too; google services that can be disabled in XP. Indexing Service is definitely one that should be turned off on old PC's.

There are a number of SVCHOST listed in task manager, they're all linked to some Windows function, it's just not clear which one does what. The 3,508 is the amount of memory used by that process, the column left of it is the CPU usage (it can be 0). When you click a column header it sets the order of the listing, first click is an ascending listing, click once more and the order changes to descending.

If you're doing a fresh install look at slipstreaming the lastest updates into your XP CD. Just use nLite and this update pack; you can even add SP3.

[bevills1]

A fresh install was done, but same problems persist. Perhaps the answer to the question in my initial post "Could sata drives be an issue on some systems, and would reverting to IDE drives fix the problem?" might be yes. If not that, then it must be some other hardware problem in the system.

[aedipuss]

bummer. the caps on your motherboard are probably dying. as they quickly heat up they can't maintain voltages properly and the cpu hangs. you've gotten more than the expected lifespan out of it though... i retired my 3200+ at least six years ago for the same problem. still have the chip but it's all that works.

[nic2k4]

"Could sata drives be an issue on some systems, and would reverting to IDE drives fix the problem?"

It's a known problem with optical drives and I imagine it's not impossible there might be issues with early SATA150 controller and SATA600 drives.

The bad caps issue would be a good answer too; it's easy enough to check them for bulging tops and goo oozing out.

[bevills1]

Could caps on motherboard dying cause problems only when booted normally to WinXP with no problems when booted to WinXP safe mode, booted normally to Win2k or booted normally to Win98SE? That may explain why Task Manager shows cpu usage 100% in normal boot if caps dying is the issue.

Edit: The possibility of SATA drives being an issue was ruled out by disconnecting SATA drives and connecting IDE drives instead. The system seemed to work okay at first, but response slowed and cpu usage increased for about 30 minutes after boot, and cpu usage climbed to 100% usage with extremely slow response after about an hour after boot. This seems to support caps on motherboard dying to be the root of the problem.

I'll replace the motherboard tomorrow and will hopefully be good to go. It's very strange though that the same exact problem occurred simultaneously on 2 different systems, and 1 recovered while this second 1 did not. I wonder if I might expect the other PC to die the same way in the near future!

[aedipuss]

probably not. if the caps were drying out they would cause voltage fluctuation no matter what was running.

[aedipuss]

the only 100% cpu usage i've seen lately was from a customer's laptop. somehow they had interrupted a windows update and it got stuck. freeing up enough resources by killing off processes that were running and unchecking everything not essential in startup eventually allowed the updates to finish.

you did run mbar or something similar in safe mode right? rootkits can be nasty and loaded from the boot sector so they are not affected by a backup re-install.

[bevills1]

Nothing like mbar was run, and I see no logical reason it would help since reformat and fresh install, restoring image from earlier time and even connecting IDE drives that were from an earlier time than the restored image all resulted in the problem persisting. It seems to me it's got to be some hardware problem, but why it affects only WinXP normal boot I have no clue. The motherboard on the PC is around 8 to 10 years old, and it's reasonable to expect some hardware failure after this much use.

Edit: Ran mbar anyway, and it indicates no cleanup required.

[nic2k4]

While you had the case open did you look around the board for bulging/oozing capacitors? One simple thing you can try is remove the RAM and re-install it a couple times (unplug the power) and clean any dust build up. Better, use a white pencil (not pen) eraser and wipe the contacts on the RAM.

When XP is in safe mode it uses basic drivers and doesn't enable the same advanced functionnality of regular mode; it's easier on the system. Also, the problem is probably caused by a single feature that doesn't load in safe mode.

[p_l]

While you had the case open did you look around the board for bulging/oozing capacitors? One simple thing you can try is remove the RAM and re-install it a couple times (unplug the power) and clean any dust build up. Better, use a white pencil (not pen) eraser and wipe the contacts on the RAM.

Yup, that did it for me at least a couple times. You can also swab with a Q-tip dipped in 70% isopropyl alcohol after the eraser, while you're at it.

Sometimes, it's the simple things. Just again this week, I saved a relatively new Seagate 4TB HDD that "died," by swapping out the cheap SATA cable that came with the computer for a SATA cable with latching clips. Loose, cheap SATA connections I'm sure have been the cause of many a perfectly good HDD written off as "defective." The drive works fine now.

Just a little cautionary tale, however: Be careful not to let a drive attached only by its latched SATA cable fall, because it'll rip out the little plastic male L-shaped connector guide on the HDD.



I just balanced one on the edge of the computer case for a second while reaching for a flashlight, it tipped over and fell only about a foot to the table, but yanked out the plastic L as it fell.

[Nelson37]

If that's the best you can do for a detailed description then I can't help you.

From what you are describing you did NOT do an image restore as any technician I know would understand it.

Oh, and don't let Hech hear you describe Avast as a cause of the problem. He thinks that software walks on water.

[bevills1]

The image restore was done on the first partition of the second sata drive which is a primary partition if that makes any difference. I'm now uncertain Avast was the cause of any problems and really believe it wasn't because I now suspect hardware problems.

I didn't look at the capacitors, but I'll look at that when I remove, clean and replacement of RAM.

[Nelson37]

If your multiple OS installs are each in their own partition, then the "image restore" was no such thing and it is not surprising it did not solve the problem. You need an image backup of the ENTIRE DRIVE. Doing single partitions on a multi-OS drive is a waste of time, except for purely DATA partitions and even then, I would never depend on it. Image backups are an all-or-nothing proposition.

I'll guess that the "fresh install" did not involve a re-partition and format of the hard drive?

You are not starting at a zero point. Your "repair" attempts still include the boot sector of a drive that won't boot. Most standard repair tools that will fix a single-OS drive will NOT work properly on a multi-boot drive.

Get a hard drive. Delete all partitions. Create partition. Format. Install ONE and ONLY ONE operating system. Test. Assuming the drive is functional, that is how you ELIMINATE the hard drive and all it's installed software from any possibility of being the problem.

You have not done the proper diagnostic steps, that is why you don't have a workable answer. IT BOOTS IN SAFE MODE, that tells you 95% of what you need to know. Correctly running the MSconfig diagnostic is the next easy step.

Rather than acting like a headless chicken, you need to have a plan that actually eliminates some types of problem and focuses on others. So far, you have eliminated nothing and wasted a lot of time.