Weird XP startup problem (1 Viewer)

[russi]

My son has an XP service pack 3 desktop for college work. Anyway, today he kept getting a BSOD after the computer has been on for a few minutes, with a non-specific message when I Google it.
However, I can run Bart PE or LInux bootable with software fine. And for extended periods. Like hour or more. - So obviously not hardware.
He did not load new software or drivers.
If I simply boot the computer and it goes to profile login screen, even f I do nothing, it will go to BSOD. Otherwise I can enter Windows in profile, open software or Internet, but will get BSOD. Event log did mention possible Trojan, but how to remove it as the XP will not last more than a few minutes?

He has much college work on it. Ideas?

Russ

 

[RuralGuy]

Boot up in safe mode with networking and download MalwareBytes and run it in safe mode. Pressing F8 while booting will let you select Safe Mode.

 

[JamesMcS]

The event log could also reveal what's causing the blue screen.

 

[russi]

Thanks for the ideas, but... Under XP the system will go to BSOD within 3 - 5 minutes so cannot run Malware Bytes. But Linux boot disk ran Avaira and found a trojan but removed it. Still a problem with XP. I did check event log but only gives a brief number series that I can find nothing on when I Google.

Other ideas? He has a major research project among other things on the drive.

Russ

 

[rainman89]

it blue screens in safemode also?

lookup and download combofix from bleepingcomputer.org run that in safemode and see if that clears up the issue...

also do you have a system restore point you can try rolling back too?

 

[JamesMcS]

Probably a fresh install is going to be the fixer here, it usually is in my experience.... take the HDD out of the dud PC and put it in as a secondary drive on another machine (you can get USB HDD interfaces cheaply if you don't want to mess around in the other machine) and copy what you need off, I'd say.

 

[Insane_ai]

A repair installation would also do the trick.

Here's how: http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/doug92.mspx

 

[JamesMcS]

What does that do exactly? Does it completely reinstall the OS from scratch and leave documents etc. behind?

I always think of Windows as a bit of a house of cards. Nice and neat and stable when it's just finished (installing), but when you start taking bits out of the middle and putting them back in again... well.....

 

[RuralGuy]

It pretty neatly will overwrite the OS files and leave your documents alone. You may however need to spend the next few hours downloading and installing all of the updates that are no longer installed.

 

[JamesMcS]

That IS clever!

Every day's a school day!

 

[Insane_ai]

You may run into an activation problem. It took me a while to find my notes on this but these instructions will help reset the activation timer so you can log in the machine and set up any drivers that may be missing, like the network card which is needed to activate Windows.

Reseting the Activation Trial:
------------------------------
In this example: Your activation period has expired, (past 30 days) and you need to get to Normal mode again.
1. Turn On your PC
2. Press F8 repeatedly and go to Safe Mode. If you cannot get a console at first reboot and choose safemode with command prompt.
3. Logon as per normal
(note: Administrator password is usually blank, but hopefully you know your password)
4. Allow the Desktop to fully load (answering "Yes" to continue into Safe Mode)
(note: This is just a long way of saying go to Safe Mode)
5. Click on Start - Run
6. Type in exactly: rundll32.exe syssetup,SetupOobeBnk (and click OK)
(note: one space, after "rundll32.exe " also the Oo are two letter o's in "oobe"; capitals and comma are important)
7. Wait a couple of seconds (although you will Not see any change)
8. Restart your PC normally (Start - Shutdown - Restart - Ok)
9. You are now able to go to Normal Mode again (For another 30 days !!!)
10. Do whatever you like, you're back to Normal.

 

[RuralGuy]

I have not had problems with the activation timer getting reset.

 

[JamesMcS]

Could also be construed as being a little bit naughty, if you were of that ilk - but then none of us are are we?

 

[Simon_MT]

Another method if there to mount the drive on another PC as a secondary (Slave) drive and check this drive out using whatever tools you have available - Anti-Virus and chkdsk on the enslaved. There should be spare internal power leads and connectivity on the cable. There are jumpers and a diagram on the most drives as to which jumper setting to use.

Simon

 

[Insane_ai]

Re: Weird XP startup problem
Could also be construed as being a little bit naughty, if you were of that ilk - but then none of us are are we?

Any tool can be mis-used. I am not in any way supporting piracy or abuse of licensing.

I did not interpret your comment to be accusatory, I simply felt the need to clarify.

 

[JamesMcS]

Of course they can. Just my liddle joke

 

[Simon_MT]

Who cares about the legitimacy, in a situation where XP has broken, one gets out the toolbox and you don't care whether you use a spanner or a crescent.

Simon

 

[russi]

First, I want to thank all of you for your time and ideas. The slave drive in another PC sounds okay.

No, he did not have System Restore setup. And, chkdsk has found no problem. Chkdsk finds no problem.

I guess my big question is this. I have seen the BSOD on other computers but always when the PC would not boot into Windows. This is different in that it will boot fin einto a profile and I can even do the Internet. But after 3 - 5 minutes, it stops and goes to BSOD. Unfortunately not enough time to run combofix, I would think. Has anyone ever seen that?
The Event Log shows an error but with an error code that does not show in Google. 1000008e Followed by parameter errors 1, 2, 3, 4 with some numbers after each parameter.

Russ

 

[RuralGuy]

Maybe this link will be helpful: http://aumha.org/a/stop.php#0x8e

 

[Simon_MT]

I would try scanning the disk for viruses.

When does this error occur, what application are you running?

Here is other link:

http://support.microsoft.com/kb/903251

1) I would also try looking at if there is anything in Startup

2) Look at regedit

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Simon