What in the gently carress is wrong with this machine.

L

Lightningcount

Thread Thumper
Joined
Oct 9, 2008
Messages
1,116
So I was contracted to do some work for an insurance office. The guy told me he wanted me to wipe three computers clean and reload windows xp pro sp3 onto these machines. The machines are stock Compaq Evo D510 model computers. Two of the three machines gave me no trouble what so ever. After 6 months though, one of the machines would not boot into windows normally. It would go through a loop asking do you want safe mode blah blah blah. Eventually after about 20 attempts, the machine would boot normally. But the problems would return the next day after the computers were shut down each night.

At first I thought it might have been a virus, or a combination of a virus + the multiple AVs these people loaded onto the machine. (Btw I already told them to never install more than one AV ever again.)So I ran Rkill, TDSSkiller, Microsoft Security Essentials, Super Anti spyware, and MalwareBytes. (7 rootkits removed as well as a few things found from MSSE and MWB.) For about two weeks, this seemed to fix the problem. The computer in question booted normally every single time. Then I get another phone call, it started it up again.

So I started a three day long testing process to try and find out what is wrong. I ran everything from Memtest 86, Checkdisk in the XP install, a couple of hard drive checking programs from UBCD, and finally ran the manufacturer scanner and it found absolutely nothing wrong at all. So I am faced the the unfortunate conclusion of reformatting a business computer. So backups of important Emails and client data were made, all virus scanned, and then the computer was reformatted. The day after it was formatted, it gets the same error, but there was a bad storm the night before so I told the person to restart it while I was on the phone and it worked just fine.

For about two weeks now, off of a fresh install, the computer has been working just fine. Until today. I get the call telling me that it did the select safe or normal mode cycle again. The worker had to restart it about 20 times. This should not be happening at all. I went to the office and tried recreating the error myself but was unable to. It started normally every single time. I ran a fix MBR on it and it booted back into windows afterwards, but I am almost positive that it is going to mess up again tomorrow.

So far the guy has paid me over 400 to fix this machine over the course of 2 months, and now he is threatening to sue if I cant get this thing fixed asap. I am at my end here. There is no reason this machine should be acting like this.

Edit: Before anyone suggests it. Combofix will not help in this situation since it is a fresh format with no virus infestations yet.
 
Just a random thought: you already switched out the hard drives?
 
The hard drive is good. Its a problem with the computer itself. And this computer is IDE only without a raid card.
 
i did work on a comp that had similar issues turned out the person running the comp was shutting it down wrong way (holding power button until it shuts off ) instead of going thru the start button and shut down the normal way
 
I wonder if they keep getting the virus after opening certain emails or documents from a source that has the virus. Best Bet would be posting in a white hat forum.
 
HUNTER2 said:
i did work on a comp that had similar issues turned out the person running the comp was shutting it down wrong way (holding power button until it shuts off ) instead of going thru the start button and shut down the normal way
Click to expand...
Maybe its not that but there has to be some user error. He must be opening the same bad file or doing something else wrong. And btw, do you think he is really going to sue you?
 
Lightningcount said:
So I am faced the the unfortunate conclusion of reformatting a business computer. So backups of important Emails and client data were made, all virus scanned, and then the computer was reformatted.
Click to expand...
I used imaging software for clients, right after I baselined and recovered a manual install. If something happened the next day, same day, whenever... I could go back and restore from the image in less than an hour. Another option I would try is slipping a 'spare drive' in the workstation to see how it behaved in the off chance the origional had bad sectors or stubborn rootkits. Often times it would help.

Lightningcount said:
For about two weeks now, off of a fresh install, the computer has been working just fine. Until today. I get the call telling me that it did the select safe or normal mode cycle again. The worker had to restart it about 20 times. This should not be happening at all. I went to the office and tried recreating the error myself but was unable to. It started normally every single time. I ran a fix MBR on it and it booted back into windows afterwards, but I am almost positive that it is going to mess up again tomorrow.
Click to expand...
I would be wondering why the issue presents when the user is operating the machine and not when I am. Watching their behavior will not help here since they will not do anything 'out of the ordinary' with someone looking over their shoulder. One thing you could try is using the XP disk to go into a recovery cnosole and see if you can edit the boot.ini for boot without the safe mode switch.

Lightningcount said:
So far the guy has paid me over 400 to fix this machine over the course of 2 months, and now he is threatening to sue if I cant get this thing fixed asap. I am at my end here. There is no reason this machine should be acting like this.
Click to expand...
This can be considered shooting yourself in the foot, but I would always tell a client with older hardware that what you are about to ask me to do will more than likely cost you more or the same as buying a new PC. I would offer to pull data off for migrating over free of charge to advise pricing/procuring of the PCs.


Good luck man. Sounds like a fun one!:)
 
Just a thought after you fix the computer, have the users of it log every program they use and what they open etc so when it happens again you can check those particular programs/documents.
 
I have a compaq evo d550 ... among other older rigs... finally gave up on it... random issues, bluescreens and data corruption... Pulled it apart to recycle the steel yesterday. I found a whole series of blown capacitors on the MB ... these have intermitant periods of usefullness depending upon operating temps. If you have blown caps on your MB , this could be the cause of your cycling problems.

These machines are 1999 vintage...

Jim
 
There are no blown caps on the board, thanks for suggesting it though. However it was one of the first things I checked. Except the mobo, every piece of hardware is reading good. The mobo can not be tested through any normal means other than trial and error. And no, prime95 doesnt do the job for mobos.

I went through and found a small problem that I never have seen in my entire time with computers. It struck me when she told me the computer was having problems holding the time of day and that she had to reset the time each day. The bios was not holding any information changes either.

What had happened was the CMOS battery went bad on it. I pulled it out to do a reset of the bios, then found that the battery was corroded. After carefully cleaning the slot and replacing the battery, the problem went away. Three days later, no more problems at all.

So there you have it folks. The problem was a bad CMOS battery. Dont ask me how a cmos battery can go bad, and at the same time cause those issues, but it is what it is. So there you have it.
 
You must log in or register to reply here.

Latest posts

Back
Top