PC crashes, only runs in safe mode

[bewsh]

Hi,
have a problem that is driving me nuts!

My PC is on the fritz!

PC networked to a Server running SBS/MS Exchange
Server LAN is networked through a Sonicwall TZ170 firewall into a Netgear Rangemaster to the WAN

PC is XP Pro SP2
hardware is:
MSI K9N Ultra Board
AMD dual 4200+ CPU
2GB DDR2 RAM
3x SATA HDD's
C: running win XP pro SP2 single partition
D:File Dump folders
E:File Dump folders
2 x DVDRW
Graphics - Asus ATI Radeon EAH3650 twin screen set up.
built in Coolermaster case with 550WPSU
runs Symantec Enterprise up to date 24/7

about a week ago the PC crashed on me. not restart, just crash, like a switchoff
I restarted and it seemed to work just fine.
(no new hardware or software installed and no viruses flagged)

happened again about a day later.
My first guess was too hot. been a while since I cleaned it.
It has a front fan, a rear fan, a PSU fan and a CPU fan with mesh front case and a CPU vent on the side but it can get hot

all cleaned and dusted.
monitored the temps and they never got over 50deg C
cut off in the BIOS is set for 55deg

crashing increased in frequency and occasionally the green power light stayed on even when the machine is off. had to remove the power cord and press reset to clear it.
Thought maybe the CPU had been cooked so took the heatsink off and checked paste etc, smells OK, no obvious issues.
put it back together, ran for a while then crashing increased to point where now it wont complete normal Boot, crashes at blue win logo and recyles to startup again.
Works fine in safe mode with and without networking. ( I am on it now!!)

I pulled the C: drive and put it into an old HP chassis I have, worked fine in normal mode, tried my damdest to crash it by opening multiple apps during final boot etc etc, no problem. flicking from Ap to Ap, multiple Chrome tabs (which is when it started crashing)

refitted it to the coolermaster case but pulled all the unused peripherals (optical and hard drives, all USB except mouse/KB).
I tried to run Acronis to get an image of the C: but it kept forcing a crash.
I pulled two drives out and ran them in the HP box again and managed to get an image

I switched the RAM for known good RAM = crashed on restart, safe mode OK

I have tried to get a bootlog but it only shows the safe mode log. even tried a bootlog on normal mode, let it crash and remove the ntbtlog.txt file from the C: drive with ERD commander so safe mode cant overwrite it. It kept crashing ERD.
managed to do it with the C:in the HP chassis but it still shows a Safe boot mode.

C: Drive has been scanned with chkdsk and a drive fitness test, generic one not for the Maxtor HDD, it returned a "Disposition Code 0x72" message but otherwise clean.

have run Symantec full scan = Clean
ran Malwarebytes - two average infections, cleaned and quarantined

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F5F14E7A-F59D-45A0-BDC5-A9F5454F0BCF} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB05BD70-4605-4829-93FC-AD80D8CC5B66} (Rogue.PerformanceCenter) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.



disabled all startup entires in MSConfig = crashed on restart
disabled all (unwanted) services = crashed on restart

have uninstalled the graphics card = crashed on restart
reinstalled graphics card and updated the driver = crashed on restart
updated chipset drivers = crashed on restart

have attempted to copy a fresh BIOS driver flash onto a 3.5" floppy but my A: drive wont recognise the discs for some reason!

I cant switch the graphics card out as I dont have a spare compatible one (sold it less than a month ago on eBAY!!)

I have a spare PSU but it is not from a SATA enabled box so I would need IDE adapters to run all or any of the drives...I am not convinced it is the power source though.

Any ideas?
short of a complete clean rebuild to see if it is the MB or CPU I am not sure what else I can do!!

I am trying to avoid picking through the data or do a image reload, if I am going to go down that route I will ditch the MB and chip and upgrade.
bit short of cash to be throwing money at the problem at the moment.

Any help would be great, apologies for the lengthy post

 

[Route44]

If you can only boot into Safe Mode it is a strong indicator of either driver issues or sometimes infections. It is a strong possibility you are still infected.

Please go to our Virus and Malware Removal forum, read the UPDATED 8 Step sticky, follow the instructions as given in the order given and then on that forum post your results via the copy and paste method.

Good luck and if they find nothing then return to this thread and we'll continue.

By the way, any Blue Screens?

 

[bewsh]

will do thanks.
No blue screens, just the "splash screen" with the windows logo that would hang or crash when it reached that in boot.

 

[bewsh]

hi, I am back again.

have completed the AV/Malware thing on the other forum with no luck.

nothing major showed up other than poor housekeeping and I now at a loss as to what to do next.

I have installed all new and updated drivers for audio, chipset and anything else I could find for the MB model I have. short of a BIOS flash.
I reinstalled SP2 for XPpro.
I have swapped out the RAM.
unplugged all peripherals, including DVD/CD drives, A:, all USB connectors, all unnecessary PCI cards,

I have bought a new graphics card and tried to boot with that, same problem.

I have an image of the C: but if the OS is the problem then the image is of no use.

If I wipe the disc and reinstall the OS it could be the disc, (even though this disc ran in normal mode on a different MB/CPU)

if I use a new disc and install it I worry that the issue is the MB/CPU, but it has been running in safe mode with networking for over a week now.


not sure what else I can discount through disconnecting.

Are there any driver or MB diagnostic tools?
I have to think this is driver related as it gets to the windows logo screen and just before if releases to the next screen it crashes.

I have a twin screen Vdeo card.
normally the winlogo is duplicated on both screens, when the card drivers kick in for login it shows the two screens as side by side with the login window straddling the edge. I thought it was maybe the card as it was just when the card would go to twin screen mode that it seems to crash.

can anyone help me avoid a full physical and SW rebuild?

thanks

 

[skipper86]

If your system works in Safe mode then there is an opportunity for you to restore your system to an earlier date... this may resolve the problem
Best Regards

 

[Route44]

bewsh, deep apologies for failing to see your post from 6 days ago. I don't know if you resolved it but a) does it have issues running on just one screen and b) have you tried a different cable?

 

[bewsh]

Hi, no problem.
I solved the problem yesterday.

having lost my patience and been advised it was the MB I replaced it and reinstalled XP on a new HD.
no dice. hung at the logo page everytime once I had installed a few things.

So I took it back and asked if he had checked my CPU in another board...he said no.

So I bit the bullet and went for a new dual core AMD CPU, a new MB (cant use mine as the socket is AM2) and got some extra RAM.

I am tying on my new faster, slicker, reinstalled, twin screen rocket machine!

thanks for all your help.
I just need to figure out why MS Exchange is using a PST file on my PC HD to store messages now!

 

[skipper86]

Hi, no problem.
I solved the problem yesterday.

having lost my patience and been advised it was the MB I replaced it and reinstalled XP on a new HD.
no dice. hung at the logo page everytime once I had installed a few things.

So I took it back and asked if he had checked my CPU in another board...he said no.

So I bit the bullet and went for a new dual core AMD CPU, a new MB (cant use mine as the socket is AM2) and got some extra RAM.

I am tying on my new faster, slicker, reinstalled, twin screen rocket machine!

thanks for all your help.
I just need to figure out why MS Exchange is using a PST file on my PC HD to store messages now!

Nice to hear that...!!

 

[Route44]

Good work on your part. Thanks for getting back to us.