Win XP sp3 powers off while in Normal Mode...

OK long story made short:

Running a HP Slimline s7600n Win XP sp3

While working with Kestrel13! to remove Malware my MotherBoard died.

1) I replaced Motherboard and everything worked fine

2) went back to Kestrel13! to finish the Malware removal we started before MoBo died and ran all the steps again for cleaning/removal etc and this time ran Revo Uninstaller to remove Firefox and ran ComboFix and posted the logs.

Here's the thread with Kestrel13!. Kestrel13! told me to get help in Software.
http://forums.majorgeeks.com/showthread.php?t=231909

3) Shortly after doing #2 above my computer would just shut down. Immediately power off in normal mode. I would restart it and then after a few minutes OR up to 1 hour it would power off.

4) if I started it up in Safe Mode it would work just fine. I am in Safe Mode now posting this. it's been in Safe mode since last night and doesn't power off as in Normal Mode.

Please help me figure out what is causing this shut down in Normal Mode

 

Is the replacement 'board the identical make/model to the old one? Do you have a Windows SP3 install CD? Is all your important data backed up away from that computer?

Are you familiar with Windows Management (right-click My Computer > Manage), I'd like to see the System and Application logs for the last week. Save them as the default type, zip and attach them please.

 

satrow

The System and Application logs attached

Yes I did install an exact make/model motherboard, it is an OEM. I used the same CPU in this new board

My wife has the same exact computer so I tested the CPU in her motherboard to confirm it was working fine.

I have all data backed up on anther HD

I have an XP operating CD and installation CD but its the original with SP1 not SP3.

 

Could you save the logs as *.evt files please - the default type, then zip and attach them please, that way I can check them much easier and gain more details.

 

I see an event 55 from NTFS (The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume xxx) in the System log.

This looks like the cause of the shutdowns. Attach the *.evt's though, I'll check further.

 

satrow

I ran chkdsk last night. It took a few hours to complete. After the computer ran fine for over 12 hours with out a shut down.

But then it shut down today and will only run for 5-10 minutes before powering off etc.

Attached are the most recent logs as requested

Also...I was reading that HP computers with AMD CPU's (this computers has an AMD Athlon processor) that have been ungraded to SP3 have shut down problems. And what I found on the Microsoft site was that there was a patch BUT it had to be installed BEFORE SP3 was installed.
Not sure if this has anything to do with this problem but thought I's mention it

 

satrow

Also I was reading that HP computers with AMD processors ( this computer has an AMD Athlon processor) and have SP3 installed have shut down problems.

http://h10025.www1.hp.com/ewfrf/wc/...84&lc=en&dlc=en&cc=us&product=3245532&lang=en

I found on the Microsoft site that a patch was available for this BUT it had to installed BEFORE sp3 was installed.
I am not sure if this is part of the problem but thought I'd mention it.

 

This was the result of the most recent Chkdsk:

The following is the result of the only other Chkdsk run, at 3/31/2011 09:21:49

As chkdsk appears to have 'fixed' the files and filestructure, I suggest you next run sfc /scannow as Administrator to check and replace missing or damaged Windows files. To do this correctly and to enable you to run a Windows repair (non destructive), you need to create an XP SP3 CD. You'll need to do this on a different PC, of course.

The HP site reads like it has the instructions needed to disable the bad driver manually.

 

I have had this happen to me (random shut down) 3 times since I installed sp 3, I have an HP with AMD. Should I uninstall sp 3 or disable the driver? I came here looking for a good back up solution....
THANKS,
Teresa

 

Sorry plodr, I remembered I wasn't supposed to do that after I did it.....:-o

 

satrow

I created the XP SP3 CD and tried running "sfc /scannow" but it would not work while computer was in safe mode. I would always get the following:

"windows file protections could not initiate a scan of protected system files. The specific error code is: 0x000006ba [the RPC server is unavailable"

When I tried to run "sfc /scannow" while in normal mode it would start but the computer would power off after a few minutes so it never completed.

I can't get the computer to stay on long enough for it to run while in normal mode. In Safe Mode the computer does NOT power off, it stays on.

Is the any way to get this to work in Safe Mode?

 

You could try 'sfc /Scanonce'

 

Satrow
When do I run this?

In Safe mode with the command prompt at start-up?

In normal mode after starta-up?

 

Run it now, it'll run, or attempt to, on the following reboot.

 

Satrow
Do I keep the XP SP3 CD I made in the cd drive and boot from that or use that CD in anyway during this scanonce?

 

Yes, providing it was installed from CD originally, it should automatically look for any files needed from there.

 

satrow

When computer reboots in Normal mode the computer powers off before it gets done checking windows files before the scan starts.

When I run>cmd>sfc /Scanonce and try to boot in Safe Mode it will NOT run.
Safe mode boots up and nothing happens

So am I STUCK? or do you have any suggestions on how to get it to do the scan in Safe mode, as my computer will stay on in Safe mode but powers off after a few minutes in Normal mode

 

I'd be inclined to run a disk checker from the hard drive maker now. If the drive checks out fine, then move to a repair (non-destructive) reinstall of Windows - or flatten it and start afresh.

 

satrow

ran extend test on HD and it is fine.

What is the right way to do the (non-destructive) reinstall of Windows XP?

As my screen six (see attached photo) is different than screen six in the example on the link below. My system is WIN XP Media Center SP3

http://www.informationweek.com/news...articleID=189400897&pgno=2&queryText=&isPrev=

I booted from the Win XP SP3 CD with slipstream

 

Satrow

If I press enter my screen seven displays the following telling me that "You chose to install Windows XP on a partition that contains another operating system. etc"

If I press C will I still be on track to a non-destructive repair of Win XP?

 

That looks like there's a licensing difference between the XP installed and the XP Home on the CD, you'd do much better if you were to contact HP for a CD - if you're in the US, you can buy replacement discs for many brands - some info here.

 

I have the recovery CDs that HP sent me awhile back.

A "HP Media Center PC Supplement Recovery Disc"

and 2 "System Recovery Win XP Media Center Edition 2005 with Update Rollup 2"
Disc's 1 & 2

I am now thinking the Win XP SP1 I used for the slipstream CD may of been from my old HP laptop :-o

 

satrow
I used the corrected CD this time (WIN XP Media Center) and ran "sfc /scannow" in normal mode and it ran almost to the very end (about an hour) and then right at the very end it asked to insert "Windows Professional CD 2"
Stating "Files must be copied to the DLL Cache"
See photo...

well this computer is running "Win XP Media Center"

XP Pro was never installed on this machine and I don't have a XP Pro CD.

See attached photos of the CD's I received from HP for recovery

Is there someplace I can get a copy of the DLL files it is looking for and WHY is it asking for XP Pro DLL files when system is XP Media Center?

 

The "Windows Professional CD 2" might be an error, it may just be referring to the 2nd CD from HP. That's a big problem with OEM modified versions of Windows - we users have great difficulty separating what's a Windows error from a Dell/HP/Toshiba/whatever error.

 

Satrow

Ok. That's Interesting BUT do you have any Solutions or Work-Around for this???

Maybe some of your colleagues have suggestions... Plodr? Anyone? I know you have a very smart team over there at MajorGeeks

Any suggestions or guidance on how to run a Non-Destructive Repair of WIN XP Media Center with the disks I have?

Reminder: my main problem is my HP computer "Powers Off" when in Normal Mode but not in Safe mode

 

I can't think of a workaround for this, if the CD is the wrong version, you can't do a Repair install from it.

You can try creating the Recovery Console, booting from it and then running SFC - but you still don't have the correct version that Windows looks for.

If you have an i386 folder on your Windows partition, you can create the Recovery Console from it instead (or try a Repair install from it - if it will start from Safe Mode). To run SFC without the correct version, you might have some success by modifying the Registry - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup > 'Sourcepath' data is what you need to change. Double-click 'Sourcepath' and try changing the data in the popup box to C:\.

Reminder: your main problem is file corruption. About 98% of the Errors logged in the System log you uploaded contain the sentence "Either the component that raises this event is not installed on your local computer or the installation is corrupted.", regardless of the error source.

 

satrow

I have a i386 folder on the Recovery Drive (see photo) how do I do a "repair Install" from it?

and/or

How do I do this? Where do I start/find the path "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup > 'Sourcepath' data " ?

 

By modifying the command to point to H:\i386\winnt32.exe /unattend - if this fails, note any error then try without the /unattend modifier.

By modifying the Registry entry "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup > 'Sourcepath' data " - if you're not happy going there, flatten it and reinstall.

 

satrow

Please explain where you want me to do this?...Modify WHAT command - where? Please help as I am GREEN at doing this.

Again please bear with me as I am GREEN - WHERE do I find the Registry entry "HKEY_LOCAL_MACHINE\ ETC"

 

Considering the amount of time spent on this, if you don't understand the context of a command in Windows or what the Registry is, I'd advise a complete wipe/reinstall of Windows.

You've already stated that your data has been backed up, post #3? Use the original - or your wife's CD to install a fresh Windows, 2-3 hours, including drivers and updates and it's done and dusted...

 

satrow

1) I know how to RUN>REGEDIT and then follow the PATH down and double click "Sourcepath" and change it from "c:/windows/" to just "c:/"

I just wanted you to confirm with me on how you wanted me to do this.

PLEASE bear with me as I am doing this while working at my DAY JOB and jumping back and forth to MajorGeeks trying to fix this HP computer.
SORRY if I am asking too many questions.

2) I would like you to explain to me (or post a link that explains) how use the i386 folder on my Windows partition to start a "Repair Install" while in safe Mode as you posted below.
As this sounds like it may fix the problem if the repair install will run from the "Recovery Partition"

PLEASE don't give up on me yet as the repair install from the Recovery drive "H" is worth trying. I just need a little guidence.

 

Guidance may not defeat the blocks set in place by HP/MS and version differences.

1) looks good

2) Start > Run > "H:\i386\winnt32.exe /unattend" should get the repair underway - if it works from Safe Mode - I'm 2+ years removed from running XP and much longer since I had to do a repair on XP, suck it and see