[Geeves00]

Hey everyone, this issue isn't with my PC but a friends. I have been working on it off and on for about a week now with no real success. Luckily I have the PC here to work with and have the next few days off so I can troubleshoot until my heart's content.

Here's the rundown, it's going to be a little long so bare with me.

System:

OS: XP Home SP3
RAM: 512
Vid: Radeon x1900
CPU 1.8 Ghz AMD
Mobo (no sure, will have to took)
HDA0: 80gb partitioned 40 to C, 40 to D
HDA1: 250gb
2 DVD drives



ISSUE:

Ok, what spurred this whole incident was the response time in Windows on his machine. ANYTHING explorer related causes explorer to clock for 2-5 minutes. I did the normal, booted to safe mode, disabled startup items, ran an Ad-aware scan and Spybot S&D scan. Neither found anything major. I run and AVG virus scan, nothing. I disable a few minor items using HJT and I disabled a few other items using Autoruns.exe. Booted normally. Same issue.

His PC has a lot of junk so he gave me the green light to blow the OS away and reimage. He backed up everything he needed onto his 250gb drive.

I throw his restore disk in and reboot. Nothing happens, it boots right into windows....... I reboot again and check the BIOS, CDROM is set to device #1 in the boot order. I move the CD to the other DVD drive and try to boot, again just bypasses the CD and goes right into windows. I drop it back down again and go into the bios. I disabled all other boot options so it would be forced to use the CD or nothing. Try to boot, it looks like it is trying to boot (there's activity on the DVD drive), but eventually comes back and tells me to inset a disk and press enter.

At this point I start thinking hardware. Maybe the IDE controller is fudged (I know I know, worst case....) though it strikes me as odd that the BIOS would recognize the drives if the controller was bad. Anyway, to appease my self I swap out the IDE cable with one that I know works. Same issue. I unplugged the second HDD and connected the first DVD drive to the cable (disconnecting the second controller completely). BIOS recognizes HDD and CD-ROM. Try to boot from CD, goes right into windows. Change cable to the other DVD drive, same issue.

Through all of these boots I also tried booting from an XP Home CD with the same results (both CDs do work, I can boot with both on my PC).

The next step is to try to boot from USB but I haven't tried that yet.

So, thoroughly frustrated with that I move back to the OS thinking maybe there is something I can work on there until I get the boot issue worked out.

So I have run Adaware and Spybot. Gone through HJT and Autoruns and I still have an issue.


A little more detail on what I am seeing with this:

Anything Explorer related seem to be causing explorer to hang. However.... once I get an app or an MMC loaded they will run normally. Though getting them to work is like pulling teeth. I click on start, wait 2-5 min, click on programs, wait 2-5 minutes, click on app (you get the picture).

Now, if I boot into safe mode, everything runs normally.

I tried creating a new user account, same issue.

I removed SP3, same issue.

In safe mode I added ProcessExplorer.exe to startup so i can launch some apps without going through explorer. I also used to PE to view the DLL hooks in explorer, I don't see anything out of the ordinary when comparing it to my PC (also didn't see any abnormal processes running).

One thing that has caught my eye is that neither DVD drive is showing up in My Computer. Both have an ! next to them in device manager. Both throw a driver issue, code 32 (device connected to the machine not functioning properly). Same thing occurs in Safe Mode.

So grasping at straws I start disabling things, drop hardware acceleration to None. Disable a lot of the ATI files that boot up. No help. I run a chkdsk /r..... finds a few minor issues and fixes them.

I'm kind of running out of ideas here..... I will try booting from USB a little later. I would try to run SFC but since the PC will not locate a CD drive I can't.

I will post another HJT log for you guys to look at here when I get a chance.

Any suggestions? Questions? I'm sure I am leaving some troubleshooting steps out but it's early and I haven't had coffee yet.

Any help is appreciated

[Advertisements]

Hello Geeves00...

Let's have a look at a couple things.

Click Start, then Run, type regedit and click "Ok"

In the left pane, expand (click +) HKEY_LOCAL_MACHINE, then SYSTEM, then CurrentControlSet, then Control, then Class, and click on {4D36E965-E325-11CE-BFC1-08002BE10318}

In the right pane, are UpperFilters and/or LowerFilters listed?

=========================================

Right click on My Computer and choose "Properties". Click the "Hardware" tab and then the "Device Manager" button. Expand (click +) IDE ATA/ATAPI controllers.

Right click on the Primary IDE channel, choose "Properties", then click the "Advanced Settings" tab. List the Current Transfer Mode for each device shown for this channel.

Right click on the Secondary IDE channel, choose "Properties", then click the "Advanced Settings" tab. List the Current Transfer Mode for each device shown for this channel.

wannabe1

[wannabe1]

Hello Geeves00...

Let's have a look at a couple things.

Click Start, then Run, type regedit and click "Ok"

In the left pane, expand (click +) HKEY_LOCAL_MACHINE, then SYSTEM, then CurrentControlSet, then Control, then Class, and click on {4D36E965-E325-11CE-BFC1-08002BE10318}

In the right pane, are UpperFilters and/or LowerFilters listed?

=========================================

Right click on My Computer and choose "Properties". Click the "Hardware" tab and then the "Device Manager" button. Expand (click +) IDE ATA/ATAPI controllers.

Right click on the Primary IDE channel, choose "Properties", then click the "Advanced Settings" tab. List the Current Transfer Mode for each device shown for this channel.

Right click on the Secondary IDE channel, choose "Properties", then click the "Advanced Settings" tab. List the Current Transfer Mode for each device shown for this channel.

wannabe1

[Geeves00]

Sorry for the delay, was out fixing another PC.

The registry shows:

UpperFilters: GEARAspiWDM
LowerFilters: PxHelp20 Pfc


In Devman:

Primary IDE:

Device 0: Current Transfer is Ultra DMA Mode 5

Device 1: N/A


Secondary IDE:

Device 0: Current Transfer is Ultra DMA Mode 2

Device 1: N/A



The Devices being N/A are because I only have 1 HDD and 1 DVD player connected, each on their own cable.

Now, looking at Devman, there are a few pieces of hardware that have ! next to them. The DVD player, printer, PS/2 mouse and keyboard. USB mouse and keyboard work fine.

Exact error on all dives is the same:

A driver(service) for this device has been disabled. An alternate driver may be providing this functionality. (Code 32)

[wannabe1]

Let's remove those filters, that should get the optical drive working again. The transfer modes are good.

Open Registry Editor as you did before and navigate to the key where you found the filters. In the left pane, right click on {4D36E965-E325-11CE-BFC1-08002BE10318} and choose "Export". Name this file oldfilters and save it to your desktop. In the right pane, right click on LowerFilters and choose "Delete"...accept the change. Right click on UpperFilters and choose "Delete"...accept the change.

Close Registry Editor and reboot.

Did the optical drive show back up and work properly?

=================

Sounds like the PS2 ports have been disabled either in Device Manager, or in the BIOS setup. If you are not using them, this might not be a problem unless the machine insists on using PS2 during the install. Some machines do not have USB support until Windows is installed. It might be a good idea to enable the ports just in case.

[Geeves00]

Well removing those reg entries did resolve the ! next to the CD-Rom and it is showing up in My Computer. However it will not recognize the CDs placed in the drives and still will not boot from the CD.

As for the PS/2 Mouse/Keyboard, they are not disabled. In fact, they work up until Explorer loads (I can access the bios with the keyboard, select the boot mode, etc) the mouse and keyboard work up until i click on the user account to load. Again, the USB ones work fine

[wannabe1]

See if you can run the Autoplay Repair Wizard on the machine.

If we can get the optical drive working properly, you'll have more options for repairing the machine. Have you had this rig checked for malware? There's some nasty stuff out there that can cause problems like you describe.

[Geeves00]

Ok, so I tried to run that fix but it didn't go too well. It may have been because I tried it in Safe Mode. I will try it again on a normal boot but this will take some time due to the response time of the PC

Here is the log it gave:

AutoFix [V5.2.3790.67]
Time [2008-10-15 17:56:33]
Microsoft Windows Version [5.1 (Service Pack 2) <2600>]

Test [The Shell Hardware Detection service is running.] - Instance
[N/A]:
Result [AutoStart Setting]: OK
Result [The Shell Hardware Detection service is running.]: Problems
>> Repair << [The Shell Hardware Detection service is running.]
Step: Starting the Shell Hardware Detection service.
Result: The wizard ran into problems while trying to start the
Shell Hardware Detection service.




As for the Malware......I won't completely rule it out but everything seems to come up clean..... Here's a copy of the HJT log:

[attachment=23969:HiJackThis_log.txt]

[wannabe1]

I'm no malware expert, but there are things in the HJT log that don't look right to me.

Post a log in the Malware Forum and let's see what the experts think. That may be what's holding things up.

[Geeves00]

I posted the log there as requested. Hopefully they can see something I can't.

I re-ran the AutoFix in a normal boot session. It did run (no errors on the service this time), however it got to the point where I had to recreate the autoplay issue when i got called into the office. I'll post an update with that when I get back home. I'll also try running the malware removal tools they have in the Malware forum FAQ.

[wannabe1]

Good plan...

I've subscribed to your topic there so I can follow along.

[Geeves00]

Ok. Looks like the fix didn't go too well. Here is the log:


AutoFix [V5.2.3790.67]
Time [2008-10-15 19:14:46]
Microsoft Windows Version [5.1 (Service Pack 2) <2600>]

Test [The Shell Hardware Detection service is running.] - Instance [N/A]:
Result [AutoStart Setting]: OK
Result [The Shell Hardware Detection service is running.]: OK

Test [Policies] - Instance [F:\, Drive Type: 0]:
Result [HKCU\...\Policies!NoDrives]: OK {Absent}
Result [HKCU\...\Policies!NoDriveAutorun]: OK {Absent}
Result [HKCU\...\Policies!NoDriveTypeAutorun]: OK {Present}
Result [HKLM\...\Policies!NoDrives]: OK {Absent}
Result [HKLM\...\Policies!NoDriveAutorun]: OK {Absent}
Result [HKLM\...\Policies!NoDriveTypeAutorun]: OK {Absent}
Result [Driver level policies]: OK {
HKLM\...\Services\!Autorun (Absent) <Allows>
HKLM\...\Services\\Parameters!Autorun (Absent) <Allows>
HKLM\System\CCS\Enum\...!AlwaysEnable (Absent) <Not set>
HKLM\System\CCS\Enum\...!AlwaysDisable (Absent) <Not set> }

Test [Drive Notification] - Instance [F:\, Drive Type: 0]:
Result [Legacy Notification]: Problems
Result [AutoPlay V2 Notification]: Problems {
Service (Silent)
Shell (Deaf) }
>> Repair << [Autoplay V2 Event]
Step: No steps to take.
Result: This AutoPlay setting cannot be fixed. Either the device is malfunctioning, or the wizard cannot determine the problem.
>> Repair << [Legacy AutoPlay Event]
Step: No steps to take.
Result: This AutoPlay setting cannot be fixed. Either the device is malfunctioning, or the wizard cannot determine the problem.

>> Required action: The wizard found problems but cannot fix them -> None

[Geeves00]

Ok, back to this thread. I'm sure you have been following the thread in the Malware forum so you know that the machine looks good from that aspect.

On top of that troubleshooting, I took it upon myself and removed the 3rd party video drivers I installed and reinstalled the native ATI drivers for the card. However somewhere along the line I lost my ability to boot into safe mode. It either locks up when trying (hangs when it reaches mup.sys) or it throws a UNMOUNTABLE_BOOT_VOLUME BSOD.

I have not tried booting from USB as of yet. When i try to boot from CD now it just hangs until I eject the CD. There is activity on the drive but it never boots up.