[Admirgency]

Hello.

The boot-troubles on this computer started just before cleaning-up after Malware-removal by Gringo,
geekstogo.com/forum/topic/330289-need-help-removing-snapdowebsearch/
However i don't think this is malware&removal-related but solely due to our mishap-electrical system. Gringo already closed my topic and answered 2 questions via PM but that didn't solve the boot-troubles. For the record i'll quote the related messages here.

Post #61 in thread 330289-need-help-removing-snapdowebsearch/, 04 August 2013 - 05:26 PM

Last week i did not have time to work on this computer but i needed to check at least the hanging on first start-screen, from where one can go to BIOS or into Safe Modus. I noticed that the computer could not get past this screen, but only when started on power-searge and not when started manualy. You see, our electra is a mess and everything in our office hangs on only 1 soccet. That often makes the computer boot when we turn the light on. I never noticed other (former) employees with access to this comp paying attention to this and the comp would be for hours on the user-account login-page. Before last week it never stalled at the first bootscreen. When closed by pressing the start-button for 3 seconds, there-after the comp can be started as normal with pressing the start-button again.

Note, last week the boot-troubles worsened, the comp can now lag on bootscreen 0, the NEC-welcomming-screen with only the options F2, continue to Set-up, or F12, continue to regular boot. this NEC-welcome-screen never showed before.

Sent 18 August 2013 - 07:16 in PM to Gringo.

About topic geekstogo.com/forum/topic/330289-need-help-removing-snapdowebsearch.
My greatest gratitudes for helping me resolve this issue.

Sorry i did not take time yesterday or earlyer this week to post back but as i already wrote, i've been working elsewhere. Besides i had to take extra time to relax or otherwise i might suffer burn-out too like the payed coördinator of our project.
I have 1 remark and 2 questions, don't think the post need to be re-opened, it can be answered via PM if that's alright with you and/or G2G-rules.
MS Security-updates all roled in like they should, just finished checking them.

Quesstion 1 : can i just remove the Farbar quaranteine-folder to recycle-bin or does it need more extensive un-installation (with what tool)?

Question 2 : Start-up-troubles with this computer are worse then before (remember it starts many a time at power-searge when we switch on the light). Should i now go to the G2G OS- or Hardware-forum? And is it worth their time given we just have to ask and we get new computers for free, Win XP is out of commission soon, and we'll need new computers after the re-organisation with 3 sister-projects anyway.

Thank you a million times,
Admirgency.

Sent 19 August 2013 - 02:43 AM in PM
Hello

1. yes just move it over to the recycle bin

2. because of the way it shuts down it is getting little corruptions here and there - it is only going to get worse over time - might be worth running a chkdsk on it

gringo

Note : where Gringo writes "shuts down" it has to be "Powers up".

quote of my initial reply is unimportant, though my next reply which i post together with this new thread on the OS XP forum is :

send in PM after i post this here.

Hi Gringo.

For comparison i first ran chkdsk from installationdisk->repair and there-after from Owner-account without the installationdisk. From installationdisk->repair it stated there's nothing wrong, in Owner-acc. it needed "chkdsk /f" to remove Index-statements in Index $130. They were about 10 log-files, the first 2 were edb009D4.log and edbtpm.log.

Also i ran FIXMBR without the actual fix applied afterward (from installationdisk->repair). Here the comp mentioned it had a non-standard or invallid MBR and asked to write a new MBR. I did't do that yet.


Tomorrow i'll buy a seperate extension-cord/socket with an on-off switch. That'll be used for this computer only and have no other devices plugged in. Then at least the computer will not power up when turning on the lights or the copy-machine.


Can you handle this issue? In my opinion this is coused by the power-surges and not by malware & it's removal. Or..... I think i'ld better go – according to forum-rules : have to go - to OS-forum now. Boot-up has not been improved, checked with regular shut-down and new boot, and with turning all electra off and then a power-surge when turning alectra on again. That was this morning.

When i started the comp to write this, tonight, i saw there were missing files when verifying Boot-Data. That has not shown before, either it lagged indeffinitly just before this point, or went on without a glitch. The OS-forumpage is : (Has to be edited in).


Sencerely yours,
Admirgency.

Note, as you can read i have to take extra free time to work on/with this computer as we've temporarily moved our operations to a sister-organisation. If everything is alright with a new payed coördinator we'll move back next thursday. If i don't answer right away there's no need to ask wheter i'll continue this thread, i surely will. Please don't close it.

Admirgency.

[Advertisements]

WOW lots of info but not much to work with. First lets start with diagnostics.

Run hard drive diagnostics: http://www.tacktech....ay.cfm?ttid=287
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: http://www.imgburn.com/ to burn .iso file to a CD (chose "Write image file to disc" option), and make the CD bootable.

NOTE. If your hard drive is made by Toshiba, try the Hitachi DFT CD Image version of the software

Thanks to Broni for the instructions

[rshaffer61]

WOW lots of info but not much to work with. First lets start with diagnostics.

Run hard drive diagnostics: http://www.tacktech....ay.cfm?ttid=287
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: http://www.imgburn.com/ to burn .iso file to a CD (chose "Write image file to disc" option), and make the CD bootable.

NOTE. If your hard drive is made by Toshiba, try the Hitachi DFT CD Image version of the software

Thanks to Broni for the instructions

[Admirgency]

Thank You rshaffer61 for your response.

I am not sure when i have time to do this. I did make time during working-hours yesterday but..... The perp who broke in to our lot last winter and spring almost every day has been released last week and immediatly forced entry again*. I've been bussy with repairs all day. There-fore i am not allowed on the premesis in the evening or the weekend, when i'm used to maintain on computers here. i hope i'll come around to it today or tomorrow in the afternoon.


* for those who are interested in this Dutch luxury-problem.: see 2 new entries in "What's on your mind" on my profile

[rshaffer61]

No problem as we do not close topics in this part of the forum. Take your time and I hope everything gets better.

[Admirgency]

Hello rshaffer61.

Excuse me for answering this late, i just did not have the time to do this. (we moved back to our own building and now officially have 2 captains on the ship and with me being proverbial boatsman, helmsman, quarterrmaster, fouragier, steward to visitors and paying customers, cassier and then some more functions, i have to clean up what goes wrong between the 2 captains) (Besides there being 2 more forced entries).

I installed a seperate electrical soccet so the computer does not suffer a powersurge with turning on the lights or powering up printer and copy-machine. The computer still powers up but does not boot on turning on this soccet. Thus we still have to power the comp down and turn it on again with it's own power-switch, before it boots. And then first have choise between F2 (set-up) and F12 (Network Boot) where-after F1 (continue) or F2 (Setup) must be chosen. It does not lag anymore with one of these choises or on verifying Pool Data nor on the DHCP-check there-after.
The internal clock on this computer is now 5½ days off to the past, i did not reset that yet. This is a new problem i noticed last friday.


Before i ran the fitnesscheck yesterday, in Owner-acc. I got the message :

"WindowsSearch.exe is damaged. The file or folder C:\Docume~1\gast\LocalSettings\Temporary Internet Files\ContentIE5\37NPN1X is damaged and unreadable. Perform CHKDSK". CHKDSK at reboot repaired it.

I downloaded the fitnesscheck for Hitachi/IBM from tacktech. Now i write this i see you also gave a link to Hitachi for Toshiba Hdrives. This is a Hitachi Harddrive. Should i have used the Hitachi-link?


I ran the (tacktech) fitnesscheck yesterday but did not find the report annywhere. I had already specified my own path becouse the program wanted to write to the CD (not passible on this machine nor on that CD) and with changing CD (A:\) for C:\ it metioned that that was an invallid path. This morning a ran the scan anew with another path specified but again i could not retrieve the info. Both times i looked in & via Owner and Admin-account with hidden files vissible, to no avail. Anyway i did not notice anything being wrong as an outcome of the fitnesscheck.


The computers here need to be cleaned from dust in their interior but again i realy don't know when i would have the time to continue.

Thank you for your patience.

Edited by Admirgency, 03 September 2013 - 07:31 AM.

[rshaffer61]

OK your date and time being off could indicate a failing cmos battery on the motherboard.
You should run chkdsk /r to check the disk integrity.
The damaged and corrupt files could be a result of a faulty drive or a corrupted OS.
The bootup issue with having to chose the F keys is probably due to the bios not holding settings when the system is turned off or disconnected from power. Again that may be the cmos battery issue I mentioned above.
The running of the DFT testing is confusing so I'm going to suggest you get the SeaTools DOS CD ISO HERE and then follow the steps to make the cd like before.
Before running the HD diagnostics with the SeaTools disk please do the following.


Go to

Start and then to Run
Type in Chkdsk /r Note the space between k and /
Click Enter ...It will probably ask if you want to do this on the next reboot...click Y
If the window doesn't shutdown on its own then reboot the system manually. On reboot the system will start the chkdsk operation
This one will take longer then chkdsk /f

Note... there are 5 stages...
It may appear to hang at a certain percent for a hour or more or even back up and go over the same area...this is normal...
DO NOT SHUT YOUR COMPUTER DOWN WHILE CHKDSK IS RUNNING OR YOU CAN HAVE SEVERE PROBLEMS
This can take several hours to complete.
When completed it will boot the system back into windows.

Reboot after your done running chkdsk /r...
then Go to Start...Run and type: eventvwr.msc press Enter
When Event Viewer opens, click on Applications... then scroll down to Winlogon and double-click on it. This is the log created after running Checkdisk...copy and paste the log back here


We will advise after studying the log.

[Admirgency]

hi.

I cleaned the computer from (not to much) dust, but it's a bit faster indeed. Also the battery is changed & time reset.
The comp (multiple boots and re-boots today) does not lag anymore at 1st start-screen : NEC Welcome press F2 for set-up or F12 for System Boot. But it can still lag at CMOS-check with only option F2 for set-up and no F1 to continue. This is a new lagging-point not shown before.
Shut-down (normal & hard) now powers down the comp every time so that is an improvement too.

However after about 5 min. with Windows fully operational a warning-sound turns on. It's a clear alarm, kind of like our Police-siren, never heard/red about such an alarm on computers. There's no written warning-message about what's wrong, Windows Security Center does not show anything wrong. The comp automaticly - and fast - shuts (and powers) down after this sound has rang for half a minute. I checked the new battery, it can not be put in the wrong way, that just doesn't fit it's socket.

First try with chkdsk /r lasted less then 5 sec. where-after comp booted as normal. On 2nd try, the warning-signal sounded but the signal turned off in step 2 of chkdsk /r. Chkdsk has been run when i write this, i'll give the report tomorrow if the warning-sound still is active. I write this on the other work-computer, and - in case the cause of the warning-sound has not been detected/repaired - i don't have an USB with me now. Besides it's after 18:00 h again, got to get home for diner (and i wonder why we have 2 payed coördinators now while i as a volunteer am still doing most of the work here).

[edit written from the scanned computer]
Computer is rebooted 10 minutes ago and there's no warningsound and no auto-shutdown. Good.

the log :
Type gebeurtenis: Informatie
Bron van gebeurtenis: Winlogon
Categorie van gebeurtenis: Geen
Gebeurtenis-ID: 1001
Datum: 9-9-2013
Tijd: 18:34:42
Gebruiker: n.v.t.
Computer: POWERMATE
Beschrijving:
Het bestandssysteem op C: wordt gecontroleerd...
Het type bestandssysteem is NTFS.
Volumenaam is Windows.

Er is in een eerder stadium een schijfcontrole gepland.
Windows zal de schijf nu controleren.
Bezig met het herstellen van kleine inconsistentiefouten op het station.
Bezig met het opruimen van 8 ongebruikte indexingangen in de index $SII
van het bestand 0x9.
Bezig met het opruimen van 8 ongebruikte indexingangen in de index $SDH
van het bestand 0x9.
Bezig met het opruimen van 8 ongebruikte security descriptors.
CHKDSK is bezig met het controleren van het USN-logboek...
Controle van USN-logboek is voltooid.
CHKDSK is bezig met het controleren van de bestandsgegevens (stap 4 van 5)...
De controle van bestandsgegevens is voltooid.
CHKDSK is bezig met het controleren van vrije ruimte (stap 5 van 5)...
De controle op vrije schijfruimte is voltooid.

39078080 kB totale schijfruimte.
15698892 kB in 62852 bestanden.
23940 kB in 11474 indexen.
0 kB in beschadigde sectoren.
190304 kB wordt gebruikt door het systeem.
Het logboekbestand neemt 65536 kB in beslag.
23164944 kB beschikbaar op schijf

4096 bytes per cluster
9769520 clusters in totaal op schijf
5791236 clusters beschikbaar op schijf

Interne info:
10 4d 01 00 62 22 01 00 82 9b 01 00 00 00 00 00 .M..b"..........
a3 0e 00 00 03 00 00 00 3a 04 00 00 00 00 00 00 ........:.......
28 c5 50 03 00 00 00 00 08 4c 99 3a 00 00 00 00 (.P......L.:....
0e 08 fd 05 00 00 00 00 de 17 ae 7c 02 00 00 00 ...........|....
9a 36 46 8d 01 00 00 00 8c 87 80 58 04 00 00 00 .6F........X....
00 b3 8b 8e 00 00 00 00 60 38 07 00 84 f5 00 00 ........`8......
00 00 00 00 00 30 2f be 03 00 00 00 d2 2c 00 00 .....0/......,..

Windows heeft de schijfcontrole voltooid.
Een ogenblik geduld. De computer wordt opnieuw opgestart.


Zie Help en ondersteuning op http://go.microsoft....link/events.asp voor meer informatie.

Edited by Admirgency, 09 September 2013 - 10:54 AM.

[rshaffer61]

OK the alarm could point to a possible heat issue.
Can you do the following please.

Download Speedfan (The download link is to the right), and install it. Once it's installed, run the program and post here the information it shows.
The information I want you to post is the stuff that is circled in the example picture I have attached.
To make sure we are getting all the correct information it would help us if you were to attach a screenshot like the one below of your Speedfan results.

To do a screenshot please have click on your Print Screen on your keyboard.

• It is normally the key above your number pad between the F12 key and the Scroll Lock key
• Now go to Start and then to All Programs
• Scroll to Accessories and then click on Paint
• In the Empty White Area click and hold the CTRL key and then click the V
• Go to the File option at the top and click on Save as
• Save as file type JPEG and save it to your Desktop
• Attach it to your next reply

Please download and run Hardware Monitor
Installation (setup version only)
HWMonitor is a hardware monitoring program that reads PC systems main health sensors : voltages, temperatures, fans speed.
The program handles the most common sensor chips, like ITE® IT87 series, most Winbond® ICs, and others. In addition, it can read modern CPUs on-die core thermal sensors, as well has hard drives temperature via S.M.A.R.T, and video card GPU temperature. Please get a screenshot of the sensors window and post it in your next reply.

[Admirgency]

Yesterday, tuesday, the boot-troubles were a bit worse again, sometimes the comp did not boot at all or it lagged at the NEC welcome screen (F2 + F12 option only both did not work every time). Tuesday and wednesday the allarm sounded only after an hour or more, once (now) not at all with being turned on for 2½ hours. Yesterday the comp did not shut down after the alarm sounded 30 sec..

With the SeaTools scan - default options - i could not view the logfile, it's button was greyed out.

SpeedFan Screenshot :



Hardware Monitor screenshot :

[rshaffer61]

Did the SeaTools find and\or repair anything with the HD while scanning it?
The issue does not appear to be power or heat related.
It does seem that the power problem where you are at is contributing to the issue for sure. Normally system files will become corrupted from the sudden loss of power or a failed bootup so I would like you to check this now.

SFC /Scannow Fix Windows

Go Start and then to Run ("Start Search" in Vista),
Type in: sfc /scannow
Click OK (Enter in Vista).
Have Windows CD/DVD handy.
If System File Checker (sfc) finds any errors, it may ask you for the CD/DVD.
If sfc does not find any errors in Windows XP, it will simply quit, without any message.
In Vista you will receive the following message: "Windows resource protection did not find any integrity violations".

For Vista users ONLY: Navigate to C:\Windows\Logs\CBS folder. You'll see CBS.log file.
Usually, it's pretty big file, so upload it to Flyupload, and post download link.


If you don't have Windows CD....
This applies mostly to Windows XP, since Vista rarely requires use of its DVD while running "sfc"
Note This method will not necessarily work as well, as when using Windows CD, because not always ALL system files are backed up on your hard drive. Also, backed up files may be corrupted as well.

Go Start and then Run
type in regedit and click OK


Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

You will see various entries Values on the right hand side.

The one we want is called: SourcePath

It probably has an entry pointing to your CD-ROM drive, usually D and that is why it is asking for the XP CD.
All we need to do is change it to: C:
Now, double click the SourcePatch setting and a new box will pop up.
Change the drive letter from your CD drive to your root drive, usually C:
Close Registry Editor.

Now restart your computer and try sfc /scannow again!


Thanks to Broni for the instructions

Edited by rshaffer61, 12 September 2013 - 04:54 AM.
Corrected flyupload link

[Admirgency]

WARNING! Malformed link to Flyupload, no " : " between http and //. Leads to http.com not to flyupload.
Big "Thank you" for WOT site-advisor.

[rshaffer61]

What was this for?

[Admirgency]

The link to Flyupload you gave.

[rshaffer61]

AHH ok sorry about that. Try uploading the file to this one.

If your attachment is to big to attach then go to Mediafire .
Register and upload your file.
Then reply with the link located to the right of your now uploaded file on Mediafire


www.mediafire.com

[Admirgency]

OK, but i wont have time today or tomorrow.
note : just add a double point : in between http and //, then the link to Flyupload is OK. http.com mis-uses ill written links.