W2K machine is down!!

[LawyerRon]

I'm helping a friend get his W2K machine back up and running. This is a machine that was on 24/7. It began to run very slow (painfully slow) so he brought it to me.

He also wanted the Cely 1800 cpu upgraded to a P4 2.53 (533)with 512mb of PC2700 (Kingston). Intel's site says the board (845G) supports this cpu with Bios version PO2 or greater; he has PO4, so the bios version should not be an issue. I put the P4 cpu in, along with the new memory and powered the machine up. The board reconized the P4 and memory just dandy on the bios screen

But, when I powered the machine back up, it would not boot into Windows. It would just hang on the W2K splash screen. I've tried just about everything I could think of; booting from the W2K Pro cd and using the repair feature (no luck, it still hangs), recovery console (no luck), and even trying to reinstall W2K. If I try to reinstall W2K, I get the message, "looking for previously installed versions of Windows", and then the system just hangs there.

I've run WD's diagnostic utility and it says the 40gb WD drive is good. With the WD utility, I could even copy all the data from the "C" partition to the last partition, which is "H".

This machine is really acting like it has a virus or trojan. However, I can't seem to get it back up and running.

I even tried putting the old Cely 1800 and the old PC2100 memory back in, but the same thing happens.

It seems that W2K got seriously hosed somehow.

What's my next step?

[KHT]

I assume you`ve tried booting to safe mode, last known good configuration and into VGA mode. . Try holding F8 and select boot logging. After you try to boot and it hangs, and I also assume you`ve given it a LONG time to try to boot, I would shut down and pull the drive and slave it to my machine, run a virus scan and then check ntbtlog. It is normal for some drivers not to load during boot up, the last entry in the boot log should be what is hanging the boot process.

[LawyerRon]

Thanks KHT, yes, I've tried Safe Mode, Last Known Good Config, Boot logging, etc. I think my next step will be to slave the drive in as you suggest. I'm not familiar with ntbtlog, so more info on this procedure would be appreciated.

[KHT]

ntbtlog is in the Winnt folder, it can be opened with notepad.

Assuming you`ve enabled boot logging and had the boot process hang on the Windows splash screen again and then shutdown. After pulling the drive, slaving to another machine and running a virus scan, navigate to the Winnt folder of that drive and inspect the nbtlog file. It should have logged the drivers and services that loaded or failed to load during boot up. Again, it is normal for some drivers to fail to load during the boot process to save recources. The one I would be interested in is the last entry which would be the driver\service which was trying to load when you shutdown. This should be the driver\service that was causing the hang and give you an idea of where to look for the problem.

[LawyerRon]

KHT,
Thanks for the help, I'll check it out when I get home this evening.

[Urban Earth]

If you changed the hardware you will have to reinstal 2K. It will not recognize the new hardware as with other versions of Windows.

Alan J

[fudtone]

when you mentioned that this machine was running slower and slower it makes my gears drive.

Was there anything you did to trouble shoot this before the parts swap?

I have seen 2k stall at this point for 2 differnt reasons on about 5 differnt machines.

1 as Urban earth mentioned 2k may have a hard time recognizing the changed hardware. a install might fix it or maybe some sort of repair .When I see this I always was in a posistion to fdisk.

2 sounds crazy but may be why the system was slowing down. PSU could be getting week at the welcome screen is when the cpu expects the most power. This is the less common but I have seen it on 2 differnt machines.

3 oops forgot if scsi fails you will freeze here also.

[KHT]

A CPU\memory upgade should allow W2k to boot. The system is obviously loading NTLDR, reading boot.ini, running NTDETECT, and loading NTSKRNL. I think the problem is somewhere in the Kernel initialization phase when a driver or service is failing to start.

Lawyer Ron is trying to salvage the system and not do a raw install. He tried several repair options and still had the system stall at some point. That is why I suggested scanning the drive for virus, which he stated still has the file sytem intact, on another machine and inspect the ntbtlog file in hopes of identifying the driver\service that may be causing the problem. The problem could have been caused by a virus or trojan. It may still require a re-install but considering the data is still intact it`s worth trying to get it boot on its own again.

[LawyerRon]

fudtone,
You make some good points, however, I was never able to get this machine back up after he shut it down; Just wasn't happening.

I took KHT's suggestion and slaved it into another machine, scanned for viruses (found none) and then scanned for spywhare; strange thing is when ever Ad Aware got to the documents and settings folder on the C drive, it would lock up the "Master" computer. Seems something was seriously corrupted in W2K and I never discovered what it was; I just reformatted and reloaded W2K and he's back on the road.