Re: New build - halt on ACPI Controller

The message <fga055$3bg$1$8302bc10@xxxxxxxxxxxxxxxx>
from "Peter Boulton" <peter@data*no-spam*perceptions.co.uk> contains
these words:

Hi John,

You were quite right! Brilliant - thanks! I think the boot order was
wrong - hard drive (unformatted) before CDROM. When I switched to CDROM
first I could boot from a cdrom no problem.

I realise your thanks are aimed at JJ, rather than me but it looks as
though you might have laid a 'booby trap' for yourself by creating a MBR
on the hdd from a previous install attempt. When the boot order is hdd
first, followed by the CD, it will only ever attempt to boot from the CD
if the hdd has no mbr written to it (for most folk, that only happens to
the case when booting for the first time with a "brand new, straight
from the factory" hdd fitted).

In this case, the bios handed control to the MBR code and then hung,
otherwise one would normally expect to see the usual "No Boot Device
Found, please insert disk and press enter" type of error message, in the
absence of a bootable cd.

Having a hard drive connected to the MoBo when booting up can be the
cause of some really strange problems which can look like a MoBo
hardware fault issue. This particular problem you were having is one of
the less confusing of such 'phantom hardware failures' since all you had
to do was leave any such drives disconnected from the MoBo and verify
the POST sequence would stop with the expected non- bootable disk error.

I recently dealt with a 'non powering' E-Machines PC which was
exhibiting all the strangeness of a MoBo damaged by the Bestec PSU's
classic 5v SB overvolting failure mode (but without the Bestec showing
out of spec voltages). disconnecting the cdrom and hdd interfaces and
testing with a known good PSU seemingly, at the time, making no
difference to the symptoms.

I concluded that a replacement MoBo was required and had the customer,
who had witnessed this test procedure, agree to the repair (in
hindsight, suspiciously) reluctantly enough that I was persuaded to do
it as a fixed price repair (never again, since the time element can be
ever so dependent on whether a repair install is even going to be an
option and on how much malware removal is required to reasonably remove
any risk of damage to the freshly installed parts).

As it happened, the repair procedure took rather longer than
anticipated on account the winXP installer just wouldn't give me the
option of a repair install even though it was quite capable of warning
against installing over the existing installation of windows. In the
end, I decided on this option, after renaming the Documents and Settings
folder to Old Documents and Settings to preserve as much as practical,
the user data and removing the existing windows folder to minimise the
'resident malware' risk.

All seemed well after completing the fresh re-install. Indeed, I saw no
problems during the post install fettling which includes the obligatory
'de-kakamimiising' of the various system defaults and the installation
of AVG, SpyBot S&D, Ad-Aware SE, the updates(both ms ones and the
anti-malware ones) and the google toolbar and the system scans.

A few days after the customer had collected a demonstrably repaired
system, he was on the phone complaining that it was showing exactly the
same symptoms again. When he arrived, I immediately set it up on the
workbench and it booted up perfectly fine showing none of the symtoms it
had originally shown the first time I had looked at it.

However, whilst we were discussing the details of his current problem.
lo and behold, some 15 minutes into the discussion, it started a
shutdown all by itself and, after a minute or so of being 'switched
off', 'spontaneously' switched itself on again at which point it was
decided that the system be left with me for further testing.

Now this being an E-Machines PC, complete with its original (and
dreadful) Bestec PSU, I naturally assumed it had to be down to "PSU
Weirdness" despite the lack of overvoltage on the 5vSB line, but the
symptoms persisted with a further two PSUs, and, seemingly, getting
worse with each testing.

I landed up timing the events with a stopwatch since the only way it
could have been automatically switching itself back on was via the RTC
turn on by alarm function which can only be set to the nearest minute. I
landed up using the rear panel mains isolator switch to switch it off as
soon as it 'spontaneously' restarted itself so that I could verify
whether it was going to restart at almost a whole minute after switch
on.

I think by this time, I had disconnected both the hdd and the cdrom.
Rather disconcertingly, it was now powering up within a few seconds of
un-isolation of the mains supply, but persistance eventually paid off (I
suspect just over a minute later:-), when it finally gave up the
spontaneously restarting nonsense once and for all.

After considering some very worrying virus induced damage
possibilities, I was eventually forced to conclude that the customer had
managed to re-infect the PC with a very annoying virus/trojan that not
only had planted a trojan process to program a startup by RTC alarm
event in the cmos and was telling windows to shutdown (not a restart),
but had also infected the HDD boot sector (this latter item possibly
remaining from what I had to presume was the original infection that had
created the symptoms of a dying MoBo in the first place). A google
search on this ("virus spontaneous switch ons" and varations on this
theme) failed to produce any relevent results, so I'm left guessing that
a recent, as yet unidentified, zero day threat is now making its
presence felt.

What reinforces this view is the fact that on this second visit to my
workshop, the '80GB' drive was only showing up as an 18GB drive C in
spite of the fact that diskmanager claimed it had a single healthy
75.6GB NTFS partition and forced chkdsk on reboot scans failed to
produce any change to this situation. I suspect this was the situation
the first time round but the time restraints (already well and truly
exceeded) enforced by the 'fixed fee' job agreement hadn't allowed me to
notice this strange condition.

The use of partition analysis and repair tools unearthed a further two
partition spaces, an unformatted 38GB primary NTFS partition and a final
18GB FAT32 logical disk volume in the remaining extended dos partition
space (a rather curious 18/38/18 split of disk space on an OEM installed
winXP machine with a hard drive that matched the advertised capacity as
shown on the 'Brag ***' sticker (thus precluding the possibility of a
20GB to 80GB hdd upgrade being the reason behind the curious
partitioning arrangement).

Rebooting into windows revealed an extra drive _E_ (drive D being the
unformatted primary NTFS partition space) which was devoid of any user
data. I formatted the spare NTFS volume to restore access to the missing
38GB of disk capacity and left it at that. I can only suppose the virus
must have deleted the extra partitions or the possibility that a
'Factory Restore' attempt by the customer had gone badly wrong. In
either event, a 'software' issue instead of the entirely reasonably
supposed hardware fault, after all it was an E-Machines PC exhibiting
all the classic symptoms of a 'fried by the classic Bestec 5v SB
overvolt PSU failure mode'.

Rather annoyingly, the customer insisted that all this extra work was
part of the original fixed fee job (on the basis that I hadn't cured the
original problem) I _knew_ I had, but it just wasn't worth my time
trying to put him (and his likewise, bloody minded missus) straight on
this issue and explain that this was the almost inevitable consequence
of asking for a 'cheap job' when they probably knew more about the real
cause of the problem than they were prepared to let on at the time they
initially submitted the PC into my care.

Furthermore, he used the argument that:- "If my first attempt had
failed to cure the fault, how was he to know that my second attempt
wasn't also destined to likewise fail?", electing to pay me for the
'nominal' 1 hour's worth of extra workshop time I was asking only if it
remained 'fixed' for the next ten days or so. Since I _hadn't_ been able
to find any references to support my 'weird virus' hypothesis, I decided
it was best to let him have his way in the matter.

In hindsight, I should have simply refused the job in the first place
and sent them packing. There are, quite simply, some people in this
world who think the service industry owes them a living (you know the
type. "Knows the price of everying but not its value"). I guess I'll
simply have to chalk this one up to experience (I don't anticipate a
return with money and suitable apology from this customer).

From now on, I'm going to be extra leery of dealing with any more such
E-Machines PC faults. If my 'weird virus' theory has any basis in fact,
I'd expect to see similar faults on other makes of PC begin to appear.
I'll just have to wait and see what develops. :-(

--
Regards, John.

Please remove the "ohggcyht" before replying.
The address has been munged to reject Spam-bots.

.