RE: NTw4 BSOD

[Len Hammond]

Title: RE: NTw4 BSOD

The same thought went through my mind.  The department supervisor hounded me on getting a machine back to the user, so I informed the supervisor of what caused the crash, I think that shook up the user bad enough to not "knowingly" bring in unapproved software again.

 

So far I haven't been able to get into the drive to look it over.  I'm beginning to wonder if there is a media failure in it.  Although it does start to boot on it's own before it blue screens.

 

Len

 

-----Original Message-----
From: Niels Christiansen [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 1:14 PM
To: NT System Admin Issues
Subject: RE: NTw4 BSOD

Maybe the user downloaded and installed the *same* rogue app that caused the problem the first time?

Almost too obvious to be true, but...

 

/\/iels

-----Original Message-----
From: Ray Zorz [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 8:36 AM
To: NT System Admin Issues
Subject: RE: NTw4 BSOD

Sounds like you're on the right track. Could be the drive, could be the controller. Heck, it could be power. If possible just give her a new box.

-----Original Message-----
From: Len Hammond [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 16, 2001 6:22 AM
To: NT System Admin Issues
Subject: NTw4 BSOD

Got an interesting problem.  About a month ago I had a user machine (NTw4
SP5) give a Blue screen error.  Stop e5 -- indicating that the SAM database
was corrupt.  Nothing tried brought the box back to life.  ERD failed also
as the ERDisk was out of date.  Last Known Good boot also failed.  Moved the
physical drive to another machine to view contents.  No viruses found.  Did
find about 15 small downloadable programs loaded on the box.  Junk from the
Internet - like screen savers and wallpaper retrievers and animated cursors
and such.  All clearly in violation of company policy.  Suspected that one
of these "rogue" apps had something to do with the corruption of the SAM.
Anyway, in short, I recovered her data files that were saved locally and
used DelPart to wipe out the partitions and rebuild the box from a bare
drive, again.  Machine worked fine.

Today, a month later, this machine has the same BSOD and corrupted SAM.  Is
there some kind of virus that can not be detected and survive an FDISK and
repartitioning that can come back to haunt me?  Or is there something in the
build process I'm missing.  I have 50+ other machines built to the same
configuration and from the same CDs in the building here and a few more out
of town.  NONE of these other boxes exhibit this problem. 

At this point I am planning the same investigation I did before - slave the
drive into a known good box and view the contents looking for "rogue" apps
and scan for viruses.  I am thinking that I might give her a different
physical box this time to see if it crashes with different hardware.  Maybe
a hard disk change is in order in this box?  Grasping at straws here.

Any thoughts?

Len Hammond
Network Administrator
Pontiac Coil, Inc.
248-922-1100  Main
248-922-2250  DID
248-922-1315  Fax
[EMAIL PROTECTED]

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm

http://www.sunbelt-software.com/ntsysadmin_list_charter.htm