but you are not booting from the system partition, correct? .. when you boot from the ghost boot disk?

i mean, it sounds like you're having problems *before* the hard disk is ever accessed.

what about defective hardware, such as bad memory?

i always like to blow a fan on the mobo, to make sure it's not heat related, or affected. to rule that out. is mobo dusty? (which can act as heat insulator)

general exception .. that's a crash, no? (memory related)

can you run memory diagnostics from a dos boot floppy?

can be difficult to troubleshoot bad memory.

"norwegian reset" .. never heard that term before. but i like it.  

definitely some weirdness going on, if the system does not boot on the first power-up.

and if it's not booting on the first boot, then i think that rules out any heat issues.

what about ide controller issues? .. i thot of that when you mentioned it might be having trouble when trying to access drives. the primary drive typically gets the most work and therefore usually dies first.

does the unit have good cooling/fans/air-flow?
swapping out components would provide valuable insight.

perhaps you could run some disk utilities, to be if it detects any hard disk anomolies.

these are difficult problems to troubleshoot.

the good thing about having a back-up image on the 2nd hard drive is that it makes swapping out the primary drive fairly painless.

Rad,

"norwegian reset", well, there are many "norwegian stories" circulating in Sweden. Most of them focusing on how sweet and stupid they are. There are as many "swede stories" circulating in Norway. Brother nations they call us!

About the issue at hand, I don't think it is heat related. The HDDs run at normal (low) temperatures in a well vented case but there is no HDD fan (except the small one in the mobile rack). If it is HDD failure, that will be confirmed in two steps: 1) substituting a different HDD and if Ghost loads without errors after that 2) reinstall the troublesome HDD and nuke it by DELPART which should rewrite everything on that HDD.

Having the images on a different HDD is important in situations like this. Regrettably, there is no Disk-to-Image but only Partition-to-Image which means that XP has to be installed on a new HDD, during which the HDD is partitioned prior to restoring the image. (That also will put the correct MBR on the new HDD which is lacking from a Partition-to-Image.)

NightOwl,

I said that I cleaned out the computer when installing a new video card a few weeks ago. I discussed this with my friend after posting and it actually was a few weeks before Christmas which makes it more like a few months ago.

The computer has been running flawlessly after the new video card was installed. He has been very satisfied with "Google Earth opening up a whole new world on the new hardware". There has not been a hint of any compatibility issue during the few months after the new video card was installed.

The last time Ghost started from the GBDs was after installing the new video card when the system was reimaged and the image checked for integrity.

Every "piece of evidence" indicate that the malware is the culprit. An additional "piece of evidence" is that he has analyzed his actions last week when things started to go wrong. He came to the conclusion that he may have picked up the infection when he wanted to join an association and pay the fee over the internet with his credit card. The transaction was not completed but an error due to technical difficulties was reported.

Torpig is a keylogger - password stealer. The strange thing is that it is over a year old and Norton should have detected it. I don't remember which but one of the other malware has the ability to shut down AntiVirus software and/or "allow" themselves in the FireWalls. That may explain why Norton didn't detect the malware and its actions.

I will do some more googling and share any information that I find.

Christer

Christer

Quote:

Well, the sequence of events does not seem to support that the video card is the culprit.

But, I can not think of how malware could effect the initial POST of a system that requires the "norwegian reset"!  Even if the malware is infecting the Master Boot Record (MBR) on the HDD--accessing the MBR would be later in the process than when the system is initially powered on.

And, when booting from a floppy boot disk--the main system is essentially isolated being as the MBR that is read is that of the floppy disk--now the only system level issue would be the CMOS settings!

Failure of electronics is most likely early in its life cycle of a device...but,

Quote:

That tends to point a finger at a software issue--if it were hardware related--Safe Mode should not solve the problem!

The fact that you can boot to DOS with the boot floppy successfully, but the system reports an error when Ghost is being loaded usually means there's a problem with device compatibility and accessing of HDD's or optical drives:

How to troubleshoot the error: "Internal error 36000 . . . "

It will be interesting to hear your ongoing troubleshooting efforts and results!

Christer

Quote:

Well, that's a thought!  My experience with modifying absolute sector 62 where Ghost 2003 *marks* each HDD--as well as placing its *fingerprint* data--has shown that Ghost does access that code on each Ghost load, if a single data point is altered prior to the Ghost load--you get the opening screen stating that Ghost needs to *mark* the drive again (so there must be a *check-sum* for the data Ghost places in sector 62 that must pass testing).

I've written a number of different thing to that sector--Ghost simple over-writes anything there when it *marks* the HDD again, if you allow it to during that load when it reports finding an un-marked HDD.  So, I don't know if a virus or malware could place data there that can protect itself from another program overwriting data in that sector.  And I've never had Ghost fail to load because of changes in that sector--but maybe malware could effect that!??????

Here's a Windows based *sector editor* (

Roadkil's Sector Editor

) that would allow you to look at that sector 62--or any other sector for that matter--see here for discussion:

Invalid Partition Offset Error during Integrit

And here's another discussion about using a DOS based *disk editor* (

PTS Disk Editor

):

Erase DiskID on external USB drive

You can use these tools to just *look* if you wish--you don't have to actually edit or modify anything!

NightOwl and El_Pescador,
I'm a little short on time right now but I will take your thoughts/suggestions in consideration. As you may remember, I do not have the computer to hand. If I find the time, I will probably go there tomorrow.

Thanks,
Christer

One of the local computer shops was closed for "stock taking" and the other had no means for testing RAM or RAMBUS. My friend needs his computer and decided to buy a new motherboard and memory modules. Two 256 MB RAMBUS modules would be twice as expensive as a new motherboard and a 512 MB PC3200 RAM module! The difference is made up for by me installing the new hardware and reinstalling the software. If possible, a repair installation will be done.

Christer