T42 Erratic Behavior Diagnosis

[mark-ibmtp]

Hello, friends! My problem is not necessarily T42-specific, but I suspect it may be a hardware fault which I haven't isolated. The T42 runs XP SP2.

_________________________________
SYMPTOMS

1. The first symptom was an error message (don't have the text, did not happen recently) about being unable to write mysterious Microsoft-internal files (names starting with $), which would be followed shortly by a lock-up or crash. None of the fixes suggested online helped ... but disk failure was given as one possible cause. After reboot, everything would work normally for at least a few hours.

My disk was nearly full ... not enough to prevent writing files, but usually with only a few hundred MB free. I unloaded a few gig of files, and this first symptom went away.

2. More recently, every time I reboot, XP finds that the C drive was not properly shut down (even though shutdown or restart appeared normal), and wants to run a disk check (which I always allow). When XP reboots AFTER this disk check, it starts normally.

3. Even more recently, after I have been running for a while, parts of various windows are unpainted (for example, an entire window will be normal except that the title bar at top is missing). Most extreme is Skype, where the entire interior will fail to "paint" properly, though I can get some items to paint by moving the cursor across them. Eventually, some attempts to use Skype will bring up a dialog saying that there is not enough memory to complete the operation. When this happens, the actually RAM utilization (as shown by Task Manager) is normal, or even low.

Only a reboot will recover from this condition.

_________________________________
WHAT I'VE TRIED

A. Suspecting that RAM could be at fault, I ran linux MemTest86 for more than 12 hours, with no reported errors.

B. I then removed my expansion RAM (I bought the T42 with one gig, added a second from ebay) to see whether it makes any difference ... I'm getting the same symptoms 2 and 3 above, only it takes longer because the T42 runs slow with 1G

_________________________________
NEXT STEPS

Of course, it's possible that some malware has triggered all this. I take medium precautions against infection, including keeping a lookout for unusual processes, but God know what cooties might have crept in. So, I will run some of my most trusted scans.

Other steps on my list include substituting a different hard drive, and starting from a fresh XP install.


If anybody has experience with symptoms resembling these, and perhaps recognizes what might have gone wrong, I shall be grateful for your insights!

[MrMaguire]

The hard drive is definitely suspect no. 1.

[mark-ibmtp]

1. Made a byte-for-byte image of the T42 disk drive

2. Observed that when plugged into another XP machine via a USB/PATA adapter, there was no warning or notification that the drive's first partition (C: on the T42) was not properly unmounted. This is interesting, because on power-up or reboot, the T42 always detects that the drive was not properly unmounted and wants to run a disk check.

Because the drive was just pulled from the shut-down T42, it was in the condition that the T42 would classify as improperly unmounted. But the other computer didn't detect such a condition.

3. Ran chkdsk on the USB-connected drive (twice), with no problems detected.

4. Ran Avast anti-virus scan of every file of the first partition (about 45G of files). One low-threat file was detected.
___________________________

At this stage, it seems to me that the hard disk itself has been substantially exercised: the first partition has had every byte read (empty or not), every file scanned, and passed two chkdsk scans.

My #1 suspect is now the IDE controller on the T42 motherboard.

Next stop, substituting another hard disk.

[MrMaguire]

It's quite common for T42 systems to have problems with the southbridge. Maybe yours is suffering from that.

What's the make and model of your current hard drive?

[ajkula66]

1. Made a byte-for-byte image of the T42 disk drive

Instead of cloning the drive, you should run something like HD Tune on the original drive itself and see whether it comes up with any errors/bad sectors etc.

My #1 suspect is now the IDE controller on the T42 motherboard.

While it's not impossible, I have yet to see that controller fail on a T42 system, and I've gone through hundreds - if not thousands - of them.

Next stop, substituting another hard disk.

Let's see what that brings...

On a different note, have you attempted booting a "live" Linux CD/DVD/USB and checking whether the same type of behaviour is present in that environment?

[mark-ibmtp]

@MrMaguire:

Hitachi HTS726060M9AT00 ASM P/N 13N6806 FRU P/N 92P6122

60 G 7200 RPM

I believe this is a "TravelStar", but its label is partly obscured by other labels ...
_____________________

@ajkula66:

Yes, I repeatedly boot Ubuntu liveCD to do the test and diagnostic work. So far, no anomalies on Linux.
_____________________

The T42 doesn't boot with the cloned drive ... it has the same geometry, I don't know why this didn't work. Sigh

[MrMaguire]

What cloning software did you use? Perhaps it didn't copy over the boot sector or something.

[ajkula66]

I believe this is a "TravelStar", but its label is partly obscured by other labels ...

Yes, that's a Travelstar. These are very old now. Testing for errors and bad blocks is a must.

The T42 doesn't boot with the cloned drive ... it has the same geometry, I don't know why this didn't work. Sigh

When cloning a hard drive on a ThinkPad, the new drive must be in the main slot and the original one in the USB enclosure. Is this the setup that you've had?

[rkawakami]

What cloning software did you use? Perhaps it didn't copy over the boot sector or something.

That sounds like a distinct possibility.

When cloning a hard drive on a ThinkPad, the new drive must be in the main slot and the original one in the USB enclosure. Is this the setup that you've had?

While this is usually the recommended method given here in the forum, I can personally say that it IS possible to go the other way around; having the original drive in the main HD bay of the laptop and the (new) clone drive in the Ultrabay (I don't think I've ever put a clone drive in a USB enclosure as it's pretty slow). I just did this (again) a few days ago when upsizing my A31p drive from 100GB to 160GB. I used Ghost 2003 on a boot floppy which was properly configured to copy the boot sector as well.

[mark-ibmtp]

@Ray & George,

I used the linux dd command (something I have done literally hundreds of times).

I don't copy partitions (for example, /dev/sda1), but rather the entire block device (/dev/sda) which captures the MBR & partition table, along with everything else.

Because I'm using the suspect machine, the neither the source nor destination drives were in the PATA drive slot. I backed up the source drive as a file to a USB backup drive, and then copied this dd image to the destination drive, using a USB-to-PATA adapter.

Usually, when I restore an XP image from a dd image, the drive is in its normal slot.

I can try this ... that is, copying the dd image to the drive in its bay. Does anyone know why this could make a difference?
____________

I deeply appreciate, that you all take time to read about my troubles and offer your wisdom!

[MrMaguire]

I'm not familiar with the Linux DD command, but if you've done it 100 times, then there's no reason why it wouldn't work 101 times.

You could try restoring the image file with the drive in the main bay. It's worth a shot.

Download something like HDAT2 and test the old hard drive, just to confirm whether it's good or bad. You can also use Linux to check the SMART data, I believe.

[mark-ibmtp]

Well, my brain is almost melted ...

I tried copying from the saved dd image into the new disk in the drive bay, and also copying directly from the Travelstar (via a USB adapter) to the new disk in the drive bay.

Same results as before ... won't boot, and my attempts at "rescue" don't work.

Deeply baffled, as to why this seemingly simple procedure fails so completely.
__________________________

I'm backing booting up into the problem scenario (from the Travelstar), and will try running some disk tests.

HD Tune Pro (recommended by one of you), under "Health" (which I believe is SMART data) a "warning" for C4 Reallocated Event Count: Current=100, Worst=100, Data=4. If I understand rightly, this means that 4 sectors were found to be bad and re-mapped.

I'm going to run a few tests with HD Tune. Any recommendations, how to test most thoroughly?

[ajkula66]

Well, my brain is almost melted ...

Try simply cloning the drive with Clonezilla and see where that gets you.

I'm going to run a few tests with HD Tune. Any recommendations, how to test most thoroughly?

Do the error scan and report back the results. It's quite likely that the Travelstar will have to be retired sooner than later.

Good luck.

[mark-ibmtp]

HD Tune Pro error scan passed (twice) with no errors.

I have just run RootkitRevealer ... because the symptoms are so weird and flaky.

The scan results are unlike anything I have seen before, with hundreds of files described as "Hidden from Windows API". There can be a few files which are hidden for a good reason ... but there is no obvious rhyme or reason.

However, it appears that although files in the Windows directory are not (in general) hidden, files in any other directory whose name starts with (or perhaps even contains) the letter 'w' are hidden.

I now think it quite likely that a rootkit is on this machine.

[RealBlackStuff]

No, you just have a hard disk that has been treated poorly.
By running out of space, you prevented any HD-errors to be corrected, such as bad sectors.
There was no room left to 'mask' these and move the contents to a new sector.

Those $-files are usually related with Windows updates.
Every subdirectory that has a name starting with $NtUninstall can be completely deleted.
You may have a few hundred of those, all wasting space.

If I were you, delete those subdirs, empty all your Temp directories, empty the Recycle bin, then start defragment and go to bed.
Get another (new if possible) HD and clone your old HD onto it.

[mark-ibmtp]

In case anyone is interested in the progression of my "soap opera" ...

ROOTKIT

Although there is clearly a rootkit, several packages I installed that are supposed to be able to detect and clean common rootkits failed to detect anything. Actually, GMER (which is very detailed) found a large number of discrepancies, but its output requires a lot of savvy to interpret.

CLONING

Although I no longer suspect anything having to do with the hard drive, I was so baffled by the failure of my cloned disk to boot (being sure that the procedure I used always works), that I tried Clonezilla as one of you recommended. Same outcome: Operating System not found.

Even though the cloned drive has a Lenovo part number on its Fujitsu label, the T42 seems to have trouble booting from it.

FREE SPACE

With all due respect to RealBlackStuff, the first partition (C:) has 2.5 G free space, and the logic cited (concerning bad sectors) is about 20 years out of date. All "modern" drives have reserved extra sectors (over and above the nominal disk size), which their on-drive controllers use as spares in case of bad sectors. Although software filesystems may have the capacity to handle bad sectors, they will only see them if the hard drive runs out of reserve sectors, and by the time that happens, the disk is in extremely bad shape.

Barring such calamity, the ability of the drive to remap bad sectors has nothing to do with whether the disk is empty or full.

[RealBlackStuff]

Your Travelstar is probably almost 12 years old and built with even older technology...
I'm also sure you have heard of a failing Southbridge...
I'll leave the rest to you.

[mark-ibmtp]

FOR THE INFORMATION OF ALL INTERESTED READERS ...

Drives that comply with the S.M.A.R.T. standard are designed with extra storage space (over and above their nominal capacity). With every storage access, they check the integrity of each allocation unit (usually sector, for a hard disk), and if that unit is bad, they mark it is defective and substitute a spare allocation unit. This is called reallocation.

The old Travelstar in my ailing T42 is indeed S.M.A.R.T. compliant, and the readout of S.M.A.R.T. parameters shows that it does indeed perform reallocation.

Note that S.M.A.R.T. is not limited to hard drives: because of the "wearout" phenomenon in solid-state "flash" drives, reallocation is essential to integrity, and they may also be S.M.A.R.T. compliant.

@RealBlackStuff:

The IDE controller is still suspect. I will be grateful for any suggestions, as to how I could most thoroughly test it.

Edited to Add: Could the bizarre inability to boot from the Fujitsu be related to a fault in the IDE controller?

[rkawakami]

The only time I've had problems booting from a drive, it's been with ANY system; not just one particular one. That said, there are ways of testing the disk controller in the T42. Read your PM.

[mark-ibmtp]

HARDWARE LOOKS TO BE OK

Not knowing how to locate and remove the rootkit, I have used the Last Resort -- starting from scratch with the Recovery disks. I forgot how much time this takes

With the fresh install, I no longer get the disk-check prompt when I reboot (I've been through numerous reboots by now, because of installing and updating stuff).

I've also run more diagnostics on the drive and the IDE controller -- all test OK.

What a nasty piece of malware ...

For my next trick, I will change lots of passwords. I have to assume that the rootkit logged everything I typed on that machine.
__________________________

I still don't know why the T42 wouldn't boot from the Fujitsu (which I have previously used as the first drive of a T43), but this question is of no practical importance.
__________________________

One more item, to tie up the loose ends ... the screwy behavior with Skype (failing to repaint in its window) also showed up on my T43. I now suspect that it is a combination of recent versions of Skype, and exhaustion of Win32 handles (an internal OS resource) when I have the Chrome browser open with zillions of tabs (a habit of mine).

In any case, it doesn't seem to be connected with the other gremlins. The T43 scans normally with Rootkit Revealer.
___________________________

Thanks to everyone, who has taken time to read about my troubles, and especially to offer advice and assistance!

I wish you all good health and good luck in 2016 !!!

[axur-delmeria]

I now suspect that it is a combination of recent versions of Skype, and exhaustion of Win32 handles (an internal OS resource) when I have the Chrome browser open with zillions of tabs (a habit of mine).

I think the computer is simply running out of RAM (and using the page file /swap file / virtual memory) because Chrome eats more RAM for every new tab opened.