Malicious Software Removal Tool Errors Reported

[DavidB]

Hello

Can anyone give me an idea of what the following log file reports mean after
running the MST today?

Microsoft Windows Malicious Software Removal Tool v1.36, December 2007
Started On Wed Dec 12 15:59:33 2007
->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))
->Scan ERROR: resource process://pid:2400 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:2400 (code 0x0000054F (1359))
->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 12
15:59:53 2007

Many thanks in advance

DavidB

 

[nass]

Hello

Can anyone give me an idea of what the following log file reports mean after
running the MST today?

Microsoft Windows Malicious Software Removal Tool v1.36, December 2007
Started On Wed Dec 12 15:59:33 2007
->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))
->Scan ERROR: resource process://pid:2400 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:2400 (code 0x0000054F (1359))
->Scan ERROR: resource process://pid:1388 (code 0x00000005 (5))
->Scan ERROR: resource process://pid:1388 (code 0x0000054F (1359))

Results Summary:
----------------
No infection found.

Return code: 0
Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 12
15:59:53 2007

Many thanks in advance

DavidB

Hi DavidB,
This can happen if the MWMSRT didn't have access to a process that was in
use or termainated by the system.
Resolution: you don't have to worry about it, but if it did happen when you
reRun it then this can Indicate on a Viral infection on your system and you
need to Run these cleaning steps to make sure there is/are not any nasties on
your machine.

Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Taps:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
Spybot Search & Destroy
http://www.safer-networking.org/en/download/index.html
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx


Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html
Lots of tools to download and disinfect your machine (offline scanner):
http://www.bitdefender.co.uk/site/Downloads/browseFreeRemovalTool/

After the scan run disk cleanup on your drive.

HTH.
nass

 

[PA Bear]

Don't worry about it.

 

[DavidB]

HTH.
nass

Thanks Nass.

I have run most of these already but will try the ones I was unaware or
hadn't thought of - the MSR tool has reported in this way for the last 3
months of running and I was concerned that there might be a virus.

The only problem is that if there is a virus then it is not apparent when
Windows is loaded and running normally except when i have run a scheduled
chkdisk prior to startup. If I do this, once the check has completed and
Windows has loaded I cannot open any anti-virus utilities, the control panel
or the processes tab of Task Manager - so I can't see what's running. I can
however open any other applications (apart from Outlook). A reboot always
fixes this.

This led me to believe that there was a boot-time virus so I downloaded a
virus scanner that would operate in dos and also made a floppy to allow me to
access my NTFS disc from the A: drive on boot - however I cannot get further
than the computer booting and recognising the A: drive, it reports that there
is no C: drive (or any other drive for that matter) when I try to change
directory to run the dos virus scan.

I actually changed the boot hard drive last week, using a clean disc and
having neither of my other 2 HD's connected when I was installing windows.
The same behaviour in Windows after running a chkdsk is still apparent. Is
it possible for there to be a virus in the hardware other than the hard
drive? I don't use any memory keys or the like so the only possible place I
can think of is the RAM which has checked out clean every time I've scanned.

As you may be able to tell I am not particularly knowledgable about viri so
any help or suggestions you can give would be much appreciated.

DavidB

 

[nass]

Thanks Nass.

I have run most of these already but will try the ones I was unaware or
hadn't thought of - the MSR tool has reported in this way for the last 3
months of running and I was concerned that there might be a virus.

The only problem is that if there is a virus then it is not apparent when
Windows is loaded and running normally except when i have run a scheduled
chkdisk prior to startup. If I do this, once the check has completed and
Windows has loaded I cannot open any anti-virus utilities, the control panel
or the processes tab of Task Manager - so I can't see what's running. I can
however open any other applications (apart from Outlook). A reboot always
fixes this.

This led me to believe that there was a boot-time virus so I downloaded a
virus scanner that would operate in dos and also made a floppy to allow me to
access my NTFS disc from the A: drive on boot - however I cannot get further
than the computer booting and recognising the A: drive, it reports that there
is no C: drive (or any other drive for that matter) when I try to change
directory to run the dos virus scan.

I actually changed the boot hard drive last week, using a clean disc and
having neither of my other 2 HD's connected when I was installing windows.
The same behaviour in Windows after running a chkdsk is still apparent. Is
it possible for there to be a virus in the hardware other than the hard
drive? I don't use any memory keys or the like so the only possible place I
can think of is the RAM which has checked out clean every time I've scanned.

As you may be able to tell I am not particularly knowledgable about viri so
any help or suggestions you can give would be much appreciated.

DavidB

Hi David,
Either you can use the Avast Anti-virus as it has the Capability's to run An
On Boot Virus scan which is very good to determine if you have a Boot sector
Virus like WXY for example.
http://www.avast.com try the home user free version.
Also try to check the Event Viewer log for error as this not good new if you
run the chkdsk to enhance your system you get the opposite which slowing down
or unresponsive system for a while.

Open a Notepad, customize or minimize to the taskbar as you will need it
later for this step to copy the error message on it.
Open a run command and type in:
eventvwr.msc click [OK] you will get the Event viewer control Panel.
click on each of these:
Application
System
Security
Look in the right Pane/window for error message with red (X) or Yellow
exclamation mark /!\ , double click each one to get more info about the
causer.
On the Event error properties message you will see:
Up Arrow
Down arrow
Two pages
Click on the two pages to copy the error message then bring up the Notepad
you opened earlier and right click on the first line and select Paste from
the list, this will paste the error message on a Notepad.
Please don't duplicate the error message one of each kind will be sufficient.
HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

Please we need just the error messages with Red (X) and don't repeat the
error, just one of each kind and post them back in your next post.

Extra Info it doesn't mean it apply to your issue, just in case:
System Has Recovered from a Serious Error:
http://support.microsoft.com/kb/316424
You receive a "System Has Recovered from a Serious Error"
http://support.microsoft.com/kb/317277
HTH.
nass

 

[DavidB]

http://www.nasstec.co.uk

Hi Nass

Thanks again for your continued help. I have downloaded Avast as you
suggest and will install it tomorrow evening and give it a try.

I have pasted the Event viewer logs showing the errors when I replicated the
fault by running chkdsk on a reboot. The error in applications occured 4
times within a few seconds - always the same error. The other 2 occured
once each.

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 20 30 2e ure 0.
0018: 30 2e 30 2e 30 20 69 6e 0.0.0 in
0020: 20 75 6e 6b 6e 6f 77 6e unknown
0028: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0030: 20 61 74 20 6f 66 66 73 at offs
0038: 65 74 20 30 30 30 30 30 et 00000
0040: 30 30 30 000

From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.



For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

DavidB

 

[nass]

:

Please if you wish to "SNIP" snip all or leave all as we are here for links?.
That been said, I hope you performed a scan on your machine and made sure
all okay.
There is another option but we will come to it if these steps didn't help or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and run it on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on the DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine, please
delete this log and make sure the machine is get the IP address Auto.
On the machine having trouble obtaining IP address Open a run command and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a while.


DHCP Across IP Routers
http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass

 

[DavidB]

The machine is not networked other than through a router to the Internet.
As I've stated previously, rebooting the machine without running a further
chkdsk while the errors are occuring resolves the problem.

I installed Avast AV and did a boot time scan - no problem reported so I
scheduled a chkdsk and a boot time scan together - chkdsk ran and the boot
scan was aborted when it tried to run. On a subsequent reboot the scan ran
but of course i had not run chkdsk so the problem had disappeared again.

One thing that also happens each time the fault occurs is a message as
Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should have
told you that before.

I cannot access services.msc while the computer is faulting - therefore I
don't know if the IPsec service is running or not. It is running
automatically when the fault is not apparent

Memory checks out OK.

I am becoming more concerned that the problem may be in the BIOS of the
machine - is this possible?

DavidB

:

Please if you wish to "SNIP" snip all or leave all as we are here for
links?.
That been said, I hope you performed a scan on your machine and made sure
all okay.
There is another option but we will come to it if these steps didn't help
or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and run it
on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or
manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on the DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine, please
delete this log and make sure the machine is get the IP address Auto.
On the machine having trouble obtaining IP address Open a run command and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a while.


DHCP Across IP Routers
http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass

 

[nass]

:

Please if you wish to "SNIP" snip all or leave all as we are"" NOT"" here for
links?.
That been said, I hope you performed a scan on your machine and made sure
all okay.
There is another option but we will come to it if these steps didn't help
or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and run it
on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or
manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on the DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine, please
delete this log and make sure the machine is get the IP address Auto.
On the machine having trouble obtaining IP address Open a run command and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a while.


DHCP Across IP Routers
http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass

The machine is not networked other than through a router to the Internet.
As I've stated previously, rebooting the machine without running a further
chkdsk while the errors are occuring resolves the problem.

I installed Avast AV and did a boot time scan - no problem reported so I
scheduled a chkdsk and a boot time scan together - chkdsk ran and the boot
scan was aborted when it tried to run. On a subsequent reboot the scan ran
but of course i had not run chkdsk so the problem had disappeared again.

One thing that also happens each time the fault occurs is a message as
Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should have
told you that before.

I cannot access services.msc while the computer is faulting - therefore I
don't know if the IPsec service is running or not. It is running
automatically when the fault is not apparent

Memory checks out OK.

I am becoming more concerned that the problem may be in the BIOS of the
machine - is this possible?

DavidB

Did you update the Motherboard Drivers since you install XP on this machine?.
Go to the Motherboard manufacturer website and download the latest drive4s
for your Mobo and install them.
What make is your Motherboard and version?.
Try to access the services in Safe Mode, Does it work?.
Also make sure your account having Admin privileges or permissions.
HTH.
nass

 

[nass]

:

Please if you wish to "SNIP" snip all or leave all as we are"" NOT"" here for
links?.
That been said, I hope you performed a scan on your machine and made sure
all okay.
There is another option but we will come to it if these steps didn't help
or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and run it
on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or
manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on the DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine, please
delete this log and make sure the machine is get the IP address Auto.
On the machine having trouble obtaining IP address Open a run command and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a while.


DHCP Across IP Routers
http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass

The machine is not networked other than through a router to the Internet.
As I've stated previously, rebooting the machine without running a further
chkdsk while the errors are occuring resolves the problem.

I installed Avast AV and did a boot time scan - no problem reported so I
scheduled a chkdsk and a boot time scan together - chkdsk ran and the boot
scan was aborted when it tried to run. On a subsequent reboot the scan ran
but of course i had not run chkdsk so the problem had disappeared again.

One thing that also happens each time the fault occurs is a message as
Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should have
told you that before.

I cannot access services.msc while the computer is faulting - therefore I
don't know if the IPsec service is running or not. It is running
automatically when the fault is not apparent

Memory checks out OK.

I am becoming more concerned that the problem may be in the BIOS of the
machine - is this possible?

DavidB

Did you update the Motherboard Drivers since you install XP on this machine?.
Go to the Motherboard manufacturer website and download the latest drive4s
for your Mobo and install them.
What make is your Motherboard and version?.
Try to access the services in Safe Mode, Does it work?.
Also make sure your account having Admin privileges or permissions.

Adding to the above, to access the services.smc do the following:
For Repairing Services.msc try this:
Open a Run command and type in:
net service start click [Ok]
net services start click [OK]
regsvr32 filemgmt.dll click [OK]
Reboot you machine are you able to access services.msc?.

Do you have this file here:
c:\windows\system32\services.msc

If the above didn't help try to Restore to an earlier point, but please
backup your data before attempting to do so.
If still no luck then a Repair/Install of XP is a must:
http://www.michaelstevenstech.com/XPrepairinstall.htm
HTH.
nass
====
http://www.nasstec.co.uk

 

[DavidB]

:

Please if you wish to "SNIP" snip all or leave all as we are"" NOT""
here for
links?.
That been said, I hope you performed a scan on your machine and made
sure
all okay.
There is another option but we will come to it if these steps didn't
help
or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown,
version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by
downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and
run it
on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of
network
interfaces on the machine. This can be a potential security hazard to
the
machine since some of the network interfaces may not get the
protection as
desired by the applied IPSec filters. Please run IPSec monitor
snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or
manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter
parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been
created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network
address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on the
DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine,
please
delete this log and make sure the machine is get the IP address Auto.
On the machine having trouble obtaining IP address Open a run command
and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a while.


DHCP Across IP Routers
http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass

The machine is not networked other than through a router to the
Internet.
As I've stated previously, rebooting the machine without running a
further
chkdsk while the errors are occuring resolves the problem.

I installed Avast AV and did a boot time scan - no problem reported so
I
scheduled a chkdsk and a boot time scan together - chkdsk ran and the
boot
scan was aborted when it tried to run. On a subsequent reboot the scan
ran
but of course i had not run chkdsk so the problem had disappeared
again.

One thing that also happens each time the fault occurs is a message as
Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should
have
told you that before.

I cannot access services.msc while the computer is faulting - therefore
I
don't know if the IPsec service is running or not. It is running
automatically when the fault is not apparent

Memory checks out OK.

I am becoming more concerned that the problem may be in the BIOS of the
machine - is this possible?

DavidB

Did you update the Motherboard Drivers since you install XP on this
machine?.
Go to the Motherboard manufacturer website and download the latest
drive4s
for your Mobo and install them.
What make is your Motherboard and version?.
Try to access the services in Safe Mode, Does it work?.
Also make sure your account having Admin privileges or permissions.

Adding to the above, to access the services.smc do the following:
For Repairing Services.msc try this:
Open a Run command and type in:
net service start click [Ok]
net services start click [OK]
regsvr32 filemgmt.dll click [OK]
Reboot you machine are you able to access services.msc?.

Do you have this file here:
c:\windows\system32\services.msc

If the above didn't help try to Restore to an earlier point, but please
backup your data before attempting to do so.
If still no luck then a Repair/Install of XP is a must:
http://www.michaelstevenstech.com/XPrepairinstall.htm
HTH.
nass
====
http://www.nasstec.co.uk

Services.msc does run ok when the machine is not faulting i.e. when i have
not just run a chkdsk. It is not available for me to see and find out when
the machine is faulting.

I have already reistalled XP (retail disc) to a brand new disc and the fault
was still apparent after running chkdsk before installing any further
programs.

The drivers for the chipset are up to date.

The motherboard is an Asus M2R32-MVP. Unfortunately the BIOS update ulitity
cannot be installed (part of the same fault I presume) and therefore I
cannot easily flash the BIOS.

DavidB

 

[nass]

:

Please if you wish to "SNIP" snip all or leave all as we are"" NOT""
here for
links?.
That been said, I hope you performed a scan on your machine and made
sure
all okay.
There is another option but we will come to it if these steps didn't
help
or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown,
version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by
downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and
run it
on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of
network
interfaces on the machine. This can be a potential security hazard to
the
machine since some of the network interfaces may not get the
protection as
desired by the applied IPSec filters. Please run IPSec monitor
snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or
manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter
parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been
created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network
address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The DHCP
Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on the
DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine,
please
delete this log and make sure the machine is get the IP address Auto.
On the machine having trouble obtaining IP address Open a run command
and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a while.


DHCP Across IP Routers
http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass
----
http://www.nasstec.co.uk


:

The machine is not networked other than through a router to the
Internet.
As I've stated previously, rebooting the machine without running a
further
chkdsk while the errors are occuring resolves the problem.

I installed Avast AV and did a boot time scan - no problem reported so
I
scheduled a chkdsk and a boot time scan together - chkdsk ran and the
boot
scan was aborted when it tried to run. On a subsequent reboot the scan
ran
but of course i had not run chkdsk so the problem had disappeared
again.

One thing that also happens each time the fault occurs is a message as
Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I should
have
told you that before.

I cannot access services.msc while the computer is faulting - therefore
I
don't know if the IPsec service is running or not. It is running
automatically when the fault is not apparent

Memory checks out OK.

I am becoming more concerned that the problem may be in the BIOS of the
machine - is this possible?

DavidB

Did you update the Motherboard Drivers since you install XP on this
machine?.
Go to the Motherboard manufacturer website and download the latest
drive4s
for your Mobo and install them.
What make is your Motherboard and version?.
Try to access the services in Safe Mode, Does it work?.
Also make sure your account having Admin privileges or permissions.

Adding to the above, to access the services.smc do the following:
For Repairing Services.msc try this:
Open a Run command and type in:
net service start click [Ok]
net services start click [OK]
regsvr32 filemgmt.dll click [OK]
Reboot you machine are you able to access services.msc?.

Do you have this file here:
c:\windows\system32\services.msc

If the above didn't help try to Restore to an earlier point, but please
backup your data before attempting to do so.
If still no luck then a Repair/Install of XP is a must:
http://www.michaelstevenstech.com/XPrepairinstall.htm
HTH.
nass
====
http://www.nasstec.co.uk

Services.msc does run ok when the machine is not faulting i.e. when i have
not just run a chkdsk. It is not available for me to see and find out when
the machine is faulting.

I have already reistalled XP (retail disc) to a brand new disc and the fault
was still apparent after running chkdsk before installing any further
programs.

The drivers for the chipset are up to date.

The motherboard is an Asus M2R32-MVP. Unfortunately the BIOS update ulitity
cannot be installed (part of the same fault I presume) and therefore I
cannot easily flash the BIOS.

DavidB

Hi David,
If the link provided below didn't help I will doubt the Motherboard having
issue, sine you said this a new install!.
Asus M2R32-MVP
Model: M2R32-MVP: Please select the correct Model/Socket for your Mobo:
http://support.asus.com/download/download.aspx?SLanguage=en-us
I read something about turning the "AsusProbe" can help, you can do it from
the BIOS settings.
HTH.
nass

 

[DavidB]

:






:

Please if you wish to "SNIP" snip all or leave all as we are""
NOT""
here for
links?.
That been said, I hope you performed a scan on your machine and
made
sure
all okay.
There is another option but we will come to it if these steps
didn't
help
or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown,
version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by
downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and
run it
on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of
network
interfaces on the machine. This can be a potential security hazard
to
the
machine since some of the network interfaces may not get the
protection as
desired by the applied IPSec filters. Please run IPSec monitor
snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or
manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter
parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been
created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network
address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The
DHCP
Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on
the
DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine,
please
delete this log and make sure the machine is get the IP address
Auto.
On the machine having trouble obtaining IP address Open a run
command
and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a
while.


DHCP Across IP Routers
http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass
----
http://www.nasstec.co.uk


:

The machine is not networked other than through a router to the
Internet.
As I've stated previously, rebooting the machine without running a
further
chkdsk while the errors are occuring resolves the problem.

I installed Avast AV and did a boot time scan - no problem reported
so
I
scheduled a chkdsk and a boot time scan together - chkdsk ran and
the
boot
scan was aborted when it tried to run. On a subsequent reboot the
scan
ran
but of course i had not run chkdsk so the problem had disappeared
again.

One thing that also happens each time the fault occurs is a message
as
Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I
should
have
told you that before.

I cannot access services.msc while the computer is faulting -
therefore
I
don't know if the IPsec service is running or not. It is running
automatically when the fault is not apparent

Memory checks out OK.

I am becoming more concerned that the problem may be in the BIOS of
the
machine - is this possible?

DavidB

Did you update the Motherboard Drivers since you install XP on this
machine?.
Go to the Motherboard manufacturer website and download the latest
drive4s
for your Mobo and install them.
What make is your Motherboard and version?.
Try to access the services in Safe Mode, Does it work?.
Also make sure your account having Admin privileges or permissions.

Adding to the above, to access the services.smc do the following:
For Repairing Services.msc try this:
Open a Run command and type in:
net service start click [Ok]
net services start click [OK]
regsvr32 filemgmt.dll click [OK]
Reboot you machine are you able to access services.msc?.

Do you have this file here:
c:\windows\system32\services.msc

If the above didn't help try to Restore to an earlier point, but please
backup your data before attempting to do so.
If still no luck then a Repair/Install of XP is a must:
http://www.michaelstevenstech.com/XPrepairinstall.htm
HTH.
nass
====
http://www.nasstec.co.uk

Services.msc does run ok when the machine is not faulting i.e. when i
have
not just run a chkdsk. It is not available for me to see and find out
when
the machine is faulting.

I have already reistalled XP (retail disc) to a brand new disc and the
fault
was still apparent after running chkdsk before installing any further
programs.

The drivers for the chipset are up to date.

The motherboard is an Asus M2R32-MVP. Unfortunately the BIOS update
ulitity
cannot be installed (part of the same fault I presume) and therefore I
cannot easily flash the BIOS.

DavidB

Hi David,
If the link provided below didn't help I will doubt the Motherboard having
issue, sine you said this a new install!.
Asus M2R32-MVP
Model: M2R32-MVP: Please select the correct Model/Socket for your Mobo:
http://support.asus.com/download/download.aspx?SLanguage=en-us
I read something about turning the "AsusProbe" can help, you can do it
from
the BIOS settings.
HTH.
nass

OK Nass

Thanks very much for your time and your help. If ever I find a fix (before
I change the MB which I expect I will have to do anyway) I will post and let
you know.

Asus Probe simply monitors voltages, fan speeds and temperatures.

Thanks again

DavidB

 

[nass]

:






:

Please if you wish to "SNIP" snip all or leave all as we are""
NOT""
here for
links?.
That been said, I hope you performed a scan on your machine and
made
sure
all okay.
There is another option but we will come to it if these steps
didn't
help
or
not completely eliminate the Issue.

My reply is under each error message:

From application :

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 13/12/2007
Time: 16:43:24
User: N/A
Computer: PHANTOM
Description:
Faulting application , version 0.0.0.0, faulting module unknown,
version
0.0.0.0, fault address 0x00000000.

This can indicate a memory is Bad so check your RAM sticks by
downloading
this tool to check it with:
You may have a bad RAM try to test your RAM by running Memtest by
downloading this tool and unzip it and make a floppy or CD/DVD and
run it
on
Reboot.
http://www.memtest86.com/
You may need to reposition/reset the RAM sticks in their slots.


From security:

Event Type: Failure Audit
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 13/12/2007
Time: 16:45:41
User: NT AUTHORITY\NETWORK SERVICE
Computer: PHANTOM
Description:
IPSec Services: IPSec Services failed to get the complete list of
network
interfaces on the machine. This can be a potential security hazard
to
the
machine since some of the network interfaces may not get the
protection as
desired by the applied IPSec filters. Please run IPSec monitor
snap-in to
further diagnose the problem.

Make sure this service "IPSec Service" is started Automatically or
manullay
in Services control panel.
When this error occur?.

<MS::>
Event Message:

IPSec policy agent changed: parameter PolicySource: parameter
parameter
Source Event Log Event ID Event Type
Security Security 615 Success Audit
Explanation:

This event record indicates that a local group account has been
created.
</MS::>
Troubleshooting VPN over IPsec
http://www.microsoft.com/technet/isa/2006/ts_vpn_ipsec.mspx
Step-by-Step Guide to Internet Protocol Security (IPSec)
http://technet.microsoft.com/en-us/library/bb742429.aspx

IPsec Policy Agent Service Runtime
http://technet2.microsoft.com/windo...1c13-4900-b22a-2fd62578f74c1033.mspx?mfr=true



From System:

Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 13/12/2007
Time: 16:46:15
User: N/A
Computer: PHANTOM
Description:
The IP address lease 192.168.1.2 for the Network Card with network
address
0018F378EB3C has been denied by the DHCP server 192.168.1.1 (The
DHCP
Server
sent a DHCPNACK message).

Log into the Router or the server that assign the IP and click on
the
DHCP
there and see the MAC address for the machine having trouble.
You will find a log of bad IP addresses obtained by this machine,
please
delete this log and make sure the machine is get the IP address
Auto.
On the machine having trouble obtaining IP address Open a run
command
and
type in:
ipconfig /flushdns click [OK]
ipconfig /renew click [OK]
netsh winsock reset click [OK]
Reboot the machine and see if the error will be lgged after a
while.


DHCP Across IP Routers
http://www.microsoft.com/technet/pr...rv/reskit/intwork/inae_ips_blgx.mspx?mfr=true

HTH.
nass
----
http://www.nasstec.co.uk


:

The machine is not networked other than through a router to the
Internet.
As I've stated previously, rebooting the machine without running a
further
chkdsk while the errors are occuring resolves the problem.

I installed Avast AV and did a boot time scan - no problem reported
so
I
scheduled a chkdsk and a boot time scan together - chkdsk ran and
the
boot
scan was aborted when it tried to run. On a subsequent reboot the
scan
ran
but of course i had not run chkdsk so the problem had disappeared
again.

One thing that also happens each time the fault occurs is a message
as
Windows opens 'Enumerate Device Win_32 BIOS Fail' - I 'm sorry I
should
have
told you that before.

I cannot access services.msc while the computer is faulting -
therefore
I
don't know if the IPsec service is running or not. It is running
automatically when the fault is not apparent

Memory checks out OK.

I am becoming more concerned that the problem may be in the BIOS of
the
machine - is this possible?

DavidB

Did you update the Motherboard Drivers since you install XP on this
machine?.
Go to the Motherboard manufacturer website and download the latest
drive4s
for your Mobo and install them.
What make is your Motherboard and version?.
Try to access the services in Safe Mode, Does it work?.
Also make sure your account having Admin privileges or permissions.

Adding to the above, to access the services.smc do the following:
For Repairing Services.msc try this:
Open a Run command and type in:
net service start click [Ok]
net services start click [OK]
regsvr32 filemgmt.dll click [OK]
Reboot you machine are you able to access services.msc?.

Do you have this file here:
c:\windows\system32\services.msc

If the above didn't help try to Restore to an earlier point, but please
backup your data before attempting to do so.
If still no luck then a Repair/Install of XP is a must:
http://www.michaelstevenstech.com/XPrepairinstall.htm
HTH.
nass
====
http://www.nasstec.co.uk


Services.msc does run ok when the machine is not faulting i.e. when i
have
not just run a chkdsk. It is not available for me to see and find out
when
the machine is faulting.

I have already reistalled XP (retail disc) to a brand new disc and the
fault
was still apparent after running chkdsk before installing any further
programs.

The drivers for the chipset are up to date.

The motherboard is an Asus M2R32-MVP. Unfortunately the BIOS update
ulitity
cannot be installed (part of the same fault I presume) and therefore I
cannot easily flash the BIOS.

DavidB

Hi David,
If the link provided below didn't help I will doubt the Motherboard having
issue, sine you said this a new install!.
Asus M2R32-MVP
Model: M2R32-MVP: Please select the correct Model/Socket for your Mobo:
http://support.asus.com/download/download.aspx?SLanguage=en-us
I read something about turning the "AsusProbe" can help, you can do it
from
the BIOS settings.
HTH.
nass

OK Nass

Thanks very much for your time and your help. If ever I find a fix (before
I change the MB which I expect I will have to do anyway) I will post and let
you know.

Asus Probe simply monitors voltages, fan speeds and temperatures.

Thanks again

DavidB

I wish I was of a help in this matter but I really wasn't, so hopefully you
will get a gripe on this issue ASAP and know the culprit (mobo or Hdd).
Good luck and Merry Xmas to you.
Regards,
nass