January 3,2006: My aunt calls me for advice on her latest computer problem. I know her system because I've done some maintenance on her computer before, like upgrading the video card to add DVI support. It seems when she tries to start XP, there's an lsass.exe error popping up. I fear she has the Sasser worm, but a look around the web suggests it may be SAM corruption. I generate a new BartPE disk and a NTFS Password Recovery CD and add them to my laptop toolkit. Her house is on my way home from the consulting job I'm doing, so I crash there at the end of the night.
January 4, 2006: It doesn't look like Sasser, it seems just the SAM database needed to login is corrupted. I create a fresh SAM database using the NTFS recovery tool, but it won't write to her NTFS partition. I copy the SAM to a floppy, reboot with BartPE, and copy it over that way instead. Now I'm able to login to the machine again. Before I do anything else, I make a backup of all the user home directories onto my external USB hard drive (too big to fit on the USB key). I can get back into Windows, but there's more damage there and the system promptly eats itself again.
Since I got all their files off, I decide to reinstall Windows XP Home from Dell's installation CD, but the CD-R drive in the computer has gone bad. Happily Walmart (as close to a computer store as you'll get in their part of Pennsylvania) is carrying good Lite-On drives and I get a replacement for that. I also add a USB 2.0 PCI card to speed up my Uncle's USB key and my cousin's iPod Nano. I suggest that as soon as this software problem is fixed, this should be a perfectly functional PC for quite some time (P4 1.7GHz, 768MB RAM, decent stuff) and therefore putting some more money into it is a good idea. This recommendation will become downright comical in the near future. As there's only dial-up here, I find a friendly neighbor with a cable modem and download the complete "Network Install" version of XP Service Pack 2 and burn that onto CD. I grab the latest video card drivers as well. Reinstall Windows, add SP2, add video drivers, reinstall printer drivers, reload all their applications, copy their data files back, and bam! It's like a new computer again.
My aunt tells me this is the second time this happened; the first time was shortly after she first installed XP SP2. When the system ate itself then, she figured she didn't do the service pack installation right and someone talked her through reinstalling Windows. Curious; this machine has worked flawlessly for years running the original XP Home release, can't imagine why SP2 would cause problems given the limited number of applications they use. Oh well, hopefully now that I've installed everything correctly it will be OK.
February 6, 2006: My aunt's computer is toast again. This time it's giving "Windows - Registry Recovery. One of the files containing the system's Registry data had to be recovered by the use of a log or alternate copy. the recovery was successful." along with not working right. Not much about that error floating around; I find a forum post where some people have this problem, but the suggested repairs don't sound very promising. I make a trip back to her house again, try out Registry Mechanic, and play with sfc as suggested. Nothing helps. They've gotten used to the computer not working right, so I take it home with me for an extended therapy session.
February 7, 2006: XP is reinstalled with SP2, but I didn't install anything else yet. I want to put some stress on the system so I run a disk defrag and wander out. When I get back, the defrag is done and the screen saver has engaged. I move the mouse and there's the old registry recovery error again. This time the system still works so I can get the full details from the event log:
Event Type: Information Event Source: Application Popup Event Category: None Event ID: 26 Date: 2/7/2006 Time: 10:22:00 PM User: N/A Computer: DELLPC Description: Application popup: Windows - Registry Recovery : One of the files containing the system's Registry data had to be recovered by use of a log or alternate copy. The recovery was successful. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.That link to Microsoft's support center is of course completely useless. I play around with the BIOS (I think I turned on Plug and Play, maybe some other changes) and reinstall the OS. This time it looks like it's stable. I become suspicious of the memory and have the machine spend a week running memtest86, which it does without any errors.
March 5, 2006: I use this as an excuse to buy Acronis True Image, and I make some snapshots of the system with a base XP install. I reinstall all their apps and their data and make another snapshot. The Acronis software lets you save a snapshot onto a hidden partition of the hard drive, I do that as well. Now if the system eats itself, they can return to a known good version just by hitting F11 on boot and restoring from that hidden backup. Pretty cool. Since I have little faith this system is cured, hopefully this will at least keep them running while we investigate other options.
March 9,2006: The system is dead again. The registry recovery errors started, and soon afterwards they couldn't login anymore. I talk my aunt through restoring with the Acronis software, and that works. Joy.
March 10,2006: No joy. System dead again this fast. They're now shopping for new PCs, I give some suggestions.
March 12,2006: One of the ideas I popped into their head clicks and they buy one of the new Intel-based Mac Minis. I predict that eventually they'll be able to run Windows XP on this machine as well, making it a full replacement for the old computer. The next time someone drives from her place to mine, I take away the wounded old Dell to put it my dungeon for naughty computers.
April 5,2006: Boot Camp is announced for the Mac Mini, and I get to keep my soothsayer license (it was suspended after those comments about investing in the old PC). Unruly Dell in the corner remains untouched.
June, 2006: Because they're super lucky, the video output section of their Mac starting going crazy intermittently. When they take it the store, the problem actually manifests itself! Motherboard swap, back to health again. My aunt loves the Mac, and I love that I never hear from them about computer problems anymore. Since it's summertime and I know my cousin (the main person who wants a Windows PC around for school) is loafing, I continue to ignore the Dell.
August 23, 2006: Shoot, summer's almost over already. Let's try out that new KVM switch and get the old Dell going. I try out the following series of operations:
August 24, 2006: Since I know this system worked perfectly for years with plain old XP Home, I experiment to see if I can switch off some newer features to make the disk work more reliably. I do the whole reinstall shuffle with DMA turned off, with write-caching disabled, even with the newest Intel drivers for this motherboard installed. Nothing helps.
Another search turns up this very interesting microsoft.public.windowsupdate Usenet discussion. Here's a guy with a Dell Dimension 4400 with nearly identical specs to mine, going through the same issues with XP SP2: the product activation, the registry recovery, everything. After a bunch of people giving the usual "are you sure you don't have a virus" and "are you sure the memory is good?", someone suggests trying another hard drive. He says that seems to be fine, and swapping back to the original drive causes problems again. It's not in this thread, but eventually my new mentor Bob posts again, saying that every since switching to another hard drive his problems went away.
Hmm. Bob's system had a Maxtor 6L040L2. My aunt's system has a 6L040J2; very similar. Since this solution fits with the "Always blame the crappy Maxtor drive" axiom of PC troubleshooting, I run with it and put a shiny new 120GB Seagate drive in the PC. (anything >137GB wouldn't inevitably be incompatible with either the motherboard or the Windows install CD). Reinstall XP Home, add service pack, defrag; no problems. Reinstall all kinds of stuff, defrag; no problems. Looks like this is ready to return to my aunt.
Conclusion: The 40GB Maxtor drives included with some Dell Dimension 4400 models intermittently corrupts itself when running under XP Home with Service Pack 2, even though that drive works flawlessly under early XP Home releases. Upgrade the drive to a newer model that's under 137GB in size, either copying the old installation over or reinstalling XP from scratch, and you should be able to upgrade with SP2.
December 5, 2006: Been getting an e-mail every week or two since the middle of November from owners of 4400s who were thinking they'd never upgrade to SP2 successfully (and even one non-Dell owner who does have a similarly problematic Maxtor drive to the one mentioned). A Google search on "dell dimension 4400 windows service pack 2" now gives this page as the #1 hit. My aunt is proud of me helping out the world. While it would be great if I did this because I was a nice person, it was really just because I hate the low quality parts Dell uses and want everyone to know that.
December 12, 2006: Two more reports this week of resolved SP2 issues on 4400s by replacing the hard drive. One is particularly interesting as it suggests the same problem was happening with a 80 gigabyte Hitachi hard drive. The issue with the IDE problem on this model may not be limited to just the Maxtor drive that most of them appear to have as standard equipment.