Here is a synopses. Been working on this for over a week.
1) Windows XP SP3 system just randomly hard stoped. No dumps or blue screen. Deteriorated to the point that I couldn't even complete a regular boot but was able to get a stable boot in safe mode. Analyzed NTBTLOG and determined it was stopping soon after USBOHCI.SYS and USBEHCI.SYS loaded. I removed them and a few other USB* drivers. I added them back in one at a time until just these two drivers crashed the system every time.
2) I rolled back SP3 to SP2 and it seemed to return back to normal, but soon it was back to the bad state.
3) I tried reinstalling new copies of these two drivers, but that didn't help. It could be other related drivers are effected.
4) I am now able to boot in safe mode and in regular mode without these 2 drivers...and I can start all boot time services and applications.... except \Avast4\ashDisp.exe (crashes the system)
5) Here is what I have done to diagnose and clean the issues...following there directions...
1. Disable System Restore ---- done
2. Clean your temporary files ---- done with CleanUp452 and Advanced System Care 3
3. Schedule a boot time scanning with avast with archive scanning turned on. ---- Crashes after 5% (somewhere in program files) in normal mode. No AVSBOOT.TXT file found. Can't get a boot time scan in safe mode.
4. Use SUPERantispyware and/or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
SUPERantispyware runs to completion in safe mode. Crashes immediately in normal mode.
Avast finds nothing in safe or normal mode.
Advanced System Care 3 finds a few minor things and cleans up fine in safe and normal mode.
5. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
Avast antirootkit reports thousands (about 50% of all files) as infected in normal mode and safe mode.
GMER scans everything fine in safe mode. In normal mode I scanned each area individually ok, but as soon as I scan the registry it causes the system to stop.
6. Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
HiJackThis scans for a few seconds in normal mode, then the system stops.
In safe mode in completes and nothing looks out of the ordinary.
This is as far as I have gone...
7. Immunize your system with SpywareBlaster or Windows Advanced Care.
8. Check if you have insecure applications with Secunia Software Inspector.
Any help is appreciated.
