• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1894
  • Last Modified:

XP rebooting into safe mode only - Had an AVG 7.5 update requiring restart before problem

I rebooted in safe mode with networking, then I disabled *all* startup programs to see if it was a driver triggering the problem.  No luck.

I uninstalled AVG 7.5.  When I tried updating the virus definitions, it indicated a problem and suggested I reinstall it, so I just uninstalled it.

I've scanned the computer using SpyBot to see if there was something messing with it.  Nothing.

Any thoughts on what else I can try to get out of it not letting me boot in regular mode and defaulting to the safe mode selection screen?

Thanks,
Peter
0
pmichel1
Asked:
pmichel1
2 Solutions
 
captainCommented:
Hi

boot from your XP CD and go into recovery mode and un sfc /scannow. Afterwards reinstall SP2.

hth
0
 
r-kCommented:
It could be a faulty driver left behind by AVG. (Disabling startups in Msconfig does not disable drivers).

Here is what I suggest:

(0) Boot in safe mode.
(1) Download Autoruns from: http://www.microsoft.com/technet/sysinternals/utilities/Autoruns.mspx
(2) Run the program. It lists a bunch of things that start when Windows starts.
(3) From the menu bar, select Options, and uncheck "Include Empty Locations" and "check" "Hide Microsoft Entries"
    Important -> Then click the Refresh button in the toolbar.
(4) This will give you a shorter, more meaningful list.
(5) Examine that list and disable anything suspicious (esp. if it relates to AVG) by un-checking it. Then reboot and see if it helped.
(6) If not, or if not sure, you can use the File -> Save as.. option in Autoruns to save the list to a text file and then cut and paste it here.

Also see this: http://support.microsoft.com/default.aspx?scid=kb;en-us;308041

0
 
pmichel1Author Commented:
Thanks, R-K.

I tried that and did not find anything suspicious to disable.

Here's the Autoruns list.  Let me know if you see anything unusual that I might want to try disabling, or if you have any additional suggestions before I try a recovery and reinstall (trying to avoid this).

Thanks,
Peter


HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup                  
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup                  
HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon                  
HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit                  
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell                  
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell                  
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Shell                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run                  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run                  
+ ezShieldProtector for Px      ezSP_Px MFC Application      (Not verified) Easy Systems Japan Ltd.      c:\windows\system32\ezsp_px.exe
+ HKSERV.EXE            (Not verified) Sony Corporation      c:\program files\sony\hotkey utility\hkserv.exe
+ iTunesHelper      iTunesHelper Module      (Verified) Apple Computer, Inc.      d:\program files\itunes\ituneshelper.exe
+ QuickTime Task      QuickTime Task      (Not verified) Apple Inc.      c:\program files\quicktime\qttask.exe
+ USBToolTip      Pinnacle USB Tip - for Multi Media eXtensions      (Not verified) Pinnacle Systems GmbH      c:\program files\pinnacle\shared files\programs\usbtip\usbtip.exe
+ VAIO Recovery      PartSeal      (Not verified) Sony Electronics Inc      c:\windows\sonysys\vaio recovery\partseal.exe
+ VAIO Update 2            (Not verified) Sony Corporation      c:\program files\sony\vaio update 2\vaioupdt.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx                  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce                  
C:\Documents and Settings\All Users\Start Menu\Programs\Startup                  
+ Adobe Gamma Loader.lnk      Adobe Gamma Loader      (Not verified) Adobe Systems, Inc.      c:\program files\common files\adobe\calibration\adobe gamma loader.exe
+ TabUserW.exe.lnk      TABUSERW      (Not verified) Wacom Technology, Corp.      c:\windows\system32\wtablet\tabuserw.exe
C:\Documents and Settings\I am that I am\Start Menu\Programs\Startup                  
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load                  
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run                  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run                  
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run                  
HKCU\Software\Microsoft\Windows\CurrentVersion\Run                  
+ H/PC Connection Agent      ActiveSync Connection Manager      (Not verified) Microsoft Corporation      d:\program files\activesync\wcescomm.exe
+ Uniblue RegistryBooster 2                  File not found: C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
+ Yahoo! Pager      Yahoo! Messenger      (Verified) Yahoo! Inc.      c:\program files\yahoo!\messenger\yahoomessenger.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce                  
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce                  
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx                  
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run                  
HKLM\SOFTWARE\Classes\Protocols\Filter                  
+ application/octet-stream      Microsoft .NET Runtime Execution Engine      (Not verified) Microsoft Corporation      c:\windows\system32\mscoree.dll
+ application/x-complus      Microsoft .NET Runtime Execution Engine      (Not verified) Microsoft Corporation      c:\windows\system32\mscoree.dll
+ application/x-msdownload      Microsoft .NET Runtime Execution Engine      (Not verified) Microsoft Corporation      c:\windows\system32\mscoree.dll
HKLM\SOFTWARE\Classes\Protocols\Handler                  
+ cdo      Microsoft SharePoint Portal Server Object Model      (Not verified) Microsoft Corporation      c:\program files\common files\microsoft shared\web folders\pkmcdo.dll
+ ms-itss      Microsoft® InfoTech Storage System Library      (Not verified) Microsoft Corporation      c:\program files\common files\microsoft shared\information retrieval\msitss.dll
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components                  
+ 0                  File not found: About:Home
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components                  
+ n/a      Microsoft .NET IE SECURITY REGISTRATION      (Not verified) Microsoft Corporation      c:\windows\system32\mscories.dll
HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components                  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler                  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad                  
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad                  
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks                  
HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved                  
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved                  
+ blue.shell                  j:\program files\pinnacle\studio 10\programs\blueshellext.dll
+ dBpowerAMP Music Converter      dMCShell Module            d:\program files\dbpoweramp\dbpoweramp\dmcshell.dll
+ dBpowerAMP Music Converter 1      dBShell Module            d:\program files\dbpoweramp\dbpoweramp\dbshell.dll
+ Display Panning CPL Extension                  File not found: deskpan.dll
+ Fusion Cache      Microsoft .NET Runtime Execution Engine      (Not verified) Microsoft Corporation      c:\windows\system32\mscoree.dll
+ iTunes      iTunes Mini Player DLL      (Verified) Apple Computer, Inc.      d:\program files\itunes\itunesminiplayer.dll
+ Mobile Device      Mobile Devices Shell Extension      (Not verified) Microsoft Corporation      d:\program files\activesync\wcesview.dll
+ Shell Extensions for RealOne Player      RealOne Player Shell Extensions      (Not verified) RealNetworks      c:\program files\real\realone player\rpshellext.dll
+ Shell Icon Handler for Application References      Application Deployment Support Library      (Not verified) Microsoft Corporation      c:\windows\system32\dfshim.dll
+ ShellLink for Application References      Application Deployment Support Library      (Not verified) Microsoft Corporation      c:\windows\system32\dfshim.dll
HKCU\Software\Classes\Folder\Shellex\ColumnHandlers                  
HKLM\Software\Classes\Folder\Shellex\ColumnHandlers                  
+ dBpShell Class      dBShell Module            d:\program files\dbpoweramp\dbpoweramp\dbshell.dll
+ PDF Shell Extension      PDF Shell Extension      (Not verified) Adobe Systems, Inc.      c:\program files\adobe\acrobat 7.0\activex\pdfshell.dll
HKCU\Software\Microsoft\Ctf\LangBarAddin                  
HKLM\Software\Microsoft\Ctf\LangBarAddin                  
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects                  
+ AcroIEHlprObj Class      Adobe Acrobat IE Helper Version 7.0 for ActiveX      (Verified) Adobe Systems, Incorporated      c:\program files\adobe\acrobat 7.0\activex\acroiehelper.dll
+ {724d43a9-0d85-11d4-9908-00400523e39a}      RoboForm Main Module      (Verified) Siber Systems      c:\program files\siber systems\ai roboform\roboform.dll
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks                  
HKLM\Software\Microsoft\Internet Explorer\Toolbar                  
+ roboform.dll      RoboForm Main Module      (Verified) Siber Systems      c:\program files\siber systems\ai roboform\roboform.dll
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars                  
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars                  
HKCU\Software\Microsoft\Internet Explorer\Extensions                  
HKLM\Software\Microsoft\Internet Explorer\Extensions                  
+ Fill Forms                  c:\program files\siber systems\ai roboform\roboformcomfillforms.html
+ RoboForm Toolbar                  c:\program files\siber systems\ai roboform\roboformcomshowtoolbar.html
+ Save Forms                  c:\program files\siber systems\ai roboform\roboformcomsavepass.html
Task Scheduler                  
+ AppleSoftwareUpdate.job      Software Application      (Verified) Apple Computer, Inc.      c:\program files\apple software update\softwareupdate.exe
HKLM\System\CurrentControlSet\Services                  
+ AdobeActiveFileMonitor      Tracks files that are managed by Adobe Photoshop Album            i:\program files\adobe\photoshop elements\photoshopelementsfileagent.exe
+ Apple Mobile Device      Provides the interface to Apple mobile devices.      (Not verified) Apple, Inc.      c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe
+ EpsonBidirectionalService                  c:\program files\common files\epson\ebapi\eebsvc.exe
+ EPSONStatusAgent2      EPSON Printer Status Agent      (Not verified) SEIKO EPSON CORPORATION      c:\program files\common files\epson\ebapi\sagent2.exe
+ MDM      Manages local and remote debugging for Visual Studio debuggers      (Not verified) Microsoft Corporation      c:\program files\common files\microsoft shared\vs7debug\mdm.exe
+ PhotoshopElementsDeviceConnect      Photoshop Elements Organizer launch utility on device arrival.            i:\program files\adobe\photoshop elements\photoshopelementsdeviceconnect.exe
+ SoundMAX Agent Service (default)      SoundMAX service agent component      (Not verified) Analog Devices, Inc.      c:\program files\analog devices\soundmax\smagent.exe
+ TabletService      WacomService      (Not verified) Wacom Technology, Corp.      c:\windows\system32\tablet.exe
HKLM\System\CurrentControlSet\Services                  
+ ASAPIW2K      ASAPI      (Not verified) VOB Computersysteme GmbH      c:\windows\system32\drivers\asapiw2k.sys
+ GEARAspiWDM      CD/DVD Class Filter Driver      (Verified) GEAR Software Inc.      c:\windows\system32\drivers\gearaspiwdm.sys
+ PCLEPCI      PCLEPCI      (Not verified) Pinnacle Systems GmbH      c:\windows\system32\drivers\pclepci.sys
+ PenClass      Pen Class Driver      (Not verified) Wacom Technology Corporation      c:\windows\system32\drivers\penclass.sys
+ portD      BounceBack Port I/O      (Not verified) CMS Peripherals, Inc.      c:\windows\system32\drivers\portd2k.sys
+ PTDCBus      CDMA USB Composite Device Driver       (Not verified) DEVGURU Co,LTD.      c:\windows\system32\drivers\ptdcbus.sys
+ PTDCMdm      PANTECH PC Card Drivers (UDP)      (Not verified) DEVGURU Co,LTD.      c:\windows\system32\drivers\ptdcmdm.sys
+ PTDCVsp      PANTECH PC Card Diagnostic Serial Port (UDP)      (Not verified) DEVGURU Co,LTD.      c:\windows\system32\drivers\ptdcvsp.sys
+ PxHelp20      Px Engine Device Driver for Windows 2000/XP      (Not verified) Sonic Solutions      c:\windows\system32\drivers\pxhelp20.sys
+ SMNDIS5                  File not found: C:\PROGRA~1\VERIZO~1\VZACCE~1\SMNDIS5.SYS
HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute                  
HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute                  
HKLM\System\CurrentControlSet\Control\Session Manager\Execute                  
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options                  
HKLM\Software\Microsoft\Command Processor\Autorun                  
HKCU\Software\Microsoft\Command Processor\Autorun                  
HKLM\SOFTWARE\Classes\Exefile\Shell\Open\Command\(Default)                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls                  
HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL                  
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman                  
HKCU\Control Panel\Desktop\Scrnsave.exe                  
HKLM\System\CurrentControlSet\Control\BootVerificationProgram\ImageName                  
HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9                  
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors                  
+ Microsoft Document Imaging Writer Monitor      Microsoft® Document Imaging      (Not verified) Microsoft Corporation      c:\windows\system32\mdimon.dll
+ PDF995 Monitor                  c:\windows\system32\pdf995mon.dll
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders                  
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages                  
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages                  
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages                  
HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order                  
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
phototropicCommented:
I would try booting from an XP CD to recovery console or safe mode with command prompt, and run chkdsk /r from the  Let it run, then try to reboot Windows normally...
0
 
r-kCommented:
Sorry I was gone for a while.

Unluckily I can't see anything that jumps out as the culprit. You could try a few things:

(1) A system restore to a date before these problems started. i.e. Start -> Programs -> Accessories -> System Tools -> System Restore
This may or may not be successful.

(2) You could run Autoruns again and un-check (i.e. disable) all the "Services" listed in the HKLM\System\CurrentControlSet\Services key. Then see if you can boot in normal mode. If you can, then re-enable them a few at a time until you find the problem service. If you still can't boot in normal mode then re-enable them all back - the problem is elsewhere.

(3) Try the suggestions by the other posters. They don't quite involve a reinstall.

(4) Reinstall SP2 for XP (not all of XP, just SP2, you can download it from http://www.microsoft.com/downloads/details.aspx?FamilyId=049C9DBE-3B8E-4F30-8245-9E368D3CDB5A&displaylang=en - caution: 266 MB file)

If you don't have a recent backup of your important files I would make one now before embarking on any repairs.

Keep us posted. Thanks.
0
 
pmichel1Author Commented:
Oh well.  It turned into a reinstall as I tried the chkdsk /r that was suggested by someone and it completely FROZE my system.  Trying to reboot repeatedly, it kept freezing in the same spot.

So, having no other option I could see, I used the recovery CD to reinstall everything on my C: drive.  Fortunately, I had a lot backed up on other drives, but I did lose a lot of information.

I'm NOT happy with AVG (Grisoft) right now.  It would appear it was their recent required software update (not a definition update) that caused the problem.

Thanks for your answers.

Peter
0
 
r-kCommented:
Sorry it came to that. In case you want to try recovering any lost files, try the trial version of GetDataBack for NTFS (http://www.runtime.org/gdb.htm) It can sometimes recover even after a reformat and reinstall. The free trial version can tell you what can be recovered, and can even recover files one at a time.

Thanks and good luck.
0
 
pmichel1Author Commented:
Thanks.  I don't expect to run my C: drive as a secondary drive, though, in order to safely try that software in the way they recommend.  But, I'll keep it in mind for the future should I have another problem that requires such recovery.

Have a great day and thanks again.
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now