XP rebooting into safe mode only - Had an AVG 7.5 update requiring restart before problem

Posted on 2007-08-04
Last Modified: 2013-11-22
I rebooted in safe mode with networking, then I disabled *all* startup programs to see if it was a driver triggering the problem.  No luck.

I uninstalled AVG 7.5.  When I tried updating the virus definitions, it indicated a problem and suggested I reinstall it, so I just uninstalled it.

I've scanned the computer using SpyBot to see if there was something messing with it.  Nothing.

Any thoughts on what else I can try to get out of it not letting me boot in regular mode and defaulting to the safe mode selection screen?

Question by:pmichel1
    LVL 32

    Expert Comment


    boot from your XP CD and go into recovery mode and un sfc /scannow. Afterwards reinstall SP2.

    LVL 32

    Accepted Solution

    It could be a faulty driver left behind by AVG. (Disabling startups in Msconfig does not disable drivers).

    Here is what I suggest:

    (0) Boot in safe mode.
    (1) Download Autoruns from:
    (2) Run the program. It lists a bunch of things that start when Windows starts.
    (3) From the menu bar, select Options, and uncheck "Include Empty Locations" and "check" "Hide Microsoft Entries"
        Important -> Then click the Refresh button in the toolbar.
    (4) This will give you a shorter, more meaningful list.
    (5) Examine that list and disable anything suspicious (esp. if it relates to AVG) by un-checking it. Then reboot and see if it helped.
    (6) If not, or if not sure, you can use the File -> Save as.. option in Autoruns to save the list to a text file and then cut and paste it here.

    Also see this:;en-us;308041


    Author Comment

    Thanks, R-K.

    I tried that and did not find anything suspicious to disable.

    Here's the Autoruns list.  Let me know if you see anything unusual that I might want to try disabling, or if you have any additional suggestions before I try a recovery and reinstall (trying to avoid this).


    HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AppSetup                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit                  
    HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run                  
    + ezShieldProtector for Px      ezSP_Px MFC Application      (Not verified) Easy Systems Japan Ltd.      c:\windows\system32\ezsp_px.exe
    + HKSERV.EXE            (Not verified) Sony Corporation      c:\program files\sony\hotkey utility\hkserv.exe
    + iTunesHelper      iTunesHelper Module      (Verified) Apple Computer, Inc.      d:\program files\itunes\ituneshelper.exe
    + QuickTime Task      QuickTime Task      (Not verified) Apple Inc.      c:\program files\quicktime\qttask.exe
    + USBToolTip      Pinnacle USB Tip - for Multi Media eXtensions      (Not verified) Pinnacle Systems GmbH      c:\program files\pinnacle\shared files\programs\usbtip\usbtip.exe
    + VAIO Recovery      PartSeal      (Not verified) Sony Electronics Inc      c:\windows\sonysys\vaio recovery\partseal.exe
    + VAIO Update 2            (Not verified) Sony Corporation      c:\program files\sony\vaio update 2\vaioupdt.exe
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup                  
    + Adobe Gamma Loader.lnk      Adobe Gamma Loader      (Not verified) Adobe Systems, Inc.      c:\program files\common files\adobe\calibration\adobe gamma loader.exe
    + TabUserW.exe.lnk      TABUSERW      (Not verified) Wacom Technology, Corp.      c:\windows\system32\wtablet\tabuserw.exe
    C:\Documents and Settings\I am that I am\Start Menu\Programs\Startup                  
    HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load                  
    HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run                  
    + H/PC Connection Agent      ActiveSync Connection Manager      (Not verified) Microsoft Corporation      d:\program files\activesync\wcescomm.exe
    + Uniblue RegistryBooster 2                  File not found: C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
    + Yahoo! Pager      Yahoo! Messenger      (Verified) Yahoo! Inc.      c:\program files\yahoo!\messenger\yahoomessenger.exe
    HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce                  
    HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx                  
    HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run                  
    + application/octet-stream      Microsoft .NET Runtime Execution Engine      (Not verified) Microsoft Corporation      c:\windows\system32\mscoree.dll
    + application/x-complus      Microsoft .NET Runtime Execution Engine      (Not verified) Microsoft Corporation      c:\windows\system32\mscoree.dll
    + application/x-msdownload      Microsoft .NET Runtime Execution Engine      (Not verified) Microsoft Corporation      c:\windows\system32\mscoree.dll
    + cdo      Microsoft SharePoint Portal Server Object Model      (Not verified) Microsoft Corporation      c:\program files\common files\microsoft shared\web folders\pkmcdo.dll
    + ms-itss      Microsoft® InfoTech Storage System Library      (Not verified) Microsoft Corporation      c:\program files\common files\microsoft shared\information retrieval\msitss.dll
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components                  
    + 0                  File not found: About:Home
    HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components                  
    + n/a      Microsoft .NET IE SECURITY REGISTRATION      (Not verified) Microsoft Corporation      c:\windows\system32\mscories.dll
    HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components                  
    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved                  
    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved                  
    +                  j:\program files\pinnacle\studio 10\programs\blueshellext.dll
    + dBpowerAMP Music Converter      dMCShell Module            d:\program files\dbpoweramp\dbpoweramp\dmcshell.dll
    + dBpowerAMP Music Converter 1      dBShell Module            d:\program files\dbpoweramp\dbpoweramp\dbshell.dll
    + Display Panning CPL Extension                  File not found: deskpan.dll
    + Fusion Cache      Microsoft .NET Runtime Execution Engine      (Not verified) Microsoft Corporation      c:\windows\system32\mscoree.dll
    + iTunes      iTunes Mini Player DLL      (Verified) Apple Computer, Inc.      d:\program files\itunes\itunesminiplayer.dll
    + Mobile Device      Mobile Devices Shell Extension      (Not verified) Microsoft Corporation      d:\program files\activesync\wcesview.dll
    + Shell Extensions for RealOne Player      RealOne Player Shell Extensions      (Not verified) RealNetworks      c:\program files\real\realone player\rpshellext.dll
    + Shell Icon Handler for Application References      Application Deployment Support Library      (Not verified) Microsoft Corporation      c:\windows\system32\dfshim.dll
    + ShellLink for Application References      Application Deployment Support Library      (Not verified) Microsoft Corporation      c:\windows\system32\dfshim.dll
    + dBpShell Class      dBShell Module            d:\program files\dbpoweramp\dbpoweramp\dbshell.dll
    + PDF Shell Extension      PDF Shell Extension      (Not verified) Adobe Systems, Inc.      c:\program files\adobe\acrobat 7.0\activex\pdfshell.dll
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects                  
    + AcroIEHlprObj Class      Adobe Acrobat IE Helper Version 7.0 for ActiveX      (Verified) Adobe Systems, Incorporated      c:\program files\adobe\acrobat 7.0\activex\acroiehelper.dll
    + {724d43a9-0d85-11d4-9908-00400523e39a}      RoboForm Main Module      (Verified) Siber Systems      c:\program files\siber systems\ai roboform\roboform.dll
    HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks                  
    HKLM\Software\Microsoft\Internet Explorer\Toolbar                  
    + roboform.dll      RoboForm Main Module      (Verified) Siber Systems      c:\program files\siber systems\ai roboform\roboform.dll
    HKCU\Software\Microsoft\Internet Explorer\Explorer Bars                  
    HKLM\Software\Microsoft\Internet Explorer\Explorer Bars                  
    HKCU\Software\Microsoft\Internet Explorer\Extensions                  
    HKLM\Software\Microsoft\Internet Explorer\Extensions                  
    + Fill Forms                  c:\program files\siber systems\ai roboform\roboformcomfillforms.html
    + RoboForm Toolbar                  c:\program files\siber systems\ai roboform\roboformcomshowtoolbar.html
    + Save Forms                  c:\program files\siber systems\ai roboform\roboformcomsavepass.html
    Task Scheduler                  
    + AppleSoftwareUpdate.job      Software Application      (Verified) Apple Computer, Inc.      c:\program files\apple software update\softwareupdate.exe
    + AdobeActiveFileMonitor      Tracks files that are managed by Adobe Photoshop Album            i:\program files\adobe\photoshop elements\photoshopelementsfileagent.exe
    + Apple Mobile Device      Provides the interface to Apple mobile devices.      (Not verified) Apple, Inc.      c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe
    + EpsonBidirectionalService                  c:\program files\common files\epson\ebapi\eebsvc.exe
    + EPSONStatusAgent2      EPSON Printer Status Agent      (Not verified) SEIKO EPSON CORPORATION      c:\program files\common files\epson\ebapi\sagent2.exe
    + MDM      Manages local and remote debugging for Visual Studio debuggers      (Not verified) Microsoft Corporation      c:\program files\common files\microsoft shared\vs7debug\mdm.exe
    + PhotoshopElementsDeviceConnect      Photoshop Elements Organizer launch utility on device arrival.            i:\program files\adobe\photoshop elements\photoshopelementsdeviceconnect.exe
    + SoundMAX Agent Service (default)      SoundMAX service agent component      (Not verified) Analog Devices, Inc.      c:\program files\analog devices\soundmax\smagent.exe
    + TabletService      WacomService      (Not verified) Wacom Technology, Corp.      c:\windows\system32\tablet.exe
    + ASAPIW2K      ASAPI      (Not verified) VOB Computersysteme GmbH      c:\windows\system32\drivers\asapiw2k.sys
    + GEARAspiWDM      CD/DVD Class Filter Driver      (Verified) GEAR Software Inc.      c:\windows\system32\drivers\gearaspiwdm.sys
    + PCLEPCI      PCLEPCI      (Not verified) Pinnacle Systems GmbH      c:\windows\system32\drivers\pclepci.sys
    + PenClass      Pen Class Driver      (Not verified) Wacom Technology Corporation      c:\windows\system32\drivers\penclass.sys
    + portD      BounceBack Port I/O      (Not verified) CMS Peripherals, Inc.      c:\windows\system32\drivers\portd2k.sys
    + PTDCBus      CDMA USB Composite Device Driver       (Not verified) DEVGURU Co,LTD.      c:\windows\system32\drivers\ptdcbus.sys
    + PTDCMdm      PANTECH PC Card Drivers (UDP)      (Not verified) DEVGURU Co,LTD.      c:\windows\system32\drivers\ptdcmdm.sys
    + PTDCVsp      PANTECH PC Card Diagnostic Serial Port (UDP)      (Not verified) DEVGURU Co,LTD.      c:\windows\system32\drivers\ptdcvsp.sys
    + PxHelp20      Px Engine Device Driver for Windows 2000/XP      (Not verified) Sonic Solutions      c:\windows\system32\drivers\pxhelp20.sys
    + SMNDIS5                  File not found: C:\PROGRA~1\VERIZO~1\VZACCE~1\SMNDIS5.SYS
    HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute                  
    HKLM\System\CurrentControlSet\Control\Session Manager\SetupExecute                  
    HKLM\System\CurrentControlSet\Control\Session Manager\Execute                  
    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options                  
    HKLM\Software\Microsoft\Command Processor\Autorun                  
    HKCU\Software\Microsoft\Command Processor\Autorun                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls                  
    HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GinaDLL                  
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman                  
    HKCU\Control Panel\Desktop\Scrnsave.exe                  
    + Microsoft Document Imaging Writer Monitor      Microsoft® Document Imaging      (Not verified) Microsoft Corporation      c:\windows\system32\mdimon.dll
    + PDF995 Monitor                  c:\windows\system32\pdf995mon.dll
    HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages                  
    HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages                  
    HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages                  
    LVL 23

    Expert Comment

    I would try booting from an XP CD to recovery console or safe mode with command prompt, and run chkdsk /r from the  Let it run, then try to reboot Windows normally...
    LVL 32

    Assisted Solution

    Sorry I was gone for a while.

    Unluckily I can't see anything that jumps out as the culprit. You could try a few things:

    (1) A system restore to a date before these problems started. i.e. Start -> Programs -> Accessories -> System Tools -> System Restore
    This may or may not be successful.

    (2) You could run Autoruns again and un-check (i.e. disable) all the "Services" listed in the HKLM\System\CurrentControlSet\Services key. Then see if you can boot in normal mode. If you can, then re-enable them a few at a time until you find the problem service. If you still can't boot in normal mode then re-enable them all back - the problem is elsewhere.

    (3) Try the suggestions by the other posters. They don't quite involve a reinstall.

    (4) Reinstall SP2 for XP (not all of XP, just SP2, you can download it from - caution: 266 MB file)

    If you don't have a recent backup of your important files I would make one now before embarking on any repairs.

    Keep us posted. Thanks.

    Author Comment

    Oh well.  It turned into a reinstall as I tried the chkdsk /r that was suggested by someone and it completely FROZE my system.  Trying to reboot repeatedly, it kept freezing in the same spot.

    So, having no other option I could see, I used the recovery CD to reinstall everything on my C: drive.  Fortunately, I had a lot backed up on other drives, but I did lose a lot of information.

    I'm NOT happy with AVG (Grisoft) right now.  It would appear it was their recent required software update (not a definition update) that caused the problem.

    Thanks for your answers.

    LVL 32

    Expert Comment

    Sorry it came to that. In case you want to try recovering any lost files, try the trial version of GetDataBack for NTFS ( It can sometimes recover even after a reformat and reinstall. The free trial version can tell you what can be recovered, and can even recover files one at a time.

    Thanks and good luck.

    Author Comment

    Thanks.  I don't expect to run my C: drive as a secondary drive, though, in order to safely try that software in the way they recommend.  But, I'll keep it in mind for the future should I have another problem that requires such recovery.

    Have a great day and thanks again.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Ok I have been working on this for some time having learned and gained certification in XenDesktop 4 along came version 5 which was released last month. Since then I have been working to deploy XenDesktop 5 in a small environment with only 2 virt…
    By the time you finish reading this article, you may have already lost all your money because you don't know the simple steps to securing your BitCoin wallet. BitCoin is an incredible invention. It is a decentralized currency system, which is the…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now