XP Pro Cannot boot into Safe Mode. Normal mode starts fine

Hello I have a Windows XP Pro with SP3 system which I believe it recently had a Virus in it (Likely some sort of rootkit) and now it cannot start in Safe mode plus problems with Windows Update in normal mode.  When I try to start in safe mode or safe mode with networking I get the following BSOD:

IRQL_Not_Less_Or_Equal   0x0000000A, 0xF79AE354, 0x000000FF, 0x0000000D, 0x804E5639

Same happens if I try to do a Repair Install.  First time the error occurred was when client was trying to upgrade Avast AV (Free Version).  Have since removed all traces of Avast.  Have also run the following:  chkdsk /p, fixmbr (Initially stated that there was an non-standard Master partition table (May not be the exact wording), Malwarebytes (Found 1 virus and removed), Combofix, Rootkit hunter, Rootkit Revealer Hijack This and several other anti-spyware programs.  these scans seem to be clean now.

System restore does not seem to want to run when the computer is up in normal mode.

Currently running a chkdsk /r which at the beginning of the scan has indicated: "Performing additional checking and recover" which to me means it may have found a problem.

any help much appreciated.  trying to avoid reformatting and re-installing.  The second parameter in the BSOD above is nowhere to be found on the internet.

As a troubleshooting procedure I wanted to remove XP SP3 but the "Remove" option was not available in Add Remove programs. After the Chkdsk /r is finished I plan to remove it using option 4 in the following microsoft kb:  " http://support.microsoft.com/kb/950249 " as Steps 1 through 3 did not work either.

Carl
LVL 1
jctcomAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

jctcomAuthor Commented:
Ok.  Finished the chkdsk /r which claimed that it found and fixed some problems. Still same error trying to start into safe mode.  Am holding off on the sp3 removal due to the indication that I have to start in safe mode to complete the process.

Carl.
0
jctcomAuthor Commented:
Have booted into recovery console again and tried the "fixmbr".  I still get the "This computer appears to have a non-standard or invalid master boot record" message.  Is this an indication of a problem or is this normal?

Carl.
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

jctcomAuthor Commented:
Ran SFC /Scannow. at least three times so far.  Cannot do a Windows Repair because I get the same BSOD.

I will look at the other references you provided to see if they present with anything I haven't tried yet.

Carl.
0
johnb6767Commented:
SuperAntiSpyware
http://www.SuperAntiSpyware.com

Install this, and under the Preferences, there is a tab called Repairs. In that list, is an option to Fix SafeBoot.....

Worked for me several times now.....
0
jctcomAuthor Commented:
Ok farjadarshad  after reading through the links you provided it is obvious that you did not read through my problem. and just provided a bunch of links that seemed mildly relevant to you.  it is not like I don't know how to get into safe mode.  it is that the computer will not load into safe mode without giving me the BSOD error screen.  Perhaps someone else will have more relevant suggestions.

Carl.
0
jctcomAuthor Commented:
johnb6767 I have downloaded and ran SuperantiSpyware but I did not see this option for "repairs"  I will look for that option and give it a try..

Carl.
0
jctcomAuthor Commented:
Hi John.  I could not find the "Fix Safeboot" option that you recommended but I found the "Repair broken safeboot key" Which I imagined was probably the current version of what you were talking about.  i tried that and rebooted the computer and then tried rebooting and going into safe mode but received the same bsod.
Carl.
0
johnb6767Commented:
Can you please export the following key from the registry, and post here please......

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
0
jctcomAuthor Commented:
Hi John.

I have attached an export of the SafeBoot registry key.

Carl.
Safeboot-Key.reg
0
optomaCommented:
Also upload three recent minidump files from c:\windows\minidump
0
jctcomAuthor Commented:
Hi Optoma.  I don't know why but my C:\Windows\minidump\ folder is completely empty.

Carl.
0
optomaCommented:
Are minidumps enabled?
Can you post Combofix's logfile

Also run Hitmanpro + Tdsskiller from desktop
http://www.surfright.nl/en/hitmanpro
http://support.kaspersky.com/viruses/solutions?qid=208280684
minidump.JPG
0
jctcomAuthor Commented:
Hi Optoma.  The Mini Dump was not enabled.  I enabled it and then tried to get into safe mode again but it still did not produce a minidump file.  I have performed a new combofix scan and attached the log file here.  (Do you prefer that I attach the log file or pasted it in?

I will download and run the Hitmanpro and Tdsskiller and post the results shortly.

Carl.
ComboFix.txt
0
jctcomAuthor Commented:
Ran both Hitman Pro and Tdskiller and both came back clean.

Carl.
0
jctcomAuthor Commented:
In The meantime I have run Seatools on the Seagate hard drive for the system.  Both the basic and extended tests passed without errors.  If I don't hear back from someone by later today I am going to try to do a fresh install on a spare hard drive just to rule out any other hardware problems.  I will be heading out in the next half hour and will be gone till about 5pm local time and check back then to see if there are any other comments or suggestions.

Carl.
0
optomaCommented:
Log shows three firewalls> Keiro + Sunbelt + Zone Alarm>>one is plenty!

Can you uninstall them all + test
0
jctcomAuthor Commented:
The Keiro and sunbelt have actually been uninstalled and the Zone alarm is disabled for the moment pending my recommendation to the client to uninstall it as well.  I think the Windows Firewall is generally good enough.

Not sure though why they are still showing up in the log.  Uninstall must have left some remnants in the registry.

I will see if I can clean them out manually.

Carl.
0
optomaCommented:
This article will help with removing their leftovers
http://www.experts-exchange.com/articles/Virus_and_Spyware/Anti-Virus/Can%27t-Install-an-Antivirus-Windows-Security-Center-still-detects-previous-AV.html

Those are the ids

Kerio Personal Firewall {532EFE70-19BC-4F0F-8F50-D5F15C243133}
FW: Kerio Personal Firewall  {8DD86BF7-28B3-4CE9-88AE-E6EC790CAECA}
FW: Sunbelt Personal Firewall {BFD080F6-3BF0-40E1-9507-9CA969C35870}

Try getting go ahead to uninstall Zone Alarm> presume its free version. Can be reinstalled after if so. Sometimes disabling it dosn't help.

May or may not resolve issue...

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jctcomAuthor Commented:
Ok have removed all references to the kerio and sunbelt firewalls  (Will confirm with another combofix which is currently running).  I have uninstalled ZoneAlarm.  restarted the computer.  then restarted again to try to get into safe mode.  Same BSOD error.

Not sure where to go from here?  
Like I said earlier I will likely try to do a clean install on a spare hard drive just to see if I get the same issue or not.

 In terms of hardware testing I have tried disconnecting both optical drives and the 2nd hard drive.  There are 4 RAM modules I have removed two at a time and tested with the last 2 in the other slots and still get the same BSOD trying to get into safe mode.  I have gone into the bios and disabled all extraneous ports (Serial, Parallel, gaming port etc...)  Stil BSOD trying to get into safe mode.


Carl.
0
jctcomAuthor Commented:
Have attached current combofix log.  Interestingly the last Combofix run did not require a reboot whereas all the previous ones did.

Also this entry in "Other Deletions did not appear in the last combofix log:

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\TEMP\logishrd\LVPrcInj01.dll

I am running combofix again after a failed BSOD attempt to get into safe mode to see if the above file returned.

Carl.

.


ComboFix2.txt
0
jctcomAuthor Commented:
Interesting.  Combofix required a reboot again and that file returned.

But a search on Google seems to indicate that the file is associated with logitech QuickCam which is not currently plugged in but I suppose it could be something that gets written every time the computer starts?

any more ideas on what else to try here?

Carl.
0
optomaCommented:
Run autoruns.
In Autoruns:
Hit options and check "verify code signatures" and rescan (F5 key)
Don't make any other changes...

Within Autoruns,select the file tab and select save(Ctrl+S) and save as AutoRuns Data (*.arn) -Output file is a few megs in size
Once saved then right click autoruns.arn and rename to autoruns.txt to upload

Autoruns http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
0
jctcomAuthor Commented:
I have attached the Autoruns.txt file.

It is a little after 1:30am here and I am off to bed.

Carl.
AutoRuns.txt
0
optomaCommented:
Thanks for that. Nothing standing out :(

You mentioned Logitech Cam Software> Anything in event viewer regarding it?
Can it be uninstalled to test and reinstalled afterwards?

You also mention a problem with System Restore>can you try creating a restore point?
0
jctcomAuthor Commented:
Combofix and other programs claim they have created restore points and if I start the computer up with my Microsoft Diagnostics and Recovery disc I can run the system restore and see the calendar with various restore points.  

If I run system restore from within Windows XP I see a blank calendar  (And I mean totally blank there are not even any numbers on the calendar).

I did mention in my first post that I had tried a repair install and got the same BSOD during it.  After this the computer would not start at all.  Came up with the same BSOD error even trying to go into normal mode.

I then ran the MDART disc and restored it back to a point a few days earlier when the client had tried to install an Avast update or upgrade.

I will remove the Logitech Cam software but I am beginning to think that this is going to require a reformat.  Like I said a few time earlier I will do a test with a spare hard drive first just to be sure.

Carl.
0
jctcomAuthor Commented:
Any more comments or suggestions on this problem?

Carl.
0
optomaCommented:
Unfortunately, at the moment, I can't think of anything else :(
Sorry ....
0
jctcomAuthor Commented:
all right.  I will let you know what happens after I do a test reformat with a spare hard drive.

Carl.
0
jctcomAuthor Commented:
So a clean reformat and install ran fine.

0
jctcomAuthor Commented:
Thank you for your help.  I have awarded the points even though we did not really find a solution (Since I was trying to avoid the reformat) but I appreciate your efforts.

Carl.
0
optomaCommented:
No prob :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.