Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows XP won't boot into Safe Mode with F8


  • Please log in to reply
15 replies to this topic

#1 FrogmanMickey

FrogmanMickey

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:08:35 PM

Posted 06 December 2009 - 02:46 PM

Hi

I have Windows XP Home Version 2002 with SP 3 running on a Toshiba Satellite M35X-S349 laptop. At some point, the computer ceased being able to boot into Safe Mode using the F8 key during the boot sequence. I can get into Safe Mode using SAFEBOOT, but I was warned by the HJT team when dealing with a malware issue not to use that method if malware is suspected (they didn't say why, but they're the experts). F8 does bring up the selection screen and when Safe Mode is selected, it starts to load the files and drivers it needs, but after the screen has scrolled through a couple dozen files, the sequence stalls with agp440 as the last entry showing on the list. I have to kill the computer with the "off" switch to get out of it. There is no BSOD, it just stalls and does not continue to load the drivers. I researched this on the net and found that quite a few others seem to have had this problem and that it may have something to do with one of the updates Microsoft sent out. But I did not understand how to fix it. It was complicated and involved registry editing, which scares me. I was hoping someone on the forum has written a script that can be run to fix this, or at least can provide step by step instructions that I can follow so I can fix it without messing up my computer.

Thanks

FMM
Frogman Mickey

BC AdBot (Login to Remove)

 


#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 22,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:35 PM

Posted 09 December 2009 - 06:19 PM

Try this:

http://download.bleepingcomputer.com/sUBs/...otKeyRepair.exe
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 FrogmanMickey

FrogmanMickey
  • Topic Starter

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:08:35 PM

Posted 23 December 2009 - 12:12 AM

Didn't help :-(
Frogman Mickey

#4 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 22,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:35 PM

Posted 23 December 2009 - 05:40 AM

You could try the System File Checker:

How to Use SFC.EXE to Repair System Files
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#5 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:35 PM

Posted 23 December 2009 - 06:47 AM

At some point, the computer ceased being able to boot into Safe Mode using the F8 key during the boot sequence .......... F8 does bring up the selection screen and when Safe Mode is selected, it starts to load the files and drivers it needs, but after the screen has scrolled through a couple dozen files, the sequence stalls with agp440 as the last entry showing on the list

I can get into Safe Mode using SAFEBOOT

Are you sure that you can get into Safe Mode ... with one method and not the other ???
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#6 FrogmanMickey

FrogmanMickey
  • Topic Starter

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:08:35 PM

Posted 23 December 2009 - 04:37 PM

Hi

Now that you asked the question, I went back to try both methods again. Safe Boot using F8 still hangs, but now I can’t use SAFEBOOT either. After running the above script, MSCONFIG has been altered to use Selective Startup using Modified BOOT.INI. BOOT.INI now has the following command in it:

C:\CMDCONS\BOOTSECT.DAT=”Microsoft Windows Recovery Console”/cmdcons

Selecting the button for Check All Boot Paths returns the message:

It appears that the following line in the BOOT.INI file does not refer to a valid operating system.
C:\CMDCONS\BOOTSECT.DAT=”Microsoft Windows Recovery Console”/cmdcons
Would you like to remove it from the BOOT.INI file?

Boot Options including /SAFEBOOT are no longer available (greyed out).

So now I can’t boot into safe mode by any method.

If the boot into Safe Mode using F8 was not repaired by the script, perhaps it would be best to undo whatever the script did. At least there was a way to get into Safe Mode before.
Frogman Mickey

#7 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 22,950 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:35 PM

Posted 23 December 2009 - 04:54 PM

Did you recently install the recovery console on your computer?
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#8 FrogmanMickey

FrogmanMickey
  • Topic Starter

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:08:35 PM

Posted 23 December 2009 - 06:34 PM

No, not recently. It has been installed for some time now. I don't remember exactly when it got installed. Perhaps the line in question has been there for a while. I did not study the BOOT.INI file until just now, when I saw that the Boot Options had been disabled. BTW, it shows up under [operating systems] in BOOT.INI, which seems like a strange place, but maybe that is where it belongs. It doesn't seem to cause any ill effects during normal boot, and I only mentioned it because of the error message. If Windows put it there when Recovery Console was installed, why would it generate an error message when doing a Path Check? I know that the situation with the BOOT.INI Boot Options being disabled is recent because I used SAFEBOOT only a few weeks ago. Now I can't. The script you provided was called SafeBoot Repair. I didn't have a problem with SafeBoot before, only with the F8. Now it seems to have disabled SafeBoot.

Here is the report it generated:

Reg export of SafeBoot key after repair:
========================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]
"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\aawservice]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpcdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdpwd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\rdsessmgr]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SharedAccess]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdpipe.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\tdtcp.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\termservice]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WZCSVC]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
@="Net"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
@="NetClient"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
@="NetService"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
@="NetTrans"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

========================

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\Lavasoft Ad-Aware Service
Frogman Mickey

#9 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:35 PM

Posted 23 December 2009 - 07:15 PM

if CHKDSK has generated a log and stored it somewhere, and if the info in it might be of any value, please tell me how to find it and I can post that too.

http://www.bleepingcomputer.com/forums/ind...t&p=1502652

Start > Run and type "eventvwr" and press
Click on "Application" in the left window pane.
In the right window pane, click on "Source" in the column heading, to sort the list.
Scroll through the alphabetically sorted list to find "Winlogon" entries: These are the chkdsk logs.
Find the entry matching the date and time that you wish to view, and double-click on it.
(approximately Nov 17 2009, 08:29 PM http://www.bleepingcomputer.com/forums/ind...t&p=1502652 )
An "Event Properties" window will open.
In the top right-hand area you will see two buttons with UP/DOWN arrows, and under that, a button with a "two-page" symbol: Click on this button, and it will copy the log to the Clipboard.
Now, paste a copy in your next post.
------------------------------

ComboFix 09-11-29.03 - Doug 11/30/2009 0:13.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.478.202 [GMT -8:00]
Running from: c:\documents and settings\Doug\Desktop\ComboFix.exe

http://www.bleepingcomputer.com/forums/ind...t&p=1519214

Edited by AustrAlien, 23 December 2009 - 07:39 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#10 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:35 PM

Posted 23 December 2009 - 09:16 PM

Everything that you have reported is normal, and consistent with having the Recovery Console installed. (I have double-checked that it is so on one of my own computers). The SafeBoot Repair is most unlikely to be the cause of any problem.

You reported an issue with running Check Disk, and that was somehow "fixed" by booting into Safe Mode.
http://www.bleepingcomputer.com/forums/ind...t&p=1502652
Based on that report, I suggest that you should check that your hard drive is not failing. Download the diagnostic utility from the hard drive manufacturer's website to create a bootable floppy or CD. Boot with it, and run the short/quick test and then the long/extended test, and check the S.M.A.R.T. status.

Firstly, you need to find the brand name of your hard drive. You will find this info on the label of the hard drive (most likely you will have to remove the hard drive from the box to read the label). You will also find sufficient info to identify the drive (the model number) by looking in the BIOS Setup Menu. Another alternative is to use something like Everest or Belarc Advisor.

EVEREST Free Edition 2.20
http://majorgeeks.com/download4181.html

Belarc Advisor - Free Personal PC Audit (Version 8.1b)
http://www.belarc.com/free_download.html

Hard Drive Diagnostics Tools and Utilities
http://www.tacktech.com/display.cfm?ttid=287

If the tool that you use does not provide a check on the S.M.A.R.T. status ....
Download and install HD Tune (free version)
http://www.hdtune.com/
and examine the S.M.A.R.T. attributes using HD Tune.
--------------------------------------

If the hard drive proves to be in perfect condition, with no problems what-so-ever, please then do the following:

Use the Windows XP Error checking utility - Check Disk (chkdsk /f ONLY).
Open "My Computer" and then right-click on the drive that you wish to check.
Select Properties > Tools, and in the "Error checking" section, click on "Check now".
Place a check mark in the box beside "Automatically fix file system errors" ONLY, and click Start.
If you are attempting the disk check on your Windows system drive, you will see the following message:
"The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed only by restarting Windows. Do you want to schedule this disk check to occur the next time you restart the computer?"
Click on "Yes".
Click on "OK" to close the (C: ) Properties dialog box.
Close any open windows or programs and re-start the computer.

Check Disk will run on restart, and when finished will restart the computer normally.
If there are any errors reported or repairs made, run the disk check again.
---------------
A log of the disk check is recorded (if the scheduled re-start is used). To open Event Viewer and view the log:
Start > Run and type "eventvwr" and press the key.
In the left pane, click on "Application".
In the right pane, at the top click on the column heading "Source" to sort the list alphabetically.
Look in the "Source" column for "Winlogon", with an entry corresponding to the date and time of the disk check.
Double-click on that entry to view the log.
If you wish, click on the "copy" button: You can then paste the log text into a text editor and save it, or paste the text into a forum post.

You have been very patient: We shall keep investigating until the Safe Mode issue is resolved this time!
----------------------------------

Late addition: Ah ... found it at last .... I was sure you had written this but I could not find it again!
You wrote: "MSCONFIG has been altered to use Selective Startup"
This is not normal: Why are you using Selective Startup?
If you can't answer that question, please change it back to "Normal".
On the "General" tab, select "Normal" Startup type, click on "Apply", "Close" and "Restart now".
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#11 FrogmanMickey

FrogmanMickey
  • Topic Starter

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:08:35 PM

Posted 24 December 2009 - 04:26 PM

Hi

Onward and upward...

The hard drive:
I doubt that this is a hard drive problem because scads of people have the same problem. If you put “agp440” in a Google search you will find many forums where people have reported that their computer stalls with agp440 showing on the driver list when trying to boot into safe mode. They can’t all have failing hard drives. However, having read many of those posts it is apparent that the agp440 file is a red herring. That just happens to be the last driver loaded before the problem occurs. People have proposed lots of theories about what the problem is (and isn’t). I was hoping Bleeping Computer would know for sure and have a fix for it.

However, since checking the hard drive is not a bad idea in any case, I decided to try and do that as you suggested. I didn’t download Everest or Belarc Advisor or remove the hard drive because the hard drive installed in the computer can be determined using Device Manager. It is a Toshiba MK8025GAS. Unfortunately, according to the TackTech.com page for which you provided a link, Toshiba does not provide diagnostic tools for hard drives.

I downloaded and ran the free HD Tune utility. The Health report showed no problems. I also ran the full Error check and it reported no problems. Reports of these checks are posted below.

Selective Start Up:
As to the mscofig General tab being set to “Selective Startup”, I did not do that, at least not on purpose. I thought the script had done it. I have set it back to “Normal”.

SafeBoot
Regarding my previous report that I could not get into safe mode using Safeboot, I was mistaken. Upon closer inspection I noticed that in msconfig under the BOOT.INI tab, the command line for Windows Recovery Console (under [operating systems]) is highlighted by default and the boot options are not available as long as that is the case. However, once I clicked on and highlighted the command line for Windows XP Home Edition instead, the boot options became available and I could select Safeboot. So I tried a reboot with Safeboot checked, and the computer entered Safe Mode with no problem. So I am back to my original complaint that I can’t get into Safe Mode using F8. BTW, do you happen to know why the HJT team advised that getting into Safe Mode by this method is not recommended if malware is suspected? If it is not a big risk, maybe using this method instead of F8 is a suitable work-around.

CHKDSK:
I followed the instructions to run CHKDSK and restarted the computer, but CHKDSK didn’t run on reboot. Ithe computer just booted normally into Windows. I tried it twice to make sure I hadn’t made a mistake. Same result. Remembering that the previous time CHKDSK ran successfully was when I was booting into Safe Mode using SafeBoot, I set the computer to boot into safe mode by checking SafeBoot in msconfig and restarted. This time CHKDSK ran OK and then rebooted into Safe Mode. I undid the SafeBoot selection, rebooted back into Windows and found the report generated by CHKDSK using eventvwr. I have posted the report below.

F8
After doing all of the above I tried to boot into Safe Mode using F8. No dice. Hangs after agp440 loads (as usual). Sigh.

Cheers,
Frogman

-------------------------------------------------------------
HD Tune Health report:

HD Tune: TOSHIBA MK8025GAS Health

ID Current Worst ThresholdData Status
(01) Raw Read Error Rate 100 100 50 0 Ok
(02) Throughput Performance 100 100 50 0 Ok
(03) Spin Up Time 100 100 1 1424 Ok
(04) Start/Stop Count 100 100 0 5849 Ok
(05) Reallocated Sector Count 100 100 50 0 Ok
(07) Seek Error Rate 100 100 50 0 Ok
(08) Seek Time Performance 100 100 50 0 Ok
(09) Power On Hours Count 58 58 0 16933 Ok
(0A) Spin Retry Count 216 100 30 0 Ok
(0C) Power Cycle Count 100 100 0 5532 Ok
(C0) Power Off Retract Count 100 100 0 322 Ok
(C1) Load Cycle Count 38 38 0 625516 Ok
(C2) Temperature 100 100 0 655400 Ok
(C4) Reallocated Event Count 100 100 0 0 Ok
(C5) Current Pending Sector 100 100 0 0 Ok
(C6) Offline Uncorrectable 100 100 0 0 Ok
(C7) Ultra DMA CRC Error Count 200 200 0 0 Ok
(DC) Disk Shift 100 100 0 8391 Ok
(DE) Loaded Hours 77 77 0 9219 Ok
(DF) Load/Unload Retry Count 100 100 0 0 Ok
(E0) Load Friction 100 100 0 0 Ok
(E2) Load-in time 100 100 0 224 Ok
(F0) Head Flying Hours 100 100 1 0 Ok

Power On Time : 16933
Health Status : Ok

---------------------------------------------
HD Tune Error check:

HD Tune: TOSHIBA MK8025GAS Error Scan

Scanned data : 76288 MB
Damaged Blocks : 0.0 %
Elapsed Time : 65:04

----------------------------------------------
CHKDSK report:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 12/24/2009
Time: 12:41:39 PM
User: N/A
Computer: DOUGLAS
Description:
Checking file system on C:
The type of the file system is NTFS.


A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 77 unused index entries from index $SII of file 0x9.
Cleaning up 77 unused index entries from index $SDH of file 0x9.
Cleaning up 77 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

78148160 KB total disk space.
51970692 KB in 122216 files.
40876 KB in 8686 indexes.
0 KB in bad sectors.
320684 KB in use by the system.
65536 KB occupied by the log file.
25815908 KB available on disk.

4096 bytes in each allocation unit.
19537040 total allocation units on disk.
6453977 allocation units available on disk.

Internal Info:
40 42 02 00 61 ff 01 00 2c b7 02 00 00 00 00 00 @B..a...,.......
c5 1e 00 00 02 00 00 00 49 07 00 00 00 00 00 00 ........I.......
50 5a b4 19 00 00 00 00 64 2d ee b6 00 00 00 00 PZ......d-......
c6 f9 e1 26 00 00 00 00 00 00 00 00 00 00 00 00 ...&............
00 00 00 00 00 00 00 00 90 9a c2 2f 01 00 00 00 .........../....
99 9e 36 00 00 00 00 00 90 38 07 00 68 dd 01 00 ..6......8..h...
00 00 00 00 00 10 0a 64 0c 00 00 00 ee 21 00 00 .......d.....!..

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Frogman Mickey

#12 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:35 PM

Posted 24 December 2009 - 11:17 PM

A suggestion has been made that the following may resolve your Safe Mode issue:

SUPERAntiSypware has a built in "Repairs" feature to fix policy restrictions and certain Windows settings which are sometimes targeted by malware infection.

Please download SUPERAntiSpyware Free

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* Click the Repairs tab.
* Click on (highlight) "Repair broken SafeBoot key" and then click the Repair button.
* You may be asked to reboot your computer for the changes to take effect.

Please let us know the result.
Meanwhile I am attempting to inquire widely amongst the BC staff for an explanation/resolution to the matter, so hang in there.
'Alien
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#13 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:35 PM

Posted 25 December 2009 - 12:01 AM

BTW, do you happen to know why the HJT team advised that getting into Safe Mode by this method is not recommended if malware is suspected? If it is not a big risk, maybe using this method instead of F8 is a suitable work-around.

It is not a BIG risk .... after reading the following, you will be prepared for the possible eventuality?
Hope this provides the answers you were looking for.

Problems that can occur by forcing Safe Mode using the System Configuration Utility
http://www.bleepingcomputer.com/tutorials/...#force_safemode

Never Force Safe Mode!
http://temerc.com/forums/viewtopic.php?f=12&t=3347
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#14 FrogmanMickey

FrogmanMickey
  • Topic Starter

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:08:35 PM

Posted 25 December 2009 - 04:07 PM

If sounds like certain viruses could cause a person to get stuck in an endless safeboot loop if msconfig is set to safeboot and the virus prevents the person from ever getting into Safe Mode. I do have a DVD which came with the computer entitled "Toshiba Recovery and Applications/Drivers. It is not an actual copy of Windows XP. It might let me boot the computer to a command prompt and rename the Boot.ini file to get past the problem as described in one of the links. I don't know, I have never used the disk. In case it wouldn't, do you have an instruction for making a bootable CD for Windows XP Home?

In any case, from the links provided it sounds like HJT highly recommends resolving the problem with booting into Safe Mode using F8, so let us continue to try to do that.

Cheers,
Frogman Mickey

#15 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:02:35 PM

Posted 25 December 2009 - 05:16 PM

Try booting from the Toshiba disk that you already have. If you are able to boot from the disk, look for the option to load the XP Recovery Console: Being an OEM disk, it may not have the Recovery Console utility available.

Problems that can occur by forcing Safe Mode using the System Configuration Utility
2 solutions - same thread .... a long and twisted tale ("life was not meant to be easy")

Download and fix with Puppy Linux
http://www.techsupportforum.com/microsoft-...tml#post2429890

Download and fix with XP Recovery Console bootable disk
http://www.techsupportforum.com/microsoft-...tml#post2477427
-----------------------

Have you tried the suggestion in post #12 yet?
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users