BleepingComputer.com: Windows XP Home boots to blank screen (intermitant)

First I would like to thank your team for all the work you do in resolving peoples issues. Although this is my first post I've used this site well over a 100 times fixing systems for friends and family. I always find the forums not only helpful but very concise. I only post now because after looking I've not found a solution.

System information
Dell Insprion laptop
Windows XP Home (sp3)
Used in an office environment by approx 3 users

Primary software used
Thunderbird, Excel 2003, Word 2003, IE 8 / Firefox (current)

The issue I am having is intermittent. During start-up directly after the Windows splash screen Windows will boot to a blank screen. It appears as though the operating system completes the start up process but no matter how long you wait it will stay blank. Sometimes it can happen twice a day sometimes it will happen once a week however, once it starts booting to a blank screen it will continue to do so over and over until corrected. The only way I've found to correct it is to boot to safe mode (which has never failed) and delete the pre-fetch catch through killbox. I am not happy with doing this because it is causing the machine to run sluggish but it is the only fix that seems to work.

Things I've attempted

• compared hijack this scan with original log I have saved from known good configuration of machine (no changes)
  
• ran ESet antivirus - found a few cookies minimal threat (I allowed them to be deleted)
  
• updated/ran Spybot Search & Destroy (nothing malicious found)
  
• updated/ran Malwarebytes (nothing malicious found)
  
• ran rootkitrevealer (nothing found)
  
• installed avg free and ran (nothing malicious found)
  
• ran defrag & chkdisk (I thought maybe it was a disk failure but it didn't show any issues)

At first I was thinking it was a failing piece of hardware but the fact that I can so easily and constantly fix the issue through software it is making me think otherwise.

Again, I very rarely post on forums so if I've done anything offensive I am sorry. I appreciate any help you can give and if you need any more info from me let me know. Thanks in advance!

Zerpft

Hi zerpft, you seem to have checked your system with 'anti Malware' software, fiddled with Safe Mode; I'd suggest you test your hardware using a Hardware analysis programme. http://majorgeeks.com/downloads7.html

Hello and welcome to the fourm!

I do not think that I would download anything from the above link as it appears to be quite confusing and misleading.

Interesting thing is that you say you can replicate this on demand and it always works

I have a machine that will very occasionally do the same thing ... load to a blank Desktop screen, and I don't know why it happens.

Next time it happens, try pressing the Ctrl+Shift+Esc keys to open Task Manager:

• On the Applications tab, click on New task.
  
• Type explorer.exe into the text box and press the <ENTER> key.

Does this bring up the Taskbar and Desktop icons and allow normal use &/or restarting normally?

AustrAlien,

I am sorry about the usage of the word "blank" I should have said black. After the Windows XP splash screen it flickers for a second and goes black. Alt-Ctrl-Del does not work or at least does not take it out of that state. The only thing I see that even lets me know it is turned on is the power light and the sounds of the HDD whirling.

Uluru,

I agree that I could see it being a hardware problem. I installed pc-doctor and ran a test on the ram memory and a stress test on the video. As I said I've previously also ran chkdisk. None of them find any hardware failures. Any other areas you might point towards testing?

Thanks so much for your help. I know this is a tricky one. One of the things I've not tried and that I've always been slightly confused about is verifying the .sys files. Is there any possibility a rouge .sys could cause this issue? If so is there anything that could check them?

 zerpft, on 30 December 2011 - 11:24 PM, said:

Exactly how did you run chkdsk?

Please post the last few chkdsk logs. A log of the disk check is recorded only if the scheduled re-start is used, and only for drives on the same HDD as the Operating System.
To open Event Viewer and view the log:

• Go to Start > Run > and type eventvwr and press the <ENTER> key.
  The Event Viewer window will open.
  
• In the left pane, click on Application.
  
• In the right pane, at the top, click on the column heading Source to sort the list alphabetically.
  
• Look in the Source column for "Winlogon", with an entry corresponding to the date and time of the disk check.
  
• Double-click on that entry to view the log.
  
• Click on the button to copy the log text to the clipboard.
  
• Paste the log text into your next reply.

@ zerpft

Quote

I must apologise for pointing you at a huge clump of Hardware diagnostic tools, zerpft.

I do 'feel' it is a Hardware problem you're experiencing.
I'll look further at some diagnostic programmes which may help. Not necessarily third party.


Please Uninstall pc-doctor.

Any info about your machine being hotter than normal, having dropped it, is always a help as the environment you put your Computer through is often the root cause of these intermittent problems.

Quote

Ask the other User's if they've noticed anything strange after performing a task, like updates, installation, etc.

zerpft, out of interest, when the Computer is booting, hold SHIFT once you're in the Windows splash screen, see if this takes you to your Login page, or logged in.

Quote

Personally I would recommend not clearing your prefetch folder, and also seeing that it is there.
C:\windows\prefetch
1.) Starting in Safe Mode means limited drivers are loaded. Suggesting a driver issue.
2.) You may have deleted the Prefetch folder ?

Please do as AustrAlien has asked.

This post has been edited by Uluru_2: 31 December 2011 - 08:26 AM

I from command prompt i typed "chkdsk /f" waited for awhile and it asked me if it should run on the next reboot I typed y. I restarted the machine and watched it complete the scan. When I pulled up eventvwr as you asked I sorted it and saw no entries for winlogon at all. I sorted by date and this is the only information I've gotten since rebooting. I checked services.msc and winlogon is set to automatic. Task manager shows winlogon as running. I will discuss with my co-workers on Monday if they have seen/done anything "iffy" but as you know non-technical people tend to have at best vague recollections.


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1004
Date: 12/31/2011
Time: 1:38:42 PM
User: NT AUTHORITY\SYSTEM
Computer: MACK-W05
Description:
Detection of product '{00020409-78E1-11D2-B60F-006097C998E7}', feature 'ProductNonBootFiles', component '{4A31E933-6F67-11D2-AAA2-00A0C90F57B0}' failed. The resource 'HKEY_CURRENT_USER\Software\ODBC\ODBC.INI\MS Access Database\' does not exist.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 zerpft, on 31 December 2011 - 02:07 PM, said:

That should normally produce a Winlogon entry containing the chkdsk log. I don't know why the log would not be saved.


Step 1: I would like you to save two Event Viewer logs and upload them so I can review them.

Please create a new folder on your Desktop, and name it EventLogs.

Go to Start > Run and type eventvwr.msc and press <ENTER>

• When the Event Viewer window has opened, on the left side, click on System.
  
• On the top main menu bar, click Action > Save Log File As ...
  
• Enter system as the "File Name" and choose the EventLogs folder on your Desktop as the "Location" to save it.
  (Leave the "Save as type:" as the default setting of "Event Log (*.evt)").
  
• Click Save.

Do the same for the Application log:

• On the left side, click on Application.
  
• On the top main menu bar, click Action > Save Log File As ...
  
• Enter application as the "File Name" and choose the EventLogs folder on your Desktop as the "Location" to save it.
  (Leave the "Save as type:" as the default setting of "Event Log (*.evt)").
  
• Click Save.

Close the Event Viewer window.

At your Desktop, zip up the EventLogs folder and attach the zip file to your next post in this thread.

Note: The BC forums will allow a total attachment size of only 512 kb and what you need to attach may exceed this limit. In that case, please upload the zip file to a file sharing website of your choice and and post a link to it in this thread so that we can access your uploaded zip file.

See the suggestions in the following links for recommendations on file sharing websites:

• http://lifehacker.com/388284/best-online-file-sharing-services
  
• http://www.hongkiat.com/blog/15-great-free-online-file-sharing-alternatives/
  
• http://www.smashingapps.com/2008/08/28/5-best-free-file-hosting-services-to-store-your-files.html

Step 2: Test the hard drive. If you tell us the hard drive manufacturer's name (brand name) and model we can point you to the most appropriate diagnostic utility to use. It is best to use the hard drive manufacturer's own diagnostic utility, but Seagate's tool will work OK on most brands. The diagnostic tool is run from a bootable CD (Windows does not need to be working).The first two steps are done on a working computer, while the third step is to boot the ailing computer with the CD that you create in the first two steps.

Please download SeaTools for DOS (CD) from Seagate's SeaTools for DOS web page

or use the following direct download link to download the latest version of SeaTools for DOS:
Download SeaTools for DOS ISO Image

The downloaded file name is SeaToolsDOS223ALL.ISO

Burn the downloaded .ISO image to a CD using the appropriate burning software.

If you do not already have a suitable burning program for writing .ISO images to disc ...

• Download and install ImgBurn.
  Ensure that you UN-check the box agreeing to install the Ask toolbar during the installation.
  
• Place a new (blank) CD disc in the drive tray.
  
• Choose Write image file to disc.
  
  • Under Source, click on the Browse button: Navigate to and select the .ISO file that you wish to burn.
    
  • Place a check-mark in the box beside Verify.
  
  
• Click
  
  When the CD has been burned and verified as successful, it will be bootable.

Boot from the CD.

(You may need to access the BIOS Setup Menu or the Boot Menu and change the boot order to enable booting from CD before hard drive.)


• From Basic tests on the Main Menu, run the Short test and then the Long test.
  
  (The long test will take some considerable time to complete.)
  The results will be shown as either a PASS or FAIL.
  There is a chance that during the Long test, you may be offered the opportunity to attempt repairs on the hard drive:
  
  • If so, go ahead and attempt to do so, but ONLY after backing up all important personal files.

Note: You may wish to view the following ...

• Learn more about SeaTools for DOS. (view a 24 page pdf document)
  
• See the tutorial on the usage of SeaTools for DOS.

Please let us know the results of the tests.

When you can, include the make and model number of the problematic hard drive. If you do choose to use SeaTools, you will see the model number (and maybe the make) when SeaTools first detects the hard drive.

Attached you will find the event viewer logs requested. I will run the seatools test as soon as I can get the CD burned and let you know those results shortly.

Thanks.

Update: Ran seatools on drive and it passed both the long and short test.
Drive information from Seatools Fujitsu MHV2060AH.

This post has been edited by zerpft: 02 January 2012 - 03:32 PM

May I suggest at this point as a safe guard to download to your Desktop, zerpft, ERUNT:The Emergency Recovery Utility NT
This is a very tried and true backup utility for your registry, which has often surpassed a 'System Restore' point as a System backup through my years of experience.

Read the info, it is very simple to use, and has saved many people from destroying their System before undertaking advanced trouble shooting.

Don't forget to add anything you are unsure about, or, peculiar about your System at this stage, as well as requested Logs.

All the best, zerpft.

Thank you both for your help.

I followed your last message and did backup of the registry and took it upon myself to throw every scanner I could find on this board (except Combofix). After multiple scans with virus scanners Spybot & Malwarebytes revealing nothing I believe I was able to actually find and correct the problem. I ran Tdsskiller and it hit on something that it said was hooked to a driver. My apologies I did not write down exactly what it found because I personally didn't think it was the problem. I allowed Tdsskiller to delete the problem file and I have not had an issue over the last week. It also seemed to have fixed my programs not displaying in Add/remove within the control panel.

It was a very surprising result so I thought it would be worth sharing. I've read a little about tdss and it seems to be a downloader. Do you have any further advice for a machine that was previously infected with tdss?

Thanks again for everything.

zerpft

Thank you for reporting on your findings to date, and congratulations on your persistence and successful result.

You asked: "Do you have any further advice for a machine that was previously infected with tdss?"
I suggest getting the system checked, cleaned and verified as clean by posting in the Malware Removal Forum ... at least for your own peace of mind. There may be other/hidden malware yet to be discovered.

Please follow the instructions in the
Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

When you have done that, post your log in the "Virus, Trojan, Spyware, and Malware Removal Logs forum", NOT here, for assistance by the Malware Response Team experts. Ensure that you report what you have done and found to date, and include a link to this topic. If you have a log produced after running TDSSKiller, then it may be helpful to include that in your initial post also.

Please let us know, here, if you have been able to successfully start your new topic.