Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows XP freezes during boot and other problems


  • Please log in to reply
38 replies to this topic

#1 Shahajjo

Shahajjo

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:04:46 AM

Posted 25 April 2011 - 10:38 AM

Hello,

My Windows XP machine almost never boots at first attempt. Many times it freezes and shows a black screen (sometimes with the cursor arrow and sometimes without) before the Welcome screen appears. However, sometimes the freeze occurs after the welcome screen but before the desktop appears. Also, sometimes during booting, it shows a message that there are no booting devices available. When this happens, I go to the setup and find that both 1st and 2nd device are set to none. So, I re-choose the proper booting sequence.

Also, once the computer boots, it does everything really slowly. Lastly, I also cannot fix the computer clock to the proper time. I changed the time on the clock and it reverted back to a wrong time on the next boot.

(This machine is not the same one about which I sought help last month)

Edited by Shahajjo, 25 April 2011 - 10:39 AM.


BC AdBot (Login to Remove)

 


#2 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:46 PM

Posted 26 April 2011 - 02:45 AM

I also cannot fix the computer clock to the proper time. I changed the time on the clock and it reverted back to a wrong time on the next boot.

The above indicates that the CMOS battery on the motherboard is flat and needs to be replaced. A new battery may also help with your other problems?

Is this is a desktop PC, rather than a laptop? If it is a desktop PC, changing the battery is a fairly simple task. Take out the old battery, and record the number on it and then get a replacement at a computer store or from a watchmaker.

How to replace the CMOS battery

When you first boot the computer, you should enter the BIOS setup menu and set the correct date and time, save the settings, and then restart your computer. Let us know how the computer is running after doing that.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#3 Shahajjo

Shahajjo
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:04:46 AM

Posted 26 April 2011 - 02:45 PM

I replaced the CMOS battery of my computer (it is a desktop) and since then the computer has not frozen during the booting process (I tried 2-3 boots immediately after replacing the battery). Also, for now the time on the computer clock is correct. However, the computer is still very slow (e.g. sometimes it takes minutes to access a website or when a window is closed it does not close immediately rather I can see the 'closing process' when the window begins to disappear from the top gradually until the bottom).

#4 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:46 PM

Posted 26 April 2011 - 03:52 PM

So far, so good.

The slowness that you described is not so easy to diagnose.

You posted in the "Am I Infected?" forum: Is there any reason you did that? Do you have any reason to think that your remaining computer issues may be related to a malware infection?

How long has this "slowness" existed. Did it start start suddenly or happen gradually? Was there anything in particular that may have led to the problem? What have you done so far in an effort to investigate or solve the issue?

To at least make a start, let's have a look at a MBAM log.

Please download Malwarebytes' Anti-Malware and save it to your Desktop.
alternate download link 1
alternate download link 2

  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note 1: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless of whether you are prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Note 2: MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes (like Spybot's Teatimer), they may interfere with the fix or alert you after scanning with MBAM. Please disable such programs until disinfection is complete or permit them to allow the changes. To disable these programs, please view this topic: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#5 Shahajjo

Shahajjo
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:04:46 AM

Posted 27 April 2011 - 09:51 AM

Unfortunately, the initial problem of freezing with a black screen during boot has returned. As for your questions, the answers are:

Questions
You posted in the "Am I Infected?" forum: Is there any reason you did that? Do you have any reason to think that your remaining computer issues may be related to a malware infection?

Answer
The reason I posted in this forum is that I assumed it is most likely a hidden infection (working in the background to slow down the computer, change the time etc)

Questions
How long has this "slowness" existed. Did it start start suddenly or happen gradually? Was there anything in particular that may have led to the problem? What have you done so far in an effort to investigate or solve the issue?

Answer
Unfortunately, I do not remember the dates. So, I will only mention the sequence of events. My computer was restarting automatically several times. So, I reinstalled Windows XP. After that, everything was ok until I installed Trend Micro Anti Virus (which optimally requires more RAM than is currently present (i.e. 256 Mb) in the computer). Then, the computer started to become slow (there were no problems yet with the booting process i.e. there was no freezing). Since then, I have tried both reinstalling Windows XP and uninstalling Trend Micro without solving the problem. So, I thought that the problem is not related to the Anti Virus and reinstalled it. Finally, what is described above is about the beginning of the problem. The degree of slowness has increased gradually. Also, I do not recall anything associated with starting of the freezing problem.

Lastly, the MBAM log is as follows:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6452

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/26/2011 11:23:25 PM
mbam-log-2011-04-26 (23-23-24).txt

Scan type: Quick scan
Objects scanned: 209051
Time elapsed: 41 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#6 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:46 PM

Posted 27 April 2011 - 11:14 AM

... sometimes during booting, it shows a message that there are no booting devices available. When this happens, I go to the setup and find that both 1st and 2nd device are set to none. So, I re-choose the proper booting sequence.

I changed the time on the clock and it reverted back to a wrong time on the next boot.

Please let me know if either of the above two happenings occur again after installing the new CMOS battery, or you notice any other unusual behaviour.

:step1: How old is this computer?

:step2: Please Publish a Snapshot using Speccy, and post a link to it in this thread.
This is a convenient and accurate way of providing us with details of your computer specifications.

:step3: Use the Windows Error Checking utility (Check Disk), with the options to scan the disk surface for errors, and attempt recovery of data and repair the disk.
  • Open "My Computer"
  • Right-click on the drive that you wish to check > Properties > Tools > and in the "Error checking" section, click on "Check now".
  • Place a tick in both boxes > Start.
  • If the disk you have chosen is the system disk:
  • A message will notify you that a restart is necessary: Click OK, and close all windows.
  • Re-start the computer. The disk will be checked when the system boots.
    This test will take some time to run and at times may appear stalled but just let it run.
  • When the disk check is complete, the system will re-start automatically and load Windows.
A log of the disk check is recorded only if the scheduled re-start is used, and only for drives on the same HDD as the Operating System.
To open Event Viewer and view the log:
  • Go to Start > Run > and type eventvwr and press the <ENTER> key.
    The Event Viewer window will open.
  • In the left pane, click on Application.
  • In the right pane, at the top, click on the column heading Source to sort the list alphabetically.
  • Look in the Source column for "Winlogon", with an entry corresponding to the date and time of the disk check.
  • Double-click on that entry to view the log.
  • Click on the Posted Image button to copy the log text to the clipboard.
  • Paste the log text into your next reply.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#7 Shahajjo

Shahajjo
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:04:46 AM

Posted 27 April 2011 - 02:55 PM

The computer is about 7 years old.

The link for the computer specification is: http://speccy.piriform.com/results/J2bPvLAXl6HIMZJM7MhdNzS

The log for error check is as follows:

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 4/27/2011
Time: 3:37:35 PM
User: N/A
Computer: MUSTAFA-B567D41
Description:
Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.
Attribute record of type 0x80 and instance tag 0x4 is cross linked
starting at 0x1d0bdc for possibly 0x10 clusters.
Attribute record of type 0x80 and instance tag 0x4 is cross linked
starting at 0x1d0bdc for possibly 0x10 clusters.
Some clusters occupied by attribute of type 0x80 and instance tag 0x4
in file 0x454d is already in use.
Deleting corrupt attribute record (128, "")
from file record segment 17741.
Cleaning up minor inconsistencies on the drive.
Cleaning up 1504 unused index entries from index $SII of file 0x9.
Cleaning up 1504 unused index entries from index $SDH of file 0x9.
Cleaning up 1504 unused security descriptors.
Inserting data attribute into file 17741.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

20482843 KB total disk space.
10747660 KB in 69268 files.
32444 KB in 5018 indexes.
0 KB in bad sectors.
153739 KB in use by the system.
65536 KB occupied by the log file.
9549000 KB available on disk.

4096 bytes in each allocation unit.
5120710 total allocation units on disk.
2387250 allocation units available on disk.

Internal Info:
e0 4f 01 00 3a 22 01 00 5b ca 01 00 00 00 00 00 .O..:"..[.......
ed 01 00 00 00 00 00 00 29 08 00 00 00 00 00 00 ........).......
02 91 ba 02 00 00 00 00 e6 f0 f8 2f 00 00 00 00 .........../....
70 10 fb 42 00 00 00 00 90 f4 51 63 02 00 00 00 p..B......Qc....
20 8b 4c 80 00 00 00 00 42 f3 e8 60 03 00 00 00 .L.....B..`....
99 9e 36 00 00 00 00 00 10 3a 07 00 94 0e 01 00 ..6......:......
00 00 00 00 00 30 fc 8f 02 00 00 00 9a 13 00 00 .....0..........

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

#8 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:46 PM

Posted 27 April 2011 - 05:29 PM

The Speccy report shows your firewall as disabled. Is there any reason that you have disabled the Windows firewall? I see no evidence of a third party firewall.

Please run Error Checking as per instructions, on both C: and D: drives and post the two logs.

How is your computer behaving now?
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#9 Shahajjo

Shahajjo
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:04:46 AM

Posted 27 April 2011 - 05:46 PM

I can enable the Firewall. When I checked the D-drive for Error, it completed the test without asking for a restart and I could not find a log file.

#10 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:46 PM

Posted 27 April 2011 - 06:03 PM

I can enable the Firewall.

That would be a good idea.

I'll await the Error Checking log from C: drive.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#11 Shahajjo

Shahajjo
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:04:46 AM

Posted 29 April 2011 - 11:55 AM

I am sorry to be later in responding. When I tried to run the error check, the machine froze. Since then when I try to re-boot, I get the meaasge saying that:
Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM
You can attempt to repair this file by staring Windows Setup using the original Setup CD-ROM. Select 'r' at the first screen to start repair.

I have tried to follow the suggestion. Hitting 'r' after inseritng the CD takes me to the recovery page. However, I did not know what to do afterwards. For now, I can implement 'Part one' of Microsoft's suggestion about the problem (http://support.microsoft.com/default.aspx?scid=kb;EN-US;q307545) and then run the error check and report back the results.

#12 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:46 PM

Posted 29 April 2011 - 04:05 PM

Start the Recovery Console using a Windows XP installation CD (or an XP Recovery Console CD).
  • Insert the CD in the computer's optical disk drive tray.
  • Start or re-start the computer so that it boots from the CD. You may be prompted to "Press any key". (If the system does not appear to be booting from the CD, you may need to enter the BIOS Setup Menu and change the boot order, so that the CD-ROM/optical disk drive is set to boot before the hard disk drive.)
  • When the Welcome to Setup screen appears, press the R key on your keyboard to start the Recovery Console.
  • The Recovery Console will ask which Windows installation you would like to log on to.
    If you have multiple Windows installations, it will list each one, and you would type the number (that is 1, 2, or 3 etc) associated with the installation you would like to work on (usually C:\Windows) and press the <ENTER> key.
    Please advise if you are not seeing C:\Windows listed (and you think that you should).
    If you have just one Windows installation showing, type 1 and press <ENTER>.
  • You will be prompted for the Administrator's password. If there is no password, (and this is most likely), simply press <ENTER>.
  • You will be presented with a C:\Windows> prompt.
    Please advise if you are not seeing a C:\WINDOWS> prompt (and you think that you should).
At the C:\Windows> prompt, type chkdsk /r and press <ENTER> (Note: There is a space between "chkdsk" and "/r")
  • This will take some time to run and at times may appear stalled but just let it run.
  • If any errors are found/repairs made, run chkdsk /r again, and repeat if necessary.
Type "exit" at the prompt and press <ENTER> to close the Recovery Console and restart your system.

Does Windows start normally now?
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#13 Shahajjo

Shahajjo
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:04:46 AM

Posted 30 April 2011 - 12:13 PM

I ran chkdsk /r (the first 3-4 times the chkdsk found and fixed errors. As instructed, I repeated the process till the disk was checked and no messages saying that one or more errors were fixed appeared. Even after that, I repeated chkdsk /r and the check did not find any errors). However, the same problem with starting Windows XP remains.
Also, the set-up from CD sometimes gets frozen with a black screen without any text (after I press a key to choose booting from CD). At other times, the set-up gets frozen with a blue screen without any text (just before the screen is loaded with the options to choose between a new installation (by pressing Enter) and a repair (by pressing R)).

#14 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:07:46 PM

Posted 30 April 2011 - 06:07 PM

... when I try to re-boot, I get the meaasge saying that:
Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

Try using a LIVE CD to perform an off-line system restore of the registry hives.

Using a working computer:
There are many options to use for a LIVE CD: Try Puppy Linux (download file size 128 MB)
When you have downloaded the ISO image, burn it to a CD using ImgBurn (choose "Write image file to disc"). The CD will be bootable.

Now to work on your problematic computer:
Boot from the Puppy Linux CD. You will be able to navigate to all the files on your HDD.

Off-line system restore using a LIVE CD

:step1: Navigate to C:\System Volume Information\
Inside that folder you will see a folder with a name beginning with "restore" followed by a long alpa-numeric code in brackets. Inside the "restore<bracketed long alpa-numeric code>" folder you will see a number of folders named "RP<3 digit number>". Choose the highest number: That is your most recent System Restore point.
Open the "RP<highest number>" folder and inside that you will see another folder called "snapshot". Finally, open the "snapshot" folder and you will be at this address ...
C:\System Volume Information\restore<bracketed long alpha-numeric code>\RP<highest number>\snapshot

Locate the 5 files that you need to copy from within the snapshot folder:

_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SAM
_REGISTRY_USER_.DEFAULT


Copy these 5 files from here, and paste into the "config" folder at following location ...
C:\Windows\System32\config <<< folder


:step2: In the "config" folder at C:\Windows\System32\config, locate the current registry hive files ...

system
software
security
sam
default

.... and re-name them by appending .old to the filename, so that they now look like this ....

system.old
software.old
security.old
sam.old
default.old


:step3: Still in the "config" folder at C:\Windows\System32\config
Re-name the files that you copied from the restore point:

_REGISTRY_MACHINE_SYSTEM ... rename to SYSTEM
_REGISTRY_MACHINE_SOFTWARE ... rename to SOFTWARE
_REGISTRY_MACHINE_SECURITY ... rename to SECURITY
_REGISTRY_MACHINE_SAM ...rename to SAM
_REGISTRY_USER_.DEFAULT .... rename to DEFAULT (You MUST remove the dot in front of DEFAULT)

You have now completed the system restore. Shut down the computer, removing the LIVE CD.


Does your Windows XP system start normally now?

Edit: If using the latest Restore Point does not work, try again using the Restore Point before that, or the one before that even.

Edited by AustrAlien, 30 April 2011 - 06:23 PM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#15 Shahajjo

Shahajjo
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Local time:04:46 AM

Posted 01 May 2011 - 04:35 PM

On starting the computer after implementing the above and restoring the system to the last restore point (i.e. the highest numbered RP), Windows XP performed a check disk operation and corrected many things and restarted. Since then, when I try to boot I get a black screen (with vertical white stripes near the bottom of the screen and the stripes join together to form a continuous white row) and afterwards the screen with the Microsoft logo and then the system restarts again. The process repeats continuously. Then, I tried to restore the system to the second-last restore point (i.e. the second-highest numbered RP). There were no check disks performed this time but XP keeps on restarting like before.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users