Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Laptop boots to default video driver


  • Please log in to reply
15 replies to this topic

#1 Popeye2000

Popeye2000

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:10:52 AM

Posted 02 May 2013 - 01:09 PM

Just recovered from Malware Issue - rootkit with several other goodies - on my mother's computer.  See accompanying forum topic: http://www.bleepingcomputer.com/forums/t/492956/unidentified-malware/

 

I have been re-directed here to help fix the remaining issues that ao ppear to be Win XP-32 related.  We have verified the computer is malware free. Her computer is running Windows XP SP3 on a dell latitude D620 (1.66 GHz Intel T2300 processor, 1Gb Ram, 80Gb HD).  I have the computer in my posession for troubleshooting.

 

Prior to the computer being provided to me, my mother sought the assistance of Microsoft.  They had her uninstall SP3 and IE8, then reinstall.  Unfortunately the reinstall failed and rendered her laptop a paperweight as she got BSOD in Boot to safe mode, and Windows Activation on regular boot (which would error out).  I had to batch the spuninst.txt file from recovery console to uninstall the IE8 update, to be able to finally activate the computer, then reinstalled SP3 and IE8.

 

Prior to the malware, none of the current issues were present.  There are 3 issues that persist, and I believe at least two, if not all, of them are related:  

 

1) Nvidia Quadro NVS 110M driver does not load on reboot.  Device Manager shows Code 10.  I can load the drivers, and they work until I reboot. When I load the driver through device manager, I can load the oldest (2006 driver) and the newest (2008 driver) and they work fine.  Once installed I can open Nvidia control panel and make changes to the settings and within the nvidia control panel.  The problem is that as soon as I reboot, it reboots with some default graphics driver and gives me a code 10 in device manager until I manually reload the driver again.  I have uninstalled/reinstalled the hardware via device manager, re flashed the bios, reloaded the chipset drivers, attempted to delete the upper and lower filters from the registry (they didn't exist).  I've tried several different drivers, all work until reboot.  I've created additional accounts and can log in and log out of each user account and the driver stays loaded.  It only fails to load on reboot.  I've run the dell hardware diagnostic and it passed all the tests, particularly, the graphics adapter and display passed all the tests run using that diagnostic tool.  I note that if I run the NVIDIA driver installation software, that upon reboot the screen gets to the point where it is about to flash to the reboot, then stops with a black screen and cursor.  No HDD activity or anything else.  When I get to this point I have to hold the power button to power down.

 

2) Laptop does not wake from Standby.  I believe this is related to the graphics adapter driver issue.  When I close the lid to the laptop the computer goes into standby, when I open the lid I get a black screen with cursor, and can see HDD activity light flashing intermittently as though its trying to do something.  Ive let it sit for as long as 15 minutes without any change in activity.  This requires me to hard boot.  I haven't tried much troubleshooting on this, as I only recently discovered this issue.  I will try to see if it is different between when the Nvidia driver is loaded and when the default VGA driver is loaded, and update this post as I have more information.

 

3) MSCONFIG generates error: I don't ordinarily use MSCONFIG to control startup programs, but when the initial malware problems occurred, you couldn't install anything, and there was no other way to turn off the malware that was loading on startup which was preventing any steps for removing them malware.  Once we were able to recover the computer, we tried to re-enable all the startup programs from MSCONFIG.  While it appears it accepted all the changes, it generated the error: "An access denied error was returned while attempting to change a service.  You may need to log on as the administrator to make the changes."  we get this error by simply opening up MSCONFIG without making any changes.  This is low priority since we ordinarily dont use MSCONFIG to control services or startup programs, but I only mention it to see if somehow the issues are related.

 

I am wondering if there is a config file or some other system file that may have been corrupted by the malware, or had its permissions changed by the malware, that direct which drivers load on startup.

 

Any help is GREATLY appreciated.



BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,106 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:52 AM

Posted 02 May 2013 - 01:46 PM

If the hard drive is sound...why not simply do a clean install?

 

You have Dell recovery CDs?  Install CDs?

 

Your first 2 errors/situations...seem to be related, hibernation issues often seem to trace to vidoe/graphics drivers.

 

See following for info on Code 10 errors, http://pcsupport.about.com/od/findbyerrormessage/a/code-10-error.htm .

 

You can go into Device Manager...and uninstall all graphics drivers...before attemtping to install drivers which are undamaged and fully functional.  If existing drivers are damaged, the "update" function may fail...it's best to remove them, then install the undamaged drivers.  Note that I did not say "latest'newest" drivers...use the ones from the Drivers CD which came with the system.

 

I don't follow you when you speak of services and msconfig.  If you changed the status of servides...then you need to undo whatever you did, it's that simple to me.

 

Microsoft Defaults, http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sys_srv_default_settings.mspx?mfr=true

 

If you want to manage startups...that is not what msconfig is for, it's designed for troubleshooting system issues.  One of the following should fit you if you want to manage startups.

 

Starter (for Startups) - http://www.softpedia.com/get/Tweak/System-Tweak/Starter.shtml

 

Startup Control Panel - http://www.mlin.net/StartupCPL.shtml

 

Startup Inspector for Windows - http://www.windowsstartup.com/

 

Louis


Edited by hamluis, 02 May 2013 - 01:50 PM.


#3 Popeye2000

Popeye2000
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:10:52 AM

Posted 03 May 2013 - 08:11 AM

Louis,  Thanks for the help.  

 

Clean install isn't in the cards just yet.  My mothers computer has some legacy software that she uses for clients (such as Quickbooks, TurboTax, etc.) that she no longer has the keys to, and needs to use for atleast another year.  I wanted to do a clean install when she was infected with the Malware... it would have saved me countless hours of troubleshooting.   :smash:  So for the time being I have to try and make this work.

 

I did try the PC Support steps previously, without success.  I tried again for troubleshooting sake.  Tried all steps from both user account and from admin account in safe mode.  Same issues persist.  I note that when the computer reboots it is loading the "VgaSave" Non-Plug and Play driver.  Also when I load the driver four (4) "Default Display" and one (1) "Plug and Play" monitor show up in device manager after the driver install.  Device manager doesnt show a monitor in device manager.

 

I did test a few additional things.  If I load the driver (and not reboot), I can shut the lid and the system goes into standby, and wakes from standby when I open the lid.  When the VGASave driver is loaded instead, I cannot wake from standby.

 

With respect to MSCONFIG, no services were affected.  The only changes ever were in the early stages of malware troubleshooting.  The malware was preventing anything from being installed, while loading certain things at startup that needed to be shut off to be able to troubleshoot the malware.  While I normally use other programs to adjust what loads on startup, that wasnt an option in this case.  Everything is on in MSCONFIG, but even if you open the panel and make no changes, and close it, you get the admin error.  The only reason I mention the MSCONFIG issue is because Im thinking that it is linked to the overall problem.

 

What file directs which drivers are loaded on startup?  Im thinking some folder or file permissions were changed as a result of the malware that is preventing a change being made to whatever configuration file loads the appropriate drivers.



#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,106 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:52 AM

Posted 03 May 2013 - 08:43 AM

I'm not clear on this...did you actually go into Device Manager...uninstall the VGASave driver under Display Adapters...then reboot?

 

I guess that I wonder if you are attempting to load the correct driver, since that model laptop can reflect either Intel graphics or nVidia graphics.

 

How did you determine that the system employs the nVidia chipset for graphics, as opposed to Intel?

 

See drivers listed as options for system at http://www.dell.com/support/drivers/us/en/19/Product/latitude-d620 .

 

Go Start/Run...type msinfo32 and hit Enter.  Scroll down to Components, click plus sign so that detail can be displayed.

 

Scroll down to Display, click...post the first five lines displayed in the right portion of the screen, please.

 

Louis


Edited by hamluis, 03 May 2013 - 08:44 AM.


#5 Popeye2000

Popeye2000
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:10:52 AM

Posted 03 May 2013 - 09:47 PM

Louis,

 

Thanks again for your reply and I apologize if I wasnt clear.

 

When I uninstall, I am going to device manager, going to the NVIDIA adapter that shows the trouble icon, and selecting "uninstall.  It then prompts me to reboot.  I have not selected to uninstall the VGASave driver.  The VGASave driver is what is being loaded on boot every time I reboot.  The only way I am able to arrive that this is the driver loading is to goto Display->properties->settings-Advanced->Adapter->Properties.  There is not an option to uninstall VGASave (atleast one I have found), and it is never shown (atleast that I can find) in device manager when it is loaded.  I hope that helps clear up any miscommunication on my part.

 

I arrived that it was the Nvidia quadro from the first time I touched the computer during the malware recovery.  One of the first things I attempted was to restore the graphics because it had me in 800x600 16 bit graphics mode.  Device Manager showed the Nvidia Device with the code 10 error.  I went to the Dell website and entered the service tag for the computer, and it provided me the list of drivers, only providing the one driver option for the graphics adapter, and that is for the Nvidia Quadro.  I would be happy to try another driver if you think it is worth a shot.

 

Here is the information you asked for fro the system info:

 

 

Name NVIDIA Quadro NVS 110M
PNP Device ID PCI\VEN_10DE&DEV_01D7&SUBSYS_01C21028&REV_A1\4&1C9EC085&0&0008
Adapter Type Not Available
Adapter Description NVIDIA
Adapter RAM Not Available
Installed Drivers Not Available
Driver Version vga.sys,framebuf.dll,vga256.dll,vga64k.dll
INF File 6.14.10.8313 (oem1.inf section)
Color Planes nv4_WSApps_G72_WinXP_LP1
Color Table Entries 1
Resolution 4294967296 x 1024 x 768 hertz
Bits/Pixel 1
Memory Address 0xED000000-0xEFEFFFFF
Memory Address 0xD0000000-0xDFFFFFFF
Memory Address 0xEE000000-0xEEFFFFFF
IRQ Channel IRQ 16
Driver c:\windows\system32\drivers\nv4_mini.sys (6.14.10.8313, 3.43 MB (3,595,296 bytes), 8/11/2004 6:08 PM)

 

Another thing I noticed is that after I uninstall, I never get the windows balloon "windows found new hardware".  Also, there is "Nvidia Drivers" in the add/remove programs.  When I remove the program, it makes me reboot, then, upon reboot the display flashes around and it loads the nvidia drivers, and the drivers appear in the add/remove programs.  Then upon reboot again, it goes back to the old problem.  Is there a way to completely remove the nvidia drivers forcing it to give me the windows balloon?  Maybe this is my issue.



#6 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:08:22 PM

Posted 04 May 2013 - 03:08 AM

Hi

 

It looks like due to the malware attack and the uninstall of SP3 your OS got corrupted. Why don't you try a repair install first to fix the OS?. Uninstall the graphic driver and do a repair install. When it finishes try to install the VGA driver. 



#7 Popeye2000

Popeye2000
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:10:52 AM

Posted 04 May 2013 - 08:13 AM

Thanks for your advise Anshad.  Will a repair install affect the operation of the legacy programs?  Most of them are pretty old, and we cant find the activation keys for them. If I create a restore point before the repair install and find that the repair install affected those programs, will I be able to revert to back?



#8 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:08:22 PM

Posted 04 May 2013 - 09:30 AM

Hi

 

Repair install will preserve all your data and installed programs. So you don't have to worry about loosing old programs. Instead of creating a restore point my advice is to create an image of your "C" drive. If anything goes wrong you can use a bootable media to restore the C drive to exactly the state before repair . There are several free tools available to do this. I recommend to use either 'Macrium Reflect' or 'Paragon Backup free'. Download links are below.

 

http://www.macrium.com/reflectfree.aspx

 

http://www.paragon-software.com/home/br-free/features.html

 

Both do have a feature to create bootable rescue media to restore the image if anything goes wrong. Rescue media can also be used to create the image by booting from CD drive.

 

Here is a couple of great video tutorials by 'Britec Computers' which explains how to use "Macrium Reflect"

 

 

How to create an image:

 



How to restore an image:

 

http://www.youtube.com/watch?feature=player_embedded&v=xuyD2Wm4y9Q


Edited by Anshad Edavana, 04 May 2013 - 09:30 AM.


#9 Popeye2000

Popeye2000
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:10:52 AM

Posted 07 May 2013 - 04:51 PM

Created an image almost effortlessly.  Thanks for the help.

 

I have been having a lot of problems getting the repair install going.  I have the Dell disc that came with the computer.  Is WinXP SP2 OS.  I tried repair install and couldnt get to 1% without having a ton of errors stating "Setup cannot copy the file: ..." A majority of them seemed like nvidia files, but they seem directed toward an nvidia IDE driver and nforce chipset (which arent on this computer). Then a bunch of other random .dll files were showing the same error, so I finally quit the repair.  I attemtped repair install with my WinXP SP3 disc purchased from microsoft, and got to about 90% install, and began getting the same message randomly.  most of them were form .htm and .jpg files, or help and support center files so I felt comfortable hitting ESC to skip those files.  I let repair install finish and allowed the computer to boot normally. Things seemed to go ok, loaded all the device drivers, entered WinXp key, but experienced several errors "An error occurred while copying file...".  Since this was during the "Installing Start Menu Items" portion of the install, I felt comfortable ignoring the file and continuing setup.  Did get a "permissions" error under the registering components portion, not sure what effect, if any, that has, but peculiar to say the least.  Then windows froze after install when indicating that it was starting my computer.  No ticks on the HDD light... had to hard reboot (power button) and windows loaded normally with the NVIDIA driver loading properly.

 

However now getting alot of "application failed to start because the application configuration is incorrect".  Pretty much happens when I attempt to run anything from "Run".  Also cannot seem to connect to the internet either through IE or Chrome.  Going to see if can install SP3 atop of the SP3 repair install and see if that helps things.  Will let you know how this progresses.



#10 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:08:22 PM

Posted 08 May 2013 - 06:39 AM

Hi

 

That errors you received are due to the incomplete XP installation. Your XP is in a half baked state with a lot of missing files. 

 

Follow this steps and do another repair install with SP3 disc.

 

1 ) Uninstall all drivers from 'Control Panel-->Add\Remove Programs" (VGA , Chipset , Audio, LAN etc)

 

2) Make sure the install disc you are using is in good condition. If you are in doubt make a copy and use that to install.

 

3) If you have a second system, borrow it's CD drive and use that for install. A drive with reading issues can also cause Can't copy file' problem.



#11 Popeye2000

Popeye2000
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:10:52 AM

Posted 08 May 2013 - 10:45 AM

Thanks for the note.  I tried to uninstall the drivers, but kept getting this administrator issue,  I attempted to do another repair install, same issues.  I decided to undo the repair install and revert back to my image, and started getting the same OS errors.  Read somewhere that is a C++ runtime issue and to uninstall all .Net installations (1.0, 1.1, 2.0, 3.0, 3.5, 4.0).  I couldnt do that either.  Couldnt do windows update... things were running really slow.

 

I booted back into safe mode, looked at the permissions for the c:/Windows folder, only to find all the permission unchecked for the "Administrators" group.  I gave full control permissions to the folder, verified ownership of the c:/windoes folder by the "Administrators" group, and rebooted.  All the original issues still remained (i.e. no nvidia adapter, and msconfig access denied error).  Im not certain where the permissions got changed.  Is it possible that may have occurred while creating the image?

 

I did repair install with Windows OS w/ SP3 without issue.  Computer booted normally, and the nvidia controller loads properly.  Re-ran all my malware programs from troubleshooting, nothing popped up.

 

The only issue remaining is the  access denied error for MSCONFIG.  Do I dare tempt fate and try to fix it?  If its just a MSCONFIG issue, I could care less.  But if its a broader permissions issue, Id like to take care of it.

 

Let me know what you think.



#12 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:08:22 PM

Posted 08 May 2013 - 11:56 AM

Hi

 

Glad to hear that you are able to solve most of the issues. The MSCONFIG error shows that there are still some issues remains. I think we can fix it by using the great 'Windows Repair All in one Tool". Before doing that create a new image of the C drive for safety as we don't want anything to go wrong. Name the new image 'After repair install' or something you like. Now follow the instructions.

 

A )If all areOK download 'Windows Repair ALL in One' from  http://www.tweaking.com/content/page/windows_repair_all_in_one.html

 

C ) Install and open the tool. Click next to continue. 

 

C ) Go to Step 4 and click on the Create button under System Restore.

 

windowsrepairstept4-1_zpseb336401.png

 

D ) Go to Start Repairs and click on the Start button.

 

windowsrepairstartrepairs-1_zpsa179850d.

 

E ) If it asks permission to backup registry, allow it to do so. Now you will see the main screen.

 

Click 'Unselect All' to remove default selection. Now select the following items.

 

Reset Registry Permissions

Reset File Permissions (C: )

Remove Policies Set By Infections

Set Windows Services to default startup

Restore important Windows Services

 

Now click 'Start' to repair. It may take sometime to complete. If it asks permission to restart, please allow it to do so.

 

Now check how system works.


Edited by Anshad Edavana, 08 May 2013 - 11:57 AM.


#13 Popeye2000

Popeye2000
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:10:52 AM

Posted 14 May 2013 - 11:17 AM

Anshad,

 

Thanks.  I tried the program, but it did not fix the MSCONFIG problem.  Any other suggestions?



#14 Anshad Edavana

Anshad Edavana

  • Members
  • 2,805 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:08:22 PM

Posted 14 May 2013 - 12:43 PM

Hi

 

Do you have any old model HP printer installed in your system ?. Some HP printer drivers are known to conflict with services and results in this error.


Edited by Anshad Edavana, 14 May 2013 - 12:43 PM.


#15 Popeye2000

Popeye2000
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:10:52 AM

Posted 17 May 2013 - 09:23 PM

Thanks for your continued support.  I did previously adjust registry settings for the Pml Driver HPZ12 setting is set to manual (3).  There were one or two HP programs installed, so I uninstalled and rebooted.  Still same error.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users