1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Cant boot in safe mode or normal mode, only with last good configuration

Discussion in 'Windows - General discussion' started by chrisk27, Aug 25, 2007.

  1. chrisk27

    chrisk27 Member

    Joined:
    Aug 25, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    11
    I hope someone here can help me. I'm not sure if I have a virus, malware or something else. But I'm having a problem similar to someone else who posted some months ago. When I reboot my computer it reboots automatically before reaching the windows logo. And then when it's back up it takes me to a window where I can choose to boot up in safe mode, normal mode or with last good configuration. I can't boot in either safe or normal mode, only with the last choice. I'm also having problems trying to run spybot and norton, but I'm not sure if they are connected or not.
     
  2. PeaInAPod

    PeaInAPod Active member

    Joined:
    Nov 28, 2005
    Messages:
    3,065
    Likes Received:
    0
    Trophy Points:
    66
    Get yourself a copy of HijackThis! somehow. Run it and in the resulting log file copy and paste that text into this thread.
     
  3. chrisk27

    chrisk27 Member

    Joined:
    Aug 25, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    11
    I have a copy of it. Here's the log.

    Logfile of HijackThis v1.99.1
    Scan saved at 12:46:27 AM, on 8/26/2007
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\Program Files\PopUp Killer\PopUpKiller.EXE
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\eMule\eMule.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Soulseek\slsk.exe
    C:\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emachines.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:6502
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\PopUpKiller.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Coast to Coast AM] C:\Program Files\Coast to Coast AM Media Center\Coast to Coast AM Media Center.exe
    O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
    O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/0636a4354bc1e900eb01/netzip/RdxIE601.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1138837164104
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1185445437515
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)

     
  4. PeaInAPod

    PeaInAPod Active member

    Joined:
    Nov 28, 2005
    Messages:
    3,065
    Likes Received:
    0
    Trophy Points:
    66
    Well theres nothing wrong with your HijackThis! log. Have you added any new hardware/software recently? When you go to the device manager are there are yellow exclamation marks?
     
  5. chrisk27

    chrisk27 Member

    Joined:
    Aug 25, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    11
    I went through device manager and I didn't see any exclamation points. And this problem started a few days ago, and I think I may have installed a program that kicked this off, but I can't remember. I forgot to mention that before my computer reboots, I quickly see a blue screen, but I'm not able to read it before it's gone. Is this significant?
     
  6. PeaInAPod

    PeaInAPod Active member

    Joined:
    Nov 28, 2005
    Messages:
    3,065
    Likes Received:
    0
    Trophy Points:
    66
    Yes the blue screen is signigicant. If you are able to read that and post what it says then I could tell you what it means and how to fix it. But since that is not possible and you say the only thing you have done is install software try removing whatever program(s) you think you installed and lets hope that fixes the problem.
     
  7. chrisk27

    chrisk27 Member

    Joined:
    Aug 25, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    11
    I did a search on how to disable reboot right after the blue screen, and rebooted the computer and this is what came up.

    A problem has been detected and windows has been shut down to prevent damage to your computer.
    PAGE_FAULT_IN_NONPAGED_AREA

    STOP 0X00000050 (0XFFA0D092,0X00000000,0XFFA0D092, 0X00000000)

    And then I try rebooting a few more times to see if the screen would come up again but it hasn't and a few times things booted up normally, though I'm still not able to boot up in safe mode. I tried to be as clear as I could.
     
  8. PeaInAPod

    PeaInAPod Active member

    Joined:
    Nov 28, 2005
    Messages:
    3,065
    Likes Received:
    0
    Trophy Points:
    66
    Well I have not been confronted by that screen in some time so although I believe I remembered the meaning I was not 100% sure. So I did a little bit of searching over a microsoft.com to find the answer, and find it I did. The reason for the PAGE_FAULT_IN_NONPAGED _AREA STOP 0X00000050 occurs when "requested data is not found in memory. The system generates a fault, which normally indicates that the system looks for data in the paging file" it goes on to say that " 1)Faulty hardware, 2)a buggy system service, 3)antivirus software, and a 4)corrupted NTFS volume can all generate this type of error." I added the numbers so I could post corresponding ways to fix them. So starting with...

    1)Faulty Hardware-If you have recently installed any type of hardware be it RAM, Video Card, etc. The Microsoft states that the problem is "usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM". After removing hardware reboot to see if you still get the blue screen error. Also, if the hardware you remove is a part needed to boot the system (like if you only have 1 stick of RAM), then you will of course need to replace this piece of hardware.

    2)If you installed any softare right before you started having these problems uninstall these programs.If any programs were installed that also installed a system service(you probably wouldn't know if the program did or didn't) then uninstalling it would clear up the problem. Also download and run CCleaner in "Issues" mode to remove registry entries from the uninstalled program.

    3)If you have antivirus software, temporarily remove the program from your startup list. To do this click Start, then Run, and type in msconfig. After doing this navigate to the "Startup" tab and uncheck and entries related to your antivirus software.

    4)Microsoft does a good job explaining this one. Heres their solution...
    Note to run Chkdsk you must click on start and run like before but instead of typing in msconfig type in cmd and hit enter. In the resulting black box type the Chkdsk like shown above.

    Lets hope this fixes it :)
     

Share This Page