XP will not boot in safe mode but will in normal setup

Question

This one has me stumped. My XP Home-equipped Dimension 4300S will NOT run in safe mode but it will in the normal startup. That is just the opposite of what is supposed to happen; ii.e., you use safe mode to start when the regular startup won't work.

I want to go into safe mode to see if I have a DSO exploit or if Spybot will work differently in safe mode.

I have done the following:

1. Defragged the system.

2. Run Spybot, Ad-Aware and Spy Sweeper to get rid of spyware and adware

3. Run Trojan Hunter to look for trojans

4. Run a registry cleaner as well as Norton to find any obvious registry problems.

5. Booted to the Last Know Good Configuration

6. Did a through virus scan with eTrust

In short, just about every thing I know how to do and I can't operate in safe mode.

I have been thinking about running a repair (re) installation, but one time last year I did that and it stalled about halfway through and I was forced to do a complete reinstall and I hadn't made backups.

I know the adage may be "If it's not broke, don't fix it" but something is wrong. The system is sluggish and I think it will die eventually.

Any ideas?

dunedin · Answer

Hi,

Here's a work around:

Start->Run->Msconfig->check the "diagnostic startup" button

Don`t know why you can`t access it. Do you suspect you have undetected spyware etc?

If so try running

Hijack This http://www.majorgeeks.com/download3155.html

Make a special folder to download it to. Set it to "Scan" and then to create its "Log". This will be long, but copy all of it into Notepad and post it to be checked.

Fender124C41 · Answer

I tried the diagnostic startup and I STILL can't boot into safe mode.

Here's the HijackThis log:

Logfile of HijackThis v1.98.2
Scan saved at 11:12:17 AM, on 9/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\ca.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Art Plus\Wallpaper5\wallpaper.exe
C:\Program Files\Spyware Doctor\spydoctor.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\VetMsgNT.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Louis F. Fryzel\Desktop\HIJCKTHIS\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\CA\ETRUST~1\ETRUST~2\ca.exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.0\THGuard.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Art Plus Wallpaper Calendar] "C:\Program Files\Art Plus\Wallpaper5\wallpaper.exe" /a
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Matrix Screen Locker (s).lnk = C:\Program Files\BaroufaSoft\Matrix Screen Locker\matrix.exe
O8 - Extra context menu item: Download using Download &Express - C:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

Any suggestions? Anybody? I really can't remember when I last used the safe mode. It may have been before I downloaded and installed Microsoft's SP2 two weeks ago. I now have it on disc. However, everything else seems to be working fine. The only software problem I found was with Nero and I downloaded an update that patched that.

As I said, I'm really stumped. I can't find this error anywhere on the .Net and I would appreciate any help.

jjbuckaroo · Answer

I have the same problem on one of my desktops. Cleaned installed it even and it still locks up when booting to safe mode at mup.sys. Works if I install windows 2000 on it. Not sure what the deal is with that either.

Fender124C41 · Answer

Thanks, I know about the bug in Spybot 1.3. I tried the safe mode because SpyBot came up with seven DSO objects while the bug shows five. By the way, I rescanned with Spybot and I am back to the five. Spybot 1.3 also has another bug it that if you also run Spyware Blaster it will detect FindItNow (or something lilke that) and when you remove it it also removes it from the Spyware Blaster protection. I don't want to try a beta because I tried a beta before and it messed up and stalled and I had to use system restore and get rid of it.

No, my question remains why can't I use the safe mode?

JRosenfeld · Answer

Depending on the version of Spybot and updates, DSO exploit showing up in its scan was a bug. There are long posts about it on the Spybot forum.

http://forums.net-integration.net/index.php?showtopic=17159

Also one in the beta forum, but just when I want to post the link the site appears to be down

Current vesion is 1.3, but you couold try the beta 1.3.1. If you have 1.2, download 1.3 from

http://www.safer-networking.org/en/download/index.html

Uninstall 1.2 before installing 1.3. If you have 1.3 and want to try the beta, in advanced mode, settings tab, settings, under web update check display availabloe beta versions, then check for updates, they'll self install. The latest beta updates have other bugs, but not the DSO exploit.

Got bck to net integration, the othe post on DSO exploit is

http://forums.net-integration.net/index.php?showtopic=21462

Message Edited by JRosenfeld on 09-10-2004 06:12 PM

Fender124C41 · Answer

JRosenfeld,

Thanks a lot. I do have InCD, the same version. And I had problems with it some time ago. When I installed SP2 it did something to my Nero Express program so the Nero site had an update that was supposed to take care of that product, and it di. While there, I also updated the INCd part so I will try to revert to the INCd that I have.

If this does work I will send a message to Nero.

This is probably the cause. I will let you folks know eventually.

JRosenfeld · Answer

One person reports the same in MS Newsgroups

http://communities.microsoft.com/newsgroups/default.asp

Windowsxp.help_and_support, 10 Sept "Joe Fardella"

Hi, after installing SP2,l have not been able to get my computer to reboot
into Safe Mode,I do not know if the two are related or not,does anyone know
of a fix for this problem?

Reply was

I experienced the same problem after installing SP2. My culprit was
Nero's INCD version 4.3.0.0. I uninstalled it and went back to an
earlier version and now have a working SP2 safe mode!

Don't know if you have anything similar installed?

Fender124C41 · Answer

That was it. I uninstalled INcd 4.3.0.3 and I now have safe mode back. Tomorrow or soon I will reinstall my older version, which is 3.something. I also uninstalled Easy Writer or Easy Reader, which is a similar product. Perhaps the latter is the real culprit but I think it is INcd because I had problem once before when I upgraded to a newer version, not 4.3.0.3, and it just caused my computer to freeze.

Thanks, JRosenfeld, for your help.

I have sent an email to Nero techies so I will see if anything happens.

JRosenfeld · Answer

Glad that perusing newsgroups as a displacement activity from work has paid off on this occasion:-)

Fender124C41 · Answer

Just as a followup, I received an email today (Thursday, Sept. 16) from Nero tech support saying they already knew of the problem and an update should be available Friday (Sept. 17) at their site. Since I uninstalled INcd I haven't had any problem so I will wait for the update.

Thanks again for the help, folks.

Windows General

XP will not boot in safe mode but will in normal setup

Was this post helpful?