[jrs9191]

My OS is XP MCE. I just finished cleaning this system of malware with some excellent assistance from geekstogo member Rorschach112. I don't know if this problem was caused by or has anything to do with this process. I also never had a need before this process to ever boot into safe mode on this system so for all I know it could have been like this from the day it came out of the box. When booting into safe mode the initial process seems to go OK (it brings up the advanced options screen, you select safe mode, then another screen comes up and you select your OS) then a screen comes up where a list of drivers seem to be loading and at this point the system hangs for 14 minutes (give or take 15 seconds). The last line on this screen when the system hangs is "multi(0)disk(0)rdisk(0)partition(2)\WINDOWS\System32\Drivers\Mup.sys". I have no idea whether this has anything to do with the problem or not. If anyone knows anything about this or wants to take a shot at solving this problem I would greatly appreciate it.

Thanks, John

P.S. I should add that it takes 75 seconds to boot into normal mode and 40 seconds to shut down from normal mode.

Edited by jrs9191, 01 August 2007 - 06:40 PM.

[Advertisements]

It does take a long time for safe mode to boot, but I agree that 19min is exceptionally long time. Do you have to the actuall xp install cd?

[starjax]

It does take a long time for safe mode to boot, but I agree that 19min is exceptionally long time. Do you have to the actuall xp install cd?

[jrs9191]

Hello starjax,

Thanks for your response! No, unfortunately I don't have the original install CD as this is one of those systems that came new with a restore from the hard drive type setup. I do, however, have an XP install CD from a different system if that would help or could be used.
I find it particularly unusual that it should take so long to boot into and shut down from safe mode when the times to boot into and shut down from normal mode are so quick (normal).

Thanks, John

[The Skeptic]

When you boot in safe mode windows uses a set of drivers which are not used in normal bootup. It is possible that one, or more, of these drivers have been corropted by malware or during malware repair. My advice is to leave things as they are if there are visible problems in normal mode.

[jrs9191]

There were "visible problems" in normal mode before the malware removal process (popups, redirects, slow boot times, etc.) but now seem to be running pretty smoothly in normal mode. I don't really know if I have any problems in safe mode other than booting into it and shutting down from it. I guess in reality this would not be a hard problem to live with because I really don't have a need to be in safe mode. BUT, if I were to get infected with malware again or have some other need to get into safe mode it would be a pain. Is it possible to reload all the safe mode drivers (after making a backup of course)? Is this even advisable? Any other ideas?

Thanks, John

[The Skeptic]

Hi jrs9191.

I think that you can consider yourself lucky to escape with such minor problems after a bad malware infection. My opinion is that things should be left as they are but if you want to try to repair this you need XP installation cd of the same version that is installed in you computer (Professional, Home, with/without sp2). You may borrow one if you need. Insert the disk into the drive and click Start > Run. Type sfc /sannow and let the repair process go all the way. When it ends the dialog box just disappears. Take the disk out and try to boot in safe mode.

[jrs9191]

Thanks for your response.

What is sfc /sannow command?

Is there any real risk to trying this?

Thanks, John

[The Skeptic]

SFC stands for System Files Checker. It's a process that installs or repairs missing or corrupt system files. It's a safe process compared with the other option, xp repair installation, which I would not recommend.

[jrs9191]

Thanks for the info.

I will try this tonight when I get home from work (yes, I am being bad checking the forums while at work) and post the results.

John

[jrs9191]

O.K. Another question, I have another system with the same OS (XP MCE) and have the installation DVD but on the DVD it says, among other things, "The software is already installed on your computer. Only use this DVD to reinstall the operating system on a Dell PC. This DVD is not for reinstallation of programs or drivers." The system I am trying to repair is an HP. Can I use this DVD to attempt the repair using the sfc /sannow command that you recommend?

Thanks, John

Edited by jrs9191, 08 August 2007 - 07:22 PM.

[The Skeptic]

I am not sure. Where I live very few brand name computers are sold. The vast majority are generic with a retail XP. This approach is much better, in my opinion. When you deal with brand names there are modifications made specifically for their computers and I am not sure how how using Dell will affect HP. I would like to take the advice of other techs on this forum.

[Major Payne]

I would recommend not using the Dell on an Hp and vice versa. These are manufacturer made specific disks which more then likely writes to the boot sector of your hard drive preventing an intermix. Some will run and detect the difference and will pop up an alert box telling you that you can not proceed and why. Other reasons may apply, but I don't remember them off-hand. I'm sure the other techs will post better info.

Ron

[The Skeptic]

Thanks Major payne, hi jrs9191.

Attached is the opinion (full quote) of Keith, Tech administrator.

If the disc he has is capable of installing XP, it should have enough to run sfc

There is this option if he can borrow a same version XP CD

You will need to get your XP CD and locate the folder called:

I386

copy this onto your hard drive into the system root. For most, that is going to be C:\ so you will create a C:\I386 folder

When you have created the folder:

Click start then run, type regedit then press enter, locate the following key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

You will see various entries here on the right hand side. The one you need is called SourcePath there may be two similar keys, it is the 2nd of the two, source path

It probably has an entry pointing to your CD-ROM drive, you need to change it to C:\

Simply double click the SourcePatch setting and a new box will pop up allowing you to make the change.

Reboot the PC and run sfc /scannow

[jrs9191]

Hello and thanks to all who have contributed to this answer. I will try this when I get home tonight but I have a few questions.

1. I assume that I can substitute DVD for CD in all instances in the instructions. Is this correct?

2. How do I locate the I386 folder on the DVD?

3. "It probably has an entry pointing to your CD-ROM drive, you need to change it to C:\"
"Simply double click the SourcePatch setting and a new box will pop up allowing you to make the change."
I'm not sure I understand this instruction (I also assume it is SourcePath not SourcePatch). Any additional help here would be appreciated.

4. Is the command to run sfc /sannow or sfc /scannow ?

Thanks, John

[Retired Tech]

1. Yes

2. Load the CD but cancel any autorun, click start, my computer, right click the drive which has the CD in, click explore

3. Post back when you have the machine in front of you

4. sfc /scannow (with the space)

I would try sfc /scannow first