[grandpa]

Hi

I wonder if anyone can help please.

Just lately Ive had to start my computer using F5 key and then clicking on Last Known Good Config. This is the only way I can get everything to work. If I use normal bootup all goes fine until I try to use the desktop, nothing will work. I notice that the little Avast icon down the bottom left corner stops spinning and the firewall dosen't load. Evertything just seems to freeze. I have absolutley no idea what to do.
I have run virus and malaware scans. Nothing shown.

Running XP SP2 & 3, Threat Fire, Avast.

Hope this all makes sense.

Any help please.

Kind regards

Grandpa

Edited by grandpa, 20 September 2009 - 01:36 PM.

[Advertisements]

Have you tried opening the task manager via Ctrl+Alt+Delete and then ending Explorer.exe
Then restarting it in "New task"

[Wander]

Have you tried opening the task manager via Ctrl+Alt+Delete and then ending Explorer.exe
Then restarting it in "New task"

[grandpa]

Hi

Thanks for that.

Unfortunately when I boot up normally, nothing on the desktop works. So I am unable to use Task Manager.

Thanks

Grandpa

[Wander]

It sounds like everytime you load back to your good configuration, something is causes a change to your registry to render it unusable again.

Download and extract Autoruns

Run "Autoruns.exe"

Click on File > Save > Save the file and attach to your next post.

[Wander]

Woops, sorry the above method generates a 5MB file which is too large to attach.

Try this instead:

Download HijackThis

Run it and when you see the new window, go on "Main Menu"

Next click on the "Open the Misc Tools section"

Now go on "Generate Startup List"

Copy and paste the log here.

[grandpa]

Hi

Thanks for that. Here's the log hope it shows a solution.

StartupList report, 21/09/2009, 10:17:54 a.m.
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP3 (6.00.2900.5512)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\TCASH4\TCASH4.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ThreatFire = C:\Program Files\ThreatFire\TFTray.exe
00PCTFW = "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
avast! = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - (no file) - {4A368E80-174F-4872-96B5-0B27DDD11DB2}
(no name) - C:\Program Files\Java\jre6\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Ad-Aware Update (Weekly).job
AppleSoftwareUpdate.job
GlaryInitialize.job

--------------------------------------------------

Enumerating Download Program Files:

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\LegitCheckControl.DLL
CODEBASE = http://go.microsoft....k/?linkid=39204

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\wuweb.dll
CODEBASE = http://www.update.mi...b?1206433057031

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\Config.Msi\28c6e.rbf|||s

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

--------------------------------------------------
End of report, 5,082 bytes
Report generated in 0.547 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Many thanks

Grandpa

[Wander]

I suggest you try and find your XP installation CD if you have one.

If you do then follow the repair instructions here written by admin.

[inapaler]

if you can boot to safemode try uninstalling your video card driver. I encountered same issue which was solved by uninstalling and installing the vc driver.

I hope that is your only issue.

[grandpa]

Hi

Im a bit thick, may sound silly. But where do you unistall video card.

I wonder if an old system restore might do the trick.

Also, is there any way you can do a repair, without the disc, as weve just moved house, and goodness knows where the XP disk is.

Cheers

Grandpa

Edited by grandpa, 21 September 2009 - 08:47 PM.

[Wander]

A system restore may possibly do the trick.

To uninstall a driver:

Go to Start > Run

Type in devmgmt.msc and hit enter

Expand the tree of the particular driver you want to install.

Right click on the device and click uninstall