Solved: Very Odd Situation with XPSP3 booting to Black Screen (diff than my search re

[Mike82]

Hey guys long time no see. I always come here when I am stumped and I am always helped, for this I can't thank you enough! So I do like modern operating systems and recently set my parents up with Windows 8.1 and it is awesome, however my personal computer is a Dell XPS-400 with XPSP3 with 3GHz processor, 2GB ram, 320GB hard drive and nvidia gforce6800 that I paid dearly for when I got done with college in 2006 and am still inlove with it. I have every thing exactly how I like it and it still does everything I want. I also have an iPhone 4S from when they first came out in 2011 that works great and I still love(but planning to do a new battery next fall at the 4 year mark) and i still purposely run ios6.1.3 on. I just have always had a hard time letting go of thigs i treasured and researched before purchasing till I have to, for this I apologize as I do realize I'm behind the times. Ok so something very odd happened twice in the last 3 weeks and it doesn't match what my search has turned up. I read through various posts of similar problems to see if I could spare you guys this post but felt the need to explain better. By the way I recently purchased Acronis True Image (about a year ago) and cloned my hard drive to a fresh identical OEM Western Blue 320GB and also made a full image on an external seagate and boot disc just incase. I did this after a error check/defrag/cleanup session and when she was in her prime (the day XP support ended actually, then redid when they let through that final extra fix) This was my zero day protection lol. I run Norton Antivirus also as a few years ago I abandoned the original McAfee when it started giving me trouble. Ok here's how it went down.

About 3 wks ago I had Norton pop up it that it had successfully quarantined an intrusion attempt (can't recall the details but it took it about a minute to work but reported successful removal). This happened while Mozilla Firefox was trying to update but I figured all was fine and shut down without trying anything. The following night I turned on the comp and walked away to give her time to boot then came back to a black screen and a white responsive cursor. I said oh boy probably needs rebooted. I tapped the power button and got no response. So I held the power button till power was cut. I then powered her back up. That first black screen (bios screen? Sorry I'm amateur lol) which says press F2 etc came up then the colored screen saying starting Windows XP! I though sweet! No issues. Next the screen went black but rather than the desktop coming up within a few seconds up came a white cursor and there I was in a panic! I repeated twice more with same results. "Windows XP starting" changes to a black screen with a responsive white cursor. So I tried again and stopped her with F8 and chose safe mode. Same problem black screen with responsive cursor. Repeated again and chose boot from Last Known Good Configuration and it worked perfectly!! Everything was back to normal! Working perfectly fully functional so I shut down and rebooted normally and got black screen and responsive moveable cursor again :-(. Hard rebooted again and hit F8 and booted from Last Known good config. Went to system restore and chose a restore point of the day before. It went through the restore but failed and said unable to complete restore and went to the black screen and cursor again in same pattern after "starting windows xp". Being persistent I repeated 3 more times going back a few days farther each time and had no success. Restore would not work. So I rebooted again with Last Known Good Config., then created a restore point of that, then restored to it. Viola! Perfection it worked perfectly and computer would bow boot on its OEM with complete functionality as normal. But thats when i noticed Mozilla Firefox would not run, as soon as I clicked the icon it said "bootlog not found" or something along those lines. So I uninstalled and re downloaded it and the. It worked perfectly and the comp was back to normal at last! Over two weeks passed with perfect boots each night. Then lastnite... I came to the same issue again after probably 15 successful boots! So after two hard shut downs, I immediately repeated my successful fix of going to Last Known Good Config, making a fresh restore point and restoring to that. It worked and now all is well again except I'm pretty worried if there is an underlying hardware issue or something corrupt in the software.

My question therefore is what is causing this and why did it happen again? I haven't dug out my OEM windows disc or any of my Acronis arsenal i made last spring after XP support ended, but have those if I need too. I am hoping that by bringing the issue to the forum now I will be able to prevent anything worse from occurring before it does. I'd love any input I truly appreciate all you time and expertise and want to thank you guys very much ahead of time! And thanks for reading my post, I'm sorry it was so long I just try to be very detailed from the start.

Thanks Again,

Yours,
Mike T

 

[Mike82]

Hey there again guys, i wanted to edit this post to add that it just happened again tonight and i had to boot using Last Known Good Config and then make a restore point and restore to that. It seems to be happening every dozen or so boots. The computer def seems slow to boot as well, and there is an unusually long hang time between the Windows XP screen and the "windows is starting" screen where the screen is black. This is the exact point at which she hangs when she does and i have to do those steps. Sorry for such a long post, and thanks again ahead of time.

Second Edit - First off I wanted to apologize for my first post being long and I want to let you know that I am not trying to double post I wanted to edit the first one and cut most of it out as I feel I was over detailed but the edit option seems to be gone after a certain time which makes sense. Thanks for your time for those that read it and even if I don't get answers it is totally cool It's such a bizarre situation though but I guess a summary could be intermittent locking up on a black screen upon loading Windows XP about every 10 times. And unable to boot in safe mode even when this happens, however last known good configuration works each time then I create a restore point and restore to that point. Then I am good for about another dozen boots and she finally hangs again between the windows XP screen with the sliding blocks that it does when booting and the blue screen that says "starting windows" or something to that matter. It seems like that black intermittent screen was always there but not for almost 10 seconds as it is now you can tell something is going on during that boot up sequence that shouldn't be during that black screen you can hear the speakers come on and the hard drive clicking away, but when she locks the hard drive quite clicking rather than the hour glass and proceeding for he blue screen. I am assuming that it is preparing certain things during this time and something isn right that intermittently trips it up... i am a beginner so I am just guessing Just hoping that the experts can point me on the way to fix it. I'm on sure if i wnd up having to use the Acronos images I made if that would even fix it or if it's somethings thats behind the scenes that I could somehow take a log of the processes and post for you guys to analyze like you did for me a couple years ago and fix the problem directly. Once again I truly appreciate everything! You guys are great! I truly don't mean to be a pain in the butt so I apologize! Any logs of start up or anything if you tell me how to do I will gladly post here. All help gladly appreciated and I won't post mod this anymore, thanks for being patient, I'm sorry for being too detailed sometimes.

So Quickest Breakdown-
Computer began hanging upon bootup at the intermittent black screen between the "Windows XP"with sliding bars and the blue "Windows is starting"/"welcome"screens". It does this every 10 or so boots and when it does it will only turn off to hard power button hold. It will not boot to safe mode as it does the same exact thing. The only workaround is to use last known good configuration then create a restore point and restore to that point then I am good for about 10 more times. This happened the first time roughly a month ago upon bootup a day after Norton had detected and quarantined some sort of intrusion at the same time Mozilla was trying to update and I had to reinstall Firefox.

 

[AtlBo]

Mike82...

Can't escape the thought that whatever malware Norton quarantined could have caused the problem. Sometimes, malware can be caught but may have done some damage, already, or part of it may remain to cause intermittent problems.

If you haven't been through the virus and malware removal procedures here, I recommend going over to that board here at TSG. I would say run sfc /scannow, but, if your PC still is still harboring some malware, any fixes made by sfc /scannow would likely be reverted by the malware.

Just for the record, malware can persist in restore points. I don't think this is your problem. If there is malware on the PC still, it's probably associated with the malware caught by Norton.

If no malware is found on the malware board, I do recommend then proceeding with running sfc /scannow from an administrator's command prompt...

 

[Mike82]

Thank you so much, your advice gives me some direction now! I will do exactly as you advised and report back here. It will be neat to see after 10 years if there are traces of malware on the computer and such and I agree something fishy started happening with the slow boot times after that incident recently. I was thinking possibly the antivirus could not get it all or in time. But I am not very computer smart but it seemed to make sense something went wrong and was not caught in time. The fact that it is intermittent and not acting perfect it behaves as if it were damaged but not terminally if you know what I mean. So your advice hits home now that I know that is possible to happen! I did not know that was possible like a sick person a virus can leave damage lol. Okay so I will get right on that and then system file Checker I have a question should I do that anyway? Is any harm done or files lost, I did not even know about that function? Either way though I see what you were saying I should address the malware first but is system file checker something that should be done regularly as I've never ran it. Thanks so much for your time, I greatly appreciate it!!!

 

[AtlBo]

Mike82...
You're welcome.

Yes, malware is sometimes complicated to catch before it causes damage. Some of it is complex enough to function in multiple independent parts. For example, it could be that you had some sort of ransomeware malware that was designed to show you a lock screen telling you to send money in exchange for freeing your PC from a lockscreen. Not that this is the case, but your a-v could catch onto a file of the malware and partly block its functionality, while there is still an element of the malware causing symptoms such as you have been seeing on your PC.

sfc /scannow is a great tool. You can run it any time, and it will repair many times the structural damage caused to an OS by malware. If there is a problem, running sfc /scannow will almost always get you much closer to a resolution of the problem if it doesn't completely finish the fix. It really makes sense to see if you still have malware before you run sfc /scannow, however. This is because most malware has a time trigger or runs on boot, etc., and it will continue to start and repeat the steps it goes through to damage the OS over and over on its schedule or at each boot, however it is set to run.

There is a command you can use to get the sfc log output placed on your desktop. Once you run the utility (wait for it to finish), type the following at the command prompt (or paste it there) and then hit enter:

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

The file is called sfcdetails and it is a plain text file...

 

[Mike82]

Awesome! You know what I truly think that there is something doing just like you described because when I got it up and running and then entered safe mode it asked me a few times with different functions I went through that I was denied because I am not the administrator… I am the only user on the computer and did set administrator rights! Then when I would click the function again it would go through. For example creating a manual restore point it said denied you do not have the rights you are not the administrator… Then I clicked it again and it did it. I have never run into that before this incident. This is so interesting! I'm at work until 11 PM so I won't be able to work on this until tonight but I am pretty excited.

 

[AtlBo]

Mike82...

Sounds like something may have messed with your administrator rights on the PC, possibly along with some other elements of the OS. If you can run it, sfc /scannow should at least catch the problem(s).

On admin privileges, unless you set up an account that doesn't have admin privileges after installing XP and then set the PC to boot into that account, your boot account should have admin privileges automatically.

I wouldn't worry too much. There are several things you can do if sfc /scannow won't run or isn't able to perform all of the fixes, especially if you have an installation disk for your version of Windows XP. That would include the XP Service Pack, too. Assuming you are on SP3, you would require an installation disk with SP3 included to perform some types of repairs from the disk.

 

[Mike82]

Ok cool thanks man. I don't believe the original disc had sp3 on it but could be wrong. I purchased the computer in June 2006. Tonite I'll visit the malware forums as well as run sfc/scan now just as you said and hopefully that will all together solve the problem. I have made little changes since I purchases and used Acronis to make an Image of the computer to an external Hard drive last May, which is something i did since the computer is so old, however I'm not actually sure how to utilize it or if that could be used to my advantage to solve the problem. Do you think I would be best off fixing the problem as we're talking of through sfc/ scan now and malware searching rather than using that image I made in May? I apologize that I am not more knowledgeable, sometimes I do things but don't research on how to utilize until the problem actually occurs.

Edit- I just googled and saw that SP3 was released in April 2008 so my original disc would not have it being the XPS400 was purchased in June 2006. However I now remember that along with using the Acronis True Image 2014 last May to clone the internal OEM Western Digital "Blue" HDD to an identical 320GB new Western Blue using a USB/SATA dock, made a full disk image to a Seagate modern 1TB external drive and I believe I also made a bootable disc I wonder If that would actually have a copy of XPSP3 on it, I'm thinking no as its probly just bootable media incase I can't actually get to the desktop to launch the program... Hopefully I don't haveta take it to that point but curious.

 

[AtlBo]

Mike82...

Restoring the image would probably be the simplest way to go about quickly restoring the OS. However, you will have to reinstall any programs that were installed after you created the image. Also, programs that have been updated since that time will require updating on your PC again. Also, keep in mind that your files will not be up to date as far as backup goes. If you have pics, vids, music, spreadsheets, or any other files that are important to you, they will be restored just as they were when the image was created a year ago. Any files created since then will not be in the image at all.

You can always copy your current files over to a USB drive if you would prefer to go the image route. Then you can restore them once the image is written onto the drive. Otherwise, the best course of action is to go through a malware checkup and then start with sfc /scannow to repair any damage malware may have caused.

The only issue I can think of with restoring the image would be that part of it is missing, since it has been around for a year. This is not likely, but, on an old drive, it can happen that a sector or some sectors on the drive that were containing part of the image go bad. The restored image could then malfunction potentially. Again, this is not very likely, but you can run a chkdsk /r on the drive containing the image before restoring. chkdsk /r will repair damaged sectors if possible and save the contents of the damaged sector. It will also mark the sector as damaged, so that it won't be used again. If chkdsk /r repairs anything it might find, then there is basically 0 risk that the image will not boot into Windows.

Post back once you have decided what to do or if you have any questions...

 

[Mike82]

Oops I added an edit before getting your reply so gonna read your latest reply now!

 

[AtlBo]

Mike82...

If you have a clone of the drive on another drive and if the clone is a bootable one, you could simply place that drive in the PC and boot from that drive. A clone could be described as a restored image, being a bit for bit copy of the drive contents. An image is encoded (like a zip file/folder), so that back ups of a drive will use less space. While an image is not bootable until it is restored, a clone is immediately bootable. There are non-bootable clones, also, which require restoration.

The bootable CD/DVD disk you created last year was probably the restore disk for the image and/or clone you have. You boot to the bootable disk and then there should be a restore option. Select restore and then you will be prompted to select the image to be restored. You may have some questions about this, but it's very straightforward. If you have the option to restore the MBR of the backed up drive you are restoring, just make sure it is selected along with the drive to be restored, probably called C. If the option is not present to select the MBR, that's usually because the imaging program restores it, automatically, along with the contents of the main drive. After this, just select the output drive, which should again be C. Restoration of an image takes usually between 15-30 minutes up to maybe 45 minutes+, depending on hardware capabilities and amount of data being restored.

Assuming the cloned drive is intact and bootable, you could replace the current drive with it and then use the current drive as a backup drive. With the current drive in a slave position, you could boot into the cloned drive and grab your files and place them on the cloned drive you would be now using for booting into Windows. Then you would need format the slaved drive (the one with the malfunctioning OS installation) if you want to remove the current installation. It would probably be a good idea to do this if you aren't going to go through malware removal. Malware can potentially spread from one drive to another, and it does appear to me that your current main drive/OS could have some remnants of malware.

 

[Mike82]

PHENOMINAL info man thanks so much!!! I truly appreciate all this and think I now have a decent arsenal of knowledge to try and conquer this. I think tonite I will begin with malware treatment then do the sfc/scan now and quit there if it works. If not try the image and first transfer the pictures I have since then and my favorites list to a thumb drive (only changes since a year ago minus program updates lol). And if that doesn't work then swap out identical WD drives as you said! One question though, I just ran into an IT guy out of freak chance 5 min ago here at work (am an xray tech and a windows 7 comp was having issues that's what they run here) and after saying XP was the best but yelled at me for still running it as a security risk (i may event modernize and keep this guy running for offline stuff) and laughed I was able to talk semi intelligently based on what you taught me and he agreed 100% on what you said to do and also recommended something free like CCleaner I have called "Malware Bytes" and said that should find the malware prior to using the sfc/scan now. My question I did not want to insult him but what do you think about that program and should I go to the malware forum here as a better choice or do both? Thanks so much again man!

-Mike

 

[AtlBo]

Mike82...

No Problem.

Malwarebytes is fine, but the experts here will be able to see if there is/has been anything unusual on the PC. I recommmend keeping Malwarebytes' on the PC, and you can use it later, but this once I think it's a good idea to get checked out. Up to you, of course.

Running CCleaner would be a good idea one time. I would say not to use the registry cleaner portion of the program, but, if you want to deep clean once, CCleaner is a good one to choose. Definitely wouldn't use it over and over for anything but removing temporary internet files (cached internet files) and windows temp files. Much of what CCleaner deletes are actually kind of useful, like the contents of history additions to textboxes (where you can see what you have typed before in a particular text box). Also, things like blue screen minidumps can come in handy if you have a problem...things like this.

BTW, this reminds me. If you are going to use CCleaner one time to deep clean, take a look in the C:\Windows folder and see if there is a file called MEMORY.dmp. It will be the same size as the amount of RAM you have and can be always safely deleted for the typical PC user. Minidumps contain the most important of the dump information on your PC and are almost always enough to solve a bluescreen problem. Anyway, I have NEVER seen anyone use MEMORY.dmp to resolve anything, and what's inside would likely be from a memory dump many months or years ago. I have CCleaner set to automatically remove MEMORY.dmp if it is present in the Windows folder...just a thing with me, but why have 2 GB or 4 GB or whatever tied up in an unnecessary file. I don't think CCleaner will remove the file by default, although it really should.

One other thing. I would avoid removing prefetch data with CCleaner. XP was the first OS to use prefetch, and the prefetch data is used to make the OS use memory better. I believe CCleaner is set to remove prefetch data by default.

On your cloned drive...put it in and see if it will boot. If it is a bootable clone, it should boot right up. If it is a restorable clone, you will have to restore it using the restoration boot disk, or you can alternatively restore the image you have. Either would accomplish the same thing.

 

[Mike82]

Thanks again man! Ok I do recall now on Acronis I did check the box to make the media bootable I remember that pretty clearly. Another thing I just learned from you and now I'm a bit worried, I use CCleaner prior to every shut down and also use the registry function once per month. And just by luck I did it Friday and I haven't had a lock up since then. Crap, hopefully the malware forum guys can still help me. I just read the rules over there so tonite I can download that logger program and post the results with the thread in my first post there. I will do that prior to downloading Malwarebytes and also prior to running sfc scan. So my action plan is go home, run that logger, post there and wait for results. Then download Malwarebytes and finally run sfc/scan. Of course along with recommendations given on Malware forum.

 

[AtlBo]

Mike82...

Another thing I just learned from you and now I'm a bit worried, I use CCleaner prior to every shut down and also use the registry function once per month. And just by luck I did it Friday and I haven't had a lock up since then. Crap, hopefully the malware forum guys can still help me.

This shouldn't be a problem. No worries there. I think the staff at TSG recommend against registry cleaners, but if there was a time to use one one time, I think you are in that situation, and CCleaner is the safest for sure. I even have used a registry cleaner once in awhile, but I steer clear of it anymore as it seems to me unnecessary in the big picture.

Actually, for the record, I use Comodo Programs Manager v1.2 to get rid of registry entries left behind by uninstalled programs. Revo is the one used by most people, and it is very good, also. I just got started with CPM and stuck with it. I have very limited experience with Revo, but I haven't ever heard of a problem with the program. Anyway, uninstaller programs are the extent of my tinkering with the registry. Some of these can be dangerous, too, so I do recommened reading up on how to use one before doing so. Revo is the only one I know of that I would recommend other than CPM (the version I use is not current and there are some quirks with the program, so I don't recommend CPM very often).

Sounds like you have a good plan. Once you have competed the virus and malware thread, post back and let us know how it went and/or if you have any questions...