[sruliwolff]

I have an interesting scenario on one of my clients machines.

They had a bunch of malware on one of their computers which we cleaned no problem, there was one issue with one of them (Vundo) which gets itself in the winlogon portion of the registry which we fixed using Atribune's Vundofix tool.

That was all fixed about two weeks ago and the computer ran fine till last Friday.

As of friday when the computer is switched on, it boots into normal mode (screen resolution is fine, programs are starting in the taskbar) but most of the services were not running, when I tried to start them manually it says error 1084: cannot start in safe mode. The virus scanner obviously isn't running because the services aren't.

I even tried running a windows repair (inplace upgrade) using the xp sp2 cd but it did the first portion (copying and seting up some of the files) but now everytime it boots it tries to finish the installation but it says it cannot continue in safe mode you have to boot into Normal Mode, but it is in Normal Mode.

Computer running Windows XP Pro sp2.

Has anyone come across this before?

Any help is appreciated.

Thanks

Sruli

[sorinso]

Hmmmm...
Have you checked the Event log?
What will happen if you DO boot into Safe Mode, and then do a normal restart again?

[sruliwolff]

The only thing in the event viewer is the event of the services trying to start at the bootup and some COM errors with the following error:

The COM+ Event System detected a bad return code during its internal processing

Sruli

[sorinso]

Try to boot in Safe Mode and then Restart in Normal Mode.

[sruliwolff]

Tried booting into safe mode and then back into normal mode, but nothing changed.

I then tried running a repair on Windows XP, but the second stage of the repair (after the copying it boots into windows and resetups all the drivers and windows files) wouldn't continue because as before "windows repair cannot continue in safe mode".

I didn't have time, so I backed up the data, reinstalled and restored the data.

Either way, it's a very interesting issue and one I had not encountered in the number of years working in this field.

If anyone comes across it and finds a fix I'd be interesteed to know.

I think it was a registry entry that was corrupt somewhere telling the winlogon and services that it was in Safe Mode when it really wasn't.

Thanks for trying.

Sruli

[sorinso]

I'm sorry that couldn't help you more...
Thank you for updating the forum.

[jfox]

sruliwolff,

I am experiencing the exact same problem and cannot resolve.

Is my only option to reload the whole system?

Thanks.

Jon

[AndyJG247]

It is usually better to make a new post rather than drag up an old one.

If you are technical it may be worth looking at this post and seeing if you can have a look at these registry settings, maybe something is calling this, especially if you have had a virus/adware problem,.
http://blog.didierstevens.com/2007/0...th-a-reg-file/
http://www.pctools.com/guides/registry/detail/213/

[GrantThomas]

system restore will work just fine if you got restore points, if it doesnt ask you to go into system restore (no repair) then goto cmd prompt and type msconfig and goto the system restore.

[sruliwolff]

If you plan on trying to figure it out I can only give you one piece of advice:

DON"T TRY TO DO A REPAIR.

I had to format and reinstall the OS as I tried to do a repair and then in the second part of the repair after it copies the files and then reboots to finish the configuation it wouldn't finish it as it says it could not run the repair in SAFE MODE.

Every reboot after that tried to finish the repair and wouldn't run in SAFE MODE even though it was booting into regular mode.

Sruli