XP freezes after login, can't boot in safe mode

[dmh22]

Hi Everyone,

I've seen variations of this problem but none that match mine. The other day I was downloading music and on the internet. I clicked on a link and it basically froze my computer up so I did a hard shutdown. When I reboot I can login and the desktop comes up and I can see all the programs and folders and a few programs start loading and then it freezes. I can move the mouse but can't click on anything or do control-alt-delete. This happens every time (even when I tried logging in as Administrator). I'm not a computer expert but I've always been able to fix problems in safe mode, however when I try booting in safe mode I get this message "We apologize for the inconvenience but windows did not start successfully. A recent hardware or software change might have caused this." It also hangs on Agp440 when loading the drivers in safe mode. I have a Dell D600 desktop. Does anyone have any suggestions? I have an external and most of my things backed up but hadn't backed up for a couple weeks so I need to get the rest of my files. Any advice is greatly appreciated, thanks!

Since the problem started as you were downloading from the internet, you
need to suspect a malware infection.

[dmh22]

Yeah I am guessing it's a virus but I can't start my computer or even get into safe mode to do a virus scan and get rid of it. Any suggestions?

I'm not a computer guy (i'm an accountant) so I don't get everything you guys are saying. I've always been able to get rid of viruses in the past by booting into safe mode and running removal program but I can't even boot into safe mode this time so I don't have a clue what to do. I got the Windows XP cd today and am going to try and do a repair install when I get home. If that doesn't work i'll start with your suggestions. Thanks again!

By "I got the windows xp cd today" I mean I got it from my dad as I don't live with him anymore. I did the following in the recovery console:
md c:\windows\tmp
copy c:\windows\system32\config\system c:\windows\tmp\system.bak copy c:\windows\system32\config\software c:\windows\tmp\software.bak copy c:\windows\system32\config\sam c:\windows\tmp\sam.bak copy c:\windows\system32\config\security c:\windows\tmp\security.bak copy c:\windows\system32\config\default c:\windows\tmp\default.bak
delete c:\windows\system32\config\system
delete c:\windows\system32\config\software
delete c:\windows\system32\config\sam
delete c:\windows\system32\config\security
delete c:\windows\system32\config\default

copy c:\windows\repair\system.bak c:\windows\system32\config\system
copy c:\windows\repair\software c:\windows\system32\config\software
copy c:\windows\repair\sam c:\windows\system32\config\sam
copy c:\windows\repair\security c:\windows\system32\config\security
copy c:\windows\repair\default c:\windows\system32\config\default

After doing this I exited which is what the steps in the article I was following said to do and now when I try to boot up I can't get to the login screen (it just loops) in any mode (safe, regular, last settings that worked, etc). I am now running a chkdsk /p /r in recover mode. Do you think it's time I just give up and re-install windows?

Boot your system from either a BartPE CD or a live Linux CD like
Knoppix (both free). Then back up your important files to a USB drive
or network drive, and then re-install Windows.

Knoppix:
<http://www.knopper.net/knoppix/index-en.html>
BartPE:
<http://www.nu2.nu/pebuilder/>

What is your complete Windows version, edition and service pack level?
(For instance, I'm using Windows XP, Professional, Service Pack 3.)

Whenever you improperly shutdown your computer, there is always a
possibility of file system corruption.

If you have a Windows XP setup CD, boot with that and use Recovery Console
to do a Check Disk with this command on the command line:
CHKDSK C: /P
(Assuming Windows is installed on your C: drive - change letter if not.)

If that completes without freezing, then try Safe Mode or Last Known Good.

If Check Disk appears to be frozen, check for disk activity. When running
outside Windows, it cannot use Virtual Memory pagefile, but only RAM. It is
normal for it to run slower. If there has been no activity for 30 minutes,
try Ctrl+C to stop it, before resorting to pulling the plug.

If you do not have a Windows XP CD, do you have access to another computer
where you can make a boot CD? There are other boot options also.

You should also try the Dell Support drivers and download page, enter your
computer's Service Tag. (See instructions on that page explaining how.)
Then when you browse to other pages, you are more likely to find help
information that applies especially to your computer. There are a number of
excellent resources there, including trouble-shooting guides.
http://support.dell.com/support/down...iverslist.aspx

Here is one of the best tools for identifying malware problems:
FREE MalwareBytes Anti-Malware (MBAM)
http://www.malwarebytes.org/mbam.php

If you do not have a good paid AV like NOD32 or Kaspersky, try this:
FREE Home Edition Avast! antivirus - anti-spyware protection
http://www.avast.com/eng/avast-free-...tispyware.html

It may be necessary to remove the drive and attach it to another
(protected) computer to get your Valued Data copied. If so, make sure that
System Restore on the other computer is not monitoring your drive.

Have you tried a Restore to a date just before the problem started?
I guess you could always put that HDD in another computer as a 'slave'
(might have to change its jumpers) and copy your files.
Also do a malware scan with the free versions of MBAM and SAS. (MalwareBytes
AntiMalware and SuperAntiSpyware).
And do a virus scan while it is in there

Burn BitDefender, or another program listed at the link below, to a CD
(using a working machine) and test the infected machine with it.
BitDefender also has a Rootkit checker on the Linux Desktop; run it if
you think that's the problem:

Download the executable rather than the .iso image, if one is
available.. it prompts you to insert a CD and burns the file, no problem.

Then run these:

Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SuperAntispyware
http://www.superantispyware.com/supe...freevspro.html

VERY bad move. Assuming you have malware, *that* it is what needs to be
addressed first! Attempting to perform a Repair Install before the
malware is removed can very well make your situation even worse.

If you don't "get everything," ask and ask again until you do get it. If
you still don't get it, there is no shame in that. Just make sure you
find a competent tech (No Geek Squad, etc!).

Also, what do you mean by "I got the Windows XP CD today"? It almost
implies this is something you recently acquired. If so, are you sure
it's the exact CD you need for your particular system (there are many
different XP CDs out there!)?

Excellent resource in dealing with malware

Is it still locking up as first reported or are you just unable to
login in any mode, do you get prompted for a login, what happens when
you enter the login credentials, etc. Locking up is not the same as
unable to login.

Are you past the point of it hanging like before? We need to know
what "can't start my computer" means to you.

It appears what you have successfully done so far it set your computer
configuration back to the date when XP was first installed and it
sounds like you have partially followed KB307545. I did not see where
you reported symptoms that KB article is supposed to resolve, so why
are you following it?

The next step in the KB307555 process would be to reboot, so is your
real issue that you cannot get past the login screen?

It is good that you can get into RC though.

It appears that you are responding to my post, yet you are replying to
your own post, which is confusing. So that others can quickly follow the
different posts in this thread (and therefore have a better
understanding to help you), in the future please reply to the person you
are responding to. Also, don't snip away their text! (Or if you want to
snip some of it, make sure you leave the relevant information.)

What you described above is often called a manual System Restore, which
at times can be useful. But if you have malware, it probably won't
address the real problem.

And regarding the CD you received from your Dad, is this the one that
matches your PC or is it a different one? If it is a different one, you
may have problems when it's time to reinstall Windows. As you
discovered, though, even if it is the incorrect one, you are still able
to use its Recivery Console.

You need to rid your PC of the malware -- which can be tricky and
time-consuming, depending on the particulare infection(s). Look here
again

Your alternative is to copy all your important data and perform a Clean
Install

(and then copy all your data back and reinstall all your programs and be
sure Windows is patched).

To copy your data, either physically remove your hard drive and place it
in and external enclosure and then connect it to another PC OR place the
drive in another PC as a slave. If you would rather not physically
remove the hard drive, you may boot off an emergency boot disk like
Knoppix or Ubuntu and copy your data to an external hard drive. If the
above is over your head, you are advised to find a competent tech (do
not use Geek Squad, etc!).

What you described in your initial post is a classic case of malware.
Repair Installs (as well as Windows System Restore or the type of manual
System Restore you already tried) are not appropriate for dealing with
malware. In the unlikely event you don't have malware and a Repair
Install would solve your problem, the technique is outlined here

Again, you should copy all your data first as a precaution. If you are
successful with your Repair Install, you will find all the data and
programs are intact. (But I doubt this will occur in your case.)

[dionysos]

I have the exact same problem as posted above Reading through all of this im looking for an easy quick fix. And it looks like the best option is running BitDefender any comments?

[youbetoufu]

Ummm i have the same problem... and how can i restore windows to the date before the error??

[youbetoufu]

as suggested by you i tried using the malwarebytes thing and i realised i can't use it because windows xp is now frozen and i CAN'T CLICK!!!!!!!!!!

[JAMES_911]

Originally Posted by youbetoufu

as suggested by you i tried using the malwarebytes thing and i realised i can't use it because windows xp is now frozen and i CAN'T CLICK!!!!!!!!!!

You should know that an improper shutdowns/startup might crosslink/corrupt some files which can be easily fixed by chkdsk. You can start chkdsk from the cd or if you are in windows, right click on your c drive, choose properties, Tools, 'check now'. Check 'automatically fix file errors' and 'scan for bad sectors' (takes a bit longer with this option). I would also scan any other drives whether physical or logical.

[youbetoufu]

Originally Posted by james_911

You should know that an improper shutdowns/startup might crosslink/corrupt some files which can be easily fixed by chkdsk. You can start chkdsk from the cd or if you are in windows, right click on your c drive, choose properties, Tools, 'check now'. Check 'automatically fix file errors' and 'scan for bad sectors' (takes a bit longer with this option). I would also scan any other drives whether physical or logical.

Thanks for the tip but i can't click on anything inside windows the cursor can be moved but i can't click D: