XP Won't boot into Safe Mode aswrvrt.sys

Usually I use Hiren’s when I need to use Ghost. That way I can load the drivers of raid adapter.

What would Hirens be? I’m on ghost 14, which seems to work within windows on the RAID drive but I need to get back to windows first,ideally non destructively

I use Hiren’s Bood CD v13.1 with the included Ghost v11.5.1.

In the past I successfully cloned partitions in Raid 1 from my computer. I just had to load the raid drivers of the chipset to gain access.

Melo, I don’t think you’re allowed to help. Also Please stick to your own thread.

http://forum.avast.com/index.php?topic=141004.0

That is the correct list of Avast drivers

Thanks again, just tried re-boot into safemode, but now stops after hotcore3.sys, which is a Paragon file.I’m loathe to do much with that as it’s one of the few disks it will boot to at the moment.

normal boot went straight into a scheduled chkdsk (on the pale blue XP screen) that I had tried to run a couple of days ago.
That’s running now, so I’ll keep you updated.

As I suspected Avast is not the problem let Chkdsk complete and if it was the MFT then it should be able to repair it

Many Thanks for the assistance, now booted up OK into normal Windows after the non-recovery console chkdsk ran. i.e. the blue screen one.

As I said, I did try booting up into safe mode first, after killing the AVAST drivers, but got stopped at hotcore3.sys
It was only when I tried to let windows boot normally that the full XP chkdsk invoked and checked all the RAID partitions. It then booted OK, albeit with lots of stuff I’d previously disabled via msconfig still inhibited.

No idea why running chkdsk from the DOS style recovery console screen didn’t do the trick.

I do suspect it was still something to do with AVAST though, as I was having major booting problems a couple of weeks ago, but I could get into safe mode that time. This time it all started when I plugged an SD card reader in with some photos on from my new camera. Avast started to scan it, PC froze, BSOD and you know the rest.

Previously as I had safe mode I could get as msconfig and prevent almost everything loading, enabling a program at a time.
Following that scenario, I uninstalled Commodo and went back to Windows Firewall and needed to re-install avast then as well, as it was misbehaving.

Now uninstalled AVAST again, but not risked re-booting to complete the uninstall yet. Madly backing up all data to the latest versions to USB hard drive with another copy to a NAS.

Also trying to create a Ghost boot CD with the latest slipstreamed RAID drivers. Hopefully that will work when I test it, ;D

On re-booting, I got the pale blue XP “Please wait…” screen, presumably whilst Windows was clearing out AVAST, followed by a normal boot.

Hopefully, I’ve also attached an FRST report if you get the chance to have a read. ( this was from an msconfig selective startup re-boot)

Many thanks for taking the time to try and help me out, even if it didn’t go exactly as planned.
FRST has also generated Addition.txt, which I could add if required, I suspect it points to another few possible issues

In the short term at least, I think we can call it a success; just need to try the New Ghost Boot disk next, but off for my tea and the out for a beer to celebrate. Driving in the morning though so not too many :cry:

No sign of malware there, was the USB infected or did it just have a load of data on it ?

No, brand new 16 gig SD card, formatted in camera with a load of photos on it and nothing else, inserted into a USB reader. ( maybe I shouldn’t have used a reader from Poundland) :wink:

Interestingly the Additional text file refers to AVG disabled.

I uninstalled that when it up-issued to 2013 edition, as it was clashing with something and crashing the PC in a big way.
That needed a ghost from a previous image with AVG 2012 still on it. I hadn’t realised what was causing the problem at the time, but as soon as it updated again to 2013, windows was seriously trashed again.
Fortunately I could still get at ghost from Safeboot that time, so a second image replacement offline and uninstalled AVG before re-connecting…
I then replaced it with AVAST which seems to have caused issues on two separate occasions. I wonder if there is a bit of AVG left that it has clashed with.
I ran CCleaner to try and flush anything out at the time and MalWare bytes has never found anything yet.
I did have Lavasoft Adaware on the at one time, so I wonder if there’s a bit of that lurking somewhere as well.

I do need some sort of AV program, so was wondering about Mcafee, as I’m on BT internet, so it comes free.

Additional text file attached, if you get the chance to peruse out of interest

Many Thanks again for your time. I presume by your username that you’re too far away to buy you a beer.

Could you run OTL as there is something I would like to check out in the ADS

Download OTL to your Desktop
Secondary link

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropboxusercontent.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[]Select LOP and Purity
[
]Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
c:\program files (x86)\Google\Desktop
c:\program files\Google\Desktop
dir “%systemdrive%*” /S /A:L /C
CREATERESTOREPOINT

[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

Will do, but not tonight as currently making a ghost backup and just about to eat.
Hopefully I’ll have a go Tomorrow evening.

Many Thanks

No problem, I am off to bed soon :slight_smile:

Hello again, back from work to hassle you as promised.
Please see the two attached files, having run otl

Ah, I’ll have another go and attach the other file; not sure what happened there

Yup a few bad ADS’s there I took the liberty of removing some orphan BHO’s for you

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-725345543-1897051121-839522115-1003\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-725345543-1897051121-839522115-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-725345543-1897051121-839522115-1003\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [20131121] C:\Program Files\AVAST Software\Avast\setup\emupdate\9f895fce-8152-4a98-a9e9-40c884b3fae9.exe /check File not found
[2011/10/14 17:39:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/18 20:43:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/06/15 14:11:59 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\~0
[2010/10/18 20:49:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bill\Application Data\AVG10
[2011/10/14 17:44:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bill\Application Data\AVG2012
[2012/10/17 20:07:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bill\Application Data\AVG2013
@Alternate Data Stream - 1315 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:4TEwIAmnT08goU1o5RGhTIo
@Alternate Data Stream - 1167 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:FzVEoJmn8AfQrVEB1WuWYaHe
@Alternate Data Stream - 1119 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:CUMhlbg5zR6IzH9EhtdPM0
@Alternate Data Stream - 1117 bytes -> C:\Program Files\Common Files\System:axWbxqHVaJvipqawJ5hXjpVvUluD

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

OK Now sorted, slight delay as PC didn’t shot down, so I thought I’d better wait for a while.
Reset button didn’t work, so power cycled
New text file attached hopefully.

Any thoughts on a suitable AV prog or do you still reckon AVAST now that these odd bits have been cleared out?

Also I’m still pondering the idea if a dual boot XP/Win7 with the latter being installed on the D partition of this RAID 1 HDD when I’ve cleared it off.
I’ve bought a ligit copy of Win 7 and also a licence for some photo software that needs Win7 as a minimum

I think this will need an upgrade to a later Ghost, as I’m pretty sure Ghost14 won’t like dual booting.

I might need to consider breaking the RAID 1 one day, considering the problems it seems to cause getting back in when there is a system crash

Many thanks for the fixes, buy
Yup a few bad ADS’s there I took the liberty of removing some orphan BHO’s for you

ADSs & BHOs ???

Alternate data streams http://searchsecurity.techtarget.com/definition/alternate-data-stream
Browser helper objects http://www.sysinfo.org/bhoinfo.html

On balance I would still recommend Avast purely from my own experiences but, I have never used a Raid system :slight_smile:

Windows 7 once you get use to it is a superior OS to XP in many ways as the security is a lot tighter. Plus XP will no longer be supported next year so it will be the target of choice for malware writers

How is the computer behaving now ?

Seems to be behaving at the moment thanks, I’ll start re-introducing a few of the things I’ve inhibited via MSConfig, like monitor calibration etc.
MS Eventvwr seems happy enough except for a whole selection of error messages and warnings from round about the time I launched your fix file, so that’s only to be expected.

I keep getting “An error was detected on device \Device\Harddisk6\D during a paging operation.”, but I’m pretty sure that’s narrowed down to a 1 gig USB desktop drive that I use for SyncToy backups of data (I also have second copies on a network drive).

I’ll look into seeing if AVAST can generate a raid supported boot disk, which might be the way to go, but I’m still not sure about the implications of a dual boot system.
I know Win 7/XP dual boot should work OK with a RAID 1, provided XP is loaded first onto “C” , which it obviously is. My understanding is that XP needs the software RAID drivers loading before the system gets to XP itself, but Win7 has native support.

Not really sure how all this will impact on future system recoveries, should they inevitably be needed. Certainly Ghost 14 doesn’t seem to support dual booting.
The previous time, even with a single boot XP Raid 1, I ended up recovering by,

first unplugging one RAID 1 hdd to make sure I had a second bite.
Format C and reinstall a basic windows XP SP1 without connecting to the net, using RAID drivers previously downloaded onto a floppy and selecting the F6 option during install.
Install Ghost 14
Call back a recent Ghosted “C” image from within Windows now that I could see it.

All very time consuming and slightly traumatic.

Then again I didn’t have an Ghost 14 boot CD with the relevant RAID drivers slipstreamed in.
I think I’ve now made one, but haven’t tested it yet; this will all probably be immaterial if/when I add Win7 onto “D”

To be honest I could never really see the need for a raid system as the hard drives nowadays are of a much better quality, unless of course it is in a commercial environment

Once you are set up and all looks good let me know and I will tidy up :slight_smile: