Dan from Burbank's HJT Log

It's not that big a file… ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run hpsysdrv REG_SZ c:\windows\system\hpsysdrv.exe HotKeysCmds REG_SZ C:\WINDOWS\System32\hkcmd.exe HP Component Manager REG_SZ "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" HPHUPD05 REG_SZ c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe HPHmon05 REG_SZ C:\WINDOWS\System32\hphmon05.exe KBD REG_SZ C:\HP\KBD\KBD.EXE VTTimer REG_SZ VTTimer.exe AGRSMMSG REG_SZ AGRSMMSG.exe YBrowser REG_SZ C:\Program Files\Yahoo!\browser\ybrwicon.exe 2wSysTray REG_SZ C:\Program Files\2Wire\2PortalMon.exe UpdateManager REG_SZ "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r RoxioEngineUtility REG_SZ "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" RoxioDragToDisc REG_SZ "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" RoxioAudioCentral REG_SZ "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" ccApp REG_SZ "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" SSC_UserPrompt REG_SZ C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe" AlcxMonitor REG_SZ ALCXMNTR.EXE IgfxTray REG_SZ C:\WINDOWS\System32\igfxtray.exe MSConfig REG_SZ C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto TkBellExe REG_SZ "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx ! REG.EXE VERSION 3.0 HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run ! REG.EXE VERSION 3.0 HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run ! REG.EXE VERSION 3.0 HKEY_USERS\S-1-5-21-167367719-2909908708-4152928107-1003\Software\Microsoft\Windows\CurrentVersion\Run RecordNow! REG_SZ BackupNotify REG_SZ c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe AIM REG_SZ C:\PROGRA~1\AIM\aim.exe -cnetwait.odl MSMSGS REG_SZ "C:\Program Files\Messenger\msmsgs.exe" /background ! REG.EXE VERSION 3.0 HKEY_USERS\S-1-5-21-167367719-2909908708-4152928107-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce thanks! DJ

Bummer…..

Let's do this.

Go to:

Start -> All Programs -> Accessories -> System Tools -> System Restore

And create a restore point.

Then go to:

Start -> All Programs -> Accessories -> System Tools -> System Restore

And restore the system. I'd like it to be at a point as close to, BUT BEFORE, you ran Ewido the last time.

Then reboot and let me know what happens.

If the boot is successful, post a new log file.

System restore has been turned off and cannot be turned on in safe mode. To turn on System Restore, restart in Normal mode, and then run System Restore again. DJ

Do you have windows cd's to do a repair install if necessary?

I have the one from my own computer, but I believe this one was loaded with the computer and I don't believe I made a backup copy. Am I in that much trouble?

Normally, most PC's are sold with a "recovery cd" for times like this. Is that handy? I'm still investigating all options, but unless I can figure out what is keeping it from booting, things aren't looking very promising…

nope, there's no recovery CD. I can probably get the serial number of my windows program somewhere in the system; would that help in obtaining a replacement copy from MS? Also, my Safe mode screen seems to indicate I only have SP1 installed….would it help to try to download and install SP2? Maybe it will fix whatever's broken… DJ

What is the exact error message you get when trying to boot "normally"?

Do you have a "system recovery" on this machine?

What version of XP are you running?

Copy the text in the following quote box into Notepad:

reg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore > reg.txt
notepad reg.txt

Save it to your desktop as ff.bat.

Now, the ff.bat file on the desktop. A Notepad window will open up.

Please paste it's contents into your next post.

The message is on a black screen, with simple DOS-type text. It says something like, 'we're sorry for the inconvenience, but Windows could not load. It's possible a recent software or hardware change has caused this problem." Then it gives me the option to try starting again, or start in safe mode, etc. There is no error # or identifier. I'm running Windows XP 2002 with SP1. There is a partitioned drive with system recovery capability. I understand I'd lose all data on the computer if I used this to recover the system. Do you know if my son can use his iPod to recover the 18G of music on the computer? That's probably the biggest headache. He also has a lot of pictures, and I doubt if we can burn CDs in safe mode. I tried running that batch file, but there was an error message, about an invalid or incorrect paramater. The system kept sticking a "1" in front of "> reg.txt" There is a SystemRestore folder at that place in the registry, with 12 bits of data and two subfolders, Cfg and SnapshotCallbacks. Happy Labor Day! DJ

I think we want to know specifically what's in this value:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\\DisableSR

Please post the value you have there.

It'll be 0 (zero) or 1 (one).

I have someone assisting. He's on European time, so we'll have to wait.

We haven't given up on getting the critter to boot just yet.


Added in edit:

I got the reg query command to work:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" > reg.txt
notepad reg.txt

Here's the batch file output: ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore DisableSR REG_DWORD 0x1 CreateFirstRunRp REG_DWORD 0x1 DSMin REG_DWORD 0xc8 DSMax REG_DWORD 0x190 RPSessionInterval REG_DWORD 0x0 RPGlobalInterval REG_DWORD 0x15180 RPLifeInterval REG_DWORD 0x76a700 CompressionBurst REG_DWORD 0x3c TimerInterval REG_DWORD 0x78 DiskPercent REG_DWORD 0xc ThawInterval REG_DWORD 0x384 RestoreDiskSpaceError REG_DWORD 0x0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Cfg HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\SnapshotCallbacks As you can see, the Disable value is a 1, which I assume means yes. Can I alter that manually? Now I have two people to thank… DJ

There is a partitioned drive with system recovery capability. I understand I'd lose all data on the computer if I used this to recover the system.

The fact the data is there is very promising. I'm almost certain there's a way to just restore the system files and not erase the data. I'm just not sure how to do it.

As you can see, the Disable value is a 1, which I assume means yes. Can I alter that manually?

I believe that is the direction we are headed, but I'm not sure.

I think we'll change that to 0 (zero), have you reboot, and then see if you can access system restore.

But please wait until the person assisting has a peek. I'd hate to mess things up at this point.

Thanks! I'm standing by… DJ

Plug in the IPOD to see if you can recover the music files. Also, try to burn CD's to save whatever data you want off the machine. We're thinking that if we can get the machine back to a "bootable" state, it may be like it was the day it was boxed up at the factory. Also, for now, keep it disconnected from the Internet. Let me know how things go.

Since we can only boot in safe mode, there isn't the possibility of burning CDs. Also, my son is fairly sure he can use the files on his iPod to rebuild the computer's library, but at this point we can't find the iPod startup software. I appreciate all you've done, sincerely. I guess I'll try to find the serial #'s for the iPod and Windows software, and see if I can get replacement software from them without paying full price….also, I'll probably haul the computer to a local computer guru and see if they can get it up and running without the wipe. So, it doesn't help to try to change the System Restore parameter to 0? Thanks again DJ