Windows XP won't boot in normal mode

Hello,

I'm a bit stuck and not sure where to begin. I was told by a reliable friend to try here before I do anything else so here it goes:

It all started with pop-ups that my pop-up blocker wasn't blocking. When ever I ran a spy-ware detector the same one would keep getting detected after I had deleted it. I looked through my hard drive to see if anything looked suspicious and found one called "Kazagent" that I hadn't seen before.

I tried to delete a folder "kazagent" in my program files and it said that I couldn't. It said check to see if the disk was write-protected. So I rebooted the computer into safe mode, and then I was able to delete it.

Now when I try to boot up in normal mode, I get to the screen where it says windows XP with the bars that indicate drivers and programs are loading - then all the sudden it just reboots. It now does this over and over and over again. The only way I am able to get into windows now is through safe mode.

The problem is that I am unable to restore the folder - it was completely deleted from the hard drive. So while in safe mode I tried using a program (I found from here) called "Registry Mechanic" it found over 1000 problems. I went ahead and registered it and had it fix them - hoping that that would resolve my problem. I then did the live update and checked again and it said 0 problems. So I tried to start up windows xp in normal mode again - but I am still having the re-boot problem.

At this point I am at a loss as to what to do, is there any way I can avoid re-formating my hard drive and starting all over?

 

Oh and just in case, this is the information on the 'spy-ware' that kept coming back after being deleted:

Spyware Scan Details
Start Date: 9/16/2005 7:57:23 PM
End Date: 9/16/2005 8:09:30 PM
Total Time: 12 mins 7 secs

Detected Threats

AproposMedia Browser Modifier more information...
Details: AproposMedia is a browser modifier that installs with PeopleOnPage (POP). AproposMedia displays pop-up advertisements and changes browser settings.
Status: Removed
Severe threat - Severe-risk items have an extreme potential for harm, such as a security exploit, and should be removed.

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\Software\Aprps
HKEY_LOCAL_MACHINE\Software\Aprps\Client PartnerId WB.VER2


Detected Spyware Cookies
No spyware cookies were found during this scan.

 

Please follow the steps below:

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

POST BACK IN THE SPYWARE SPECIFIC FORUM

 

Ok I will try the link you provided BUT there is one problem that I think I can see with this already. I am COMPLETELY unable to log into the normal version of windows XP. I have even tried to go through msconfig and set it up for a diagnostic boot up, and even that failed - it again would just reboot after a few minutes of showing the Windows XP status screen. The only way I am able to get the computer to boot at all is in safe mode right now. All versions of safe mode seem to work (that's how I can get online) - I will try first part though and see if I am able to resove anything this way. I have to go to the hospital in a little while, but I will reply again when I return. Thank you very much for trying to help me, I truely appreciate it!

 

I'm re-doing the Rav AntiVirus scan now because when I came home from the hospital yesterday the computer had apparently rebooted (and rebooted and rebooted etc.) I think it because of a small power outage though because when I came home the clocks in the house needed to be reset too.

I wanted to add something to this post though. I think that I may have been a bit misleading about my problem. While this all stemmed from a pop-up that I had tried to get rid of, I don't think that it is a pop-up that is my problem right now, it's not what I am trying to fix.

The problem I am having is that I am unable to start up in normal mode of any kind. To this end I have only made a little progress. I discovered how to make it so that the computer will give me a blue screen instead of just rebooting. So now when the windows logo comes up (while trying a normal boot) I get an error that says page_fault_in_a_no_page_area or something like that. It is followed by a stop: and then a long string of number.

I would like to be able to start up in normal mode again before trying to fix any pop-up problems, so my question is am I able to do that? It all started when I booted into safe mode to delete the c:\program files\kazagent folder along with everything inside it. (It was the only way I could delete these files and folders as they could not be deleted in normal mode.) I can't undelete the files now (they are completely gone - I wasn't even able to retrieve it with a program I found here called file recoverer. I also tried doing a google search (and a yahoo search) to see if I could find out anything about "Kazagent" and wasn't able to find anything even remotely relivent.

So my question is, do you need to give you more information (the actual string of numbers with my blue screen of death perhaps)? Is there any way I can pinpoint the startup string that perhaps started up this folder so I can remove it from the start up sequence. I tried MSconfig but none of those normal boot options would work - not even the debugging one which turns off everything. There MUST be a way though because I am able to boot into this safe networking mode (I am using the computer with the problem to post this now).

Is this still the right place to be asking about this particular problem or should I go somewhere else? I really do appreciate the help you've tried to give so far, and I'll listen to the advice you give, I just wanted to make sure you knew what it was that I was actually trying to fix, because it seemed like you were trying to fix my original pop-up problem - not the problem I am having now.

Thank you again.

 

You need to give the exact error message on the BSOD word for word including the Stop message.

This is also more of an issue for the software forum. When you are booted into Safe Mode Windows only loads the minimum services needed to run. You need boot in Normal Mode so we can find what is on your system, so we can eradicate it.

 

ok the fault is always the same, the numbers don't change. I also get it every single time I try to boot in ANY version of normal mode.

The exact fault name is: PAGE_FAULT_IN_NONPAGED_AREA

Then it says the usual things - if you haven't seen this error before reboot etc...

Technical information:

***STOP 0x00000050 (0xF7BDE5A4,0x00000001,0x86626244,0x00000000)

 

Sorry I forgot to mention there is no more additional information after the stop code line.

 

his is a rather nasty error that could be caused by just about anything, including busted audio drivers, incompatible video drivers, bad or corrupt hard disk, and faulty hardware such as bad RAM. The error may be triggered by an event such as plugging in a USB device, but the problem is, the fault may not lie with the device that was actually plugged in. Worse still, other errors can mask this one. The point is, the crash may be a symptom of some other problem, or another crash might prevent you from seeing this one.

Most often, x50 is associated with dud RAM. That includes main memory, video and CPU cache memory. If you have more than one stick of RAM, start ripping the sticks out one at a time. If you only have one stick, you will need to find someone who can help you out with a spare stick that fits your machine.

Use MEMTEST86+ to test your memory.

Disable all BIOS caching and speed-up options.

Disable power management.
​

If you are overclocking, don't.
​

Antivirus software can cause this error. Disable any antivirus software you have.
​

Run Chkdsk /f to check for disk errors because corrupt disk volumes can cause this, too.
​

Check Event Viewer to see if there are any additional errors or warnings that might provide a clue.
​

 

I know this is a little bit backwards but this is one things I was able to pull from the Event Viewer:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 9/18/2005
Time: 4:41:48 PM
User: N/A
Description:
The following boot-start or system-start driver(s) failed to load:
AmdK7
awlegacy
Fips
IPSDisk
SAVRTPEL
SYMTDI

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Does any of that help?

I honestly don't think it is a hardware problem since the error started happening the very moment I deleted that c:\programs files\Kazagent folder but I will still try and do what you ask just in case.

Is there any way I can get windows XP to tell me what it's doing so that I can see exactly when it does crash?

All I see is the windows logo with a status bar most of the time just before the reboot. The other option I tried from the msconfig didn't help much either (the one that disables GUI).

 

Boot into safe mode and disable Symantec Antivirus.

 

hmmm now I have an interesting problem. It seems that in safe mode I am unable to install Symantec Antivirus through the add and remove programs in control panel, and I still can't boot into normal mode to remove it. Is there another way I could disable it in safe mode?

 

Nothing Symantec/Norton will work in safe mode. Use MCConfig to disable the startup items for Symantec/Norton; you can also run SERVICES.MSC and disable Symantec/Norton services, make sure you right down what you are disabling and the configuration for each service, so when you are done you can reset everything.

 

Nothing seems to be working =(
I used MSconfig and SERVICES.MSC disabled as much of Symantic AV as I could but I still get the normal rebooting or blue screen problem (depending on how I have windows set up).

I think I'm at the point where I'll just back up what I can and then re-format and start all over. It will be a bit of a pain but at least I'll be able to use my computer again.

Thank you for trying to help I really apprecaite it.