Computer locks up during boot

[pawps]

I hope that you can give me a clue to find this problem, which is freezing or lock-up on booting. It always occurs when the Windows 98 screen is shown on the monitor. Now the good news is, I can always boot to the Safe Mode. While in the Safe Mode, I have unchecked the start-up group and a few individual items in the Win.ini and System.ini groups. The computer operates fine within the constraints of the Safe Mode capabilities. I should mention that this computer does not have any entries in the autoexe.bat or the config.sys files. I am concerned that if I keep unchecking items (that should not boot), another problem might develope.

This computer has Norton SystemWorks 2003 installed, but it is not in the booting sequence now, since I have the Start-up Group unchecked. However, I must say my boot problem started after I ran all the SystemWorks checks.

A little more on the boot problem; after unchecking something in msconfig, I can then check the restart button and sometimes it boots in normal mode. However, after shutting down the computer normally and turning off for the night, it will never boot normally the next day (freezes on the Windows 98 screen).

I would appreciate any help that you can give me.

[Mobo]

If you have a 98 cd then you may reinstall over top of the existing 98 sysyem which should clear up those troubles.

[Murf]

Hi Welcome to CTH

You probably have a hardware conflict. See if you can get it to boot normal. Once it does the:

Right Click on "My Computer" then to Properties, then to Device Manager.

See if there are any "Yellow or Red" nasties in there. If so highlight and remove them. Now reboot again. Let us know.

Also In Properties of "My Compter" under the General Tab, it tells you what version of Windows 98 you have, would help to know that.

[pawps]

Hi Welcome to CTH

You probably have a hardware conflict. See if you can get it to boot normal. Once it does the:

Right Click on "My Computer" then to Properties, then to Device Manager.

See if there are any "Yellow or Red" nasties in there. If so highlight and remove them. Now reboot again. Let us know.

Also In Properties of "My Compter" under the General Tab, it tells you what version of Windows 98 you have, would help to know that.

A check of device manager does not reveal any yellow or red marks. The windows 98 version is SE 410.2222. Thanks for your comments.

[pawps]

If you have a 98 cd then you may reinstall over top of the existing 98 sysyem which should clear up those troubles.

Can you tell me more specifically how you do this and what to expect when I use the 98 cd. I was not aware that you could do this. Thanks

[Mobo]

reboot the pc with a 98 bootdisk (http://www.24by7.ca/files/boot98se.exe) and when you are prompted select with cdrom support. The when you arrive at the a:> type setup and click enter to install the 98 over itself. You will need you product key as well.

[AnnMarie]

Hi pawps - it might help if we can see what is starting when you boot. Go here (http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip) and download and run a scan with Hijack This. Most of the files listed will be harmless and/or required so do not make any changes, just click on Save Log, copy it and post it back in this thread.

[pawps]

Hi pawps - it might help if we can see what is starting when you boot. Go here (http://www.spywareinfo.com/~merijn/files/beta/hijackthis.zip) and download and run a scan with Hijack This. Most of the files listed will be harmless and/or required so do not make any changes, just click on Save Log, copy it and post it back in this thread.

Is the log that Hijack This produces similar to the bootlog that Windows 98 produces?

[AnnMarie]

No. Hijack This shows the registry entries for all programs starting when you boot and gives detailed information.

[pawps]

No. Hijack This shows the registry entries for all programs starting when you boot and gives detailed information.

Sorry for being so long getting back to you, but let me explain what happened.
A friend of mine volunteered to look at my computer and used the boot log to find a file (ndis2sup.vxd) that had failed. After replacing this file, it booted with no problems for a good week. I waited to post a message, because I wanted to be sure that it would continue to boot.

It did until SystemWorks2003 did its routine work by schedule last night. This morning it would not boot normally, but would to the Safe Mode. I looked at the bootlog this time and found the same (ndis2sup.vxd) file had failed. I replaced it and it did not work this time. Another problem that has occured since last nights SystemWorks scans, is that when it does boot it tries to run setup for Adobe 5.0 which is already on this computer. Never had this before.

Now I have found that by picking and choosing which startup files start in MSCONFIG I can get it to boot, but it still tries to run the setup mentioned above. I have run HiJackThis and the file is listed below. I would appreciate your help and anyone else who can help me.

Thanks

Logfile of HijackThis v1.97.3
Scan saved at 11:14:41 AM, on 11/1/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\ROXIO\GOBACK\GBPOLL.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\QUICKENW\QAGENT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\MRTMNGR.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.udel.edu/students
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by University of Delaware
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\nprotect.exe
O4 - HKLM\..\Run: [InstallNAIProduct] C:\WINDOWS\TEMP\pft4160~TMP\Setup.exe /RUNVSINST /q
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [QAGENT] C:\PROGRAM FILES\QUICKENW\QAGENT.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [GoBack Polling Service] C:\Program Files\Roxio\GoBack\GBPoll.exe
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.LNK = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe
O4 - User Startup: CleanSweep Smart Sweep-Internet Sweep.LNK = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.udel.edu/students
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.7.105/1497b4c643cb0aa75b04/netzip/RdxIE.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/20010620/qtinstall.info.apple.com/qt502/us/win/QuickTimeInstaller.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37862.4561805556

[Mobo]

Not much there. Rescan and remove these by putting a check next to and click "fix all checked"


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/20010620/qtinstall.info.apple.com/qt502/us/win/QuickTimeInstaller.exe

[AnnMarie]

Hi pawps - there is a file running when you boot that looks as though it has been left over from a failed install (McAfee?). Run Hijack This again, select the below entry and click on "Fix Selected". Reboot afterwards.

O4 - HKLM\..\Run: [InstallNAIProduct] C:\WINDOWS\TEMP\pft4160~TMP\Setup.exe /RUNVSINST /q

When you have rebooted, delete the contents of your C:\WINDOWS\TEMP directory and let us know if this helps.

[pawps]

Hi pawps - there is a file running when you boot that looks as though it has been left over from a failed install (McAfee?). Run Hijack This again, select the below entry and click on "Fix Selected". Reboot afterwards.

O4 - HKLM\..\Run: [InstallNAIProduct] C:\WINDOWS\TEMP\pft4160~TMP\Setup.exe /RUNVSINST /q

When you have rebooted, delete the contents of your C:\WINDOWS\TEMP directory and let us know if this helps.

I deleted only the hijack entry as you suggested and it rebooted without trying to run Adobe program. I did not delete the Temp directory at the same time, because of this "touchee" computer; one step at a time. Computer booted fine for a couple of days. Then, before turning computer off last night, I delete the Temp directory as you suggested. This morning it would not boot again. Went to safe mode and restored Temp directory. It then restored. I also noticed this morning that the dial-up connection wants to keep coming up and hard to cancel. Hope that you can help.

Thanks

[AnnMarie]

Run Hijack This again and post a new log pawps.

[pawps]

Run Hijack This again and post a new log pawps.

Thanks Anne Marie for sticking with me. Here is Hijack file as you requested.

Logfile of HijackThis v1.97.3
Scan saved at 7:03:39 PM, on 11/5/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.udel.edu/students
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by University of Delaware
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.LNK = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe
O4 - User Startup: CleanSweep Smart Sweep-Internet Sweep.LNK = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.udel.edu/students
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.7.105/1497b4c643cb0aa75b04/netzip/RdxIE.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/20010620/qtinstall.info.apple.com/qt502/us/win/QuickTimeInstaller.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37862.4561805556

[AnnMarie]

Hi pawps - you have disabled a number of startup since you posted your last log including GoBack and the Windows Registry Checker. Are you sure you do not want these running?

Re, your dialup connection, are you still having this problem? If so, have you tried temporarily disabling all programs that automatically update such as Norton to see if one is triggering the event.

If still no luck, shut down your AV and try an online scan here (http://www.ravantivirus.com/scan/indexie.php) to make sure that there is not a dialer tucked away somewhere. If RAV reports any malware, copy the log and post it back in this thread.

[pawps]

Hi pawps - you have disabled a number of startup since you posted your last log including GoBack and the Windows Registry Checker. Are you sure you do not want these running?

Re, your dialup connection, are you still having this problem? If so, have you tried temporarily disabling all programs that automatically update such as Norton to see if one is triggering the event.

If still no luck, shut down your AV and try an online scan here (http://www.ravantivirus.com/scan/indexie.php) to make sure that there is not a dialer tucked away somewhere. If RAV reports any malware, copy the log and post it back in this thread.

I have eliminated quite a few things out of startup. My thought was to try and tell what was keeping this computer from locking up during the boot. For the first time in weeks, this computer booted normally the this morning with these things out of start up. Also, the dial up did not appear. You may have corrected that with the removal of the one entry in Hijack. I was planning to go back to Msconfig and put things back in startup individually and check the results unless you have a better thought.

Here's what I know about this computer:
It has always started in the safe mode
Not booting has started 2x after systemworks 2003 maintenance checks
It's the most frustrating computer problem I have ever encountered

Hope this answers your question and look forward to your answer. Thanks for your help.

[pawps]

A check of device manager does not reveal any yellow or red marks. The windows 98 version is SE 410.2222. Thanks for your comments.

Additional info. This computer is very tempermental when it comes to booting normally, seldom does. It will always boot to safe mode.

I have reviewed the bootlog when it tries to boot normally and shows these 2 file failing. The first to fail is ndis2sup.vxd. The last entry is stuck on INITIATING and the file name is ppa3.mpd. Can you tell me what these file are for and can this information be useful?

[pawps]

I have eliminated quite a few things out of startup. My thought was to try and tell what was keeping this computer from locking up during the boot. For the first time in weeks, this computer booted normally the this morning with these things out of start up. Also, the dial up did not appear. You may have corrected that with the removal of the one entry in Hijack. I was planning to go back to Msconfig and put things back in startup individually and check the results unless you have a better thought.

Here's what I know about this computer:
It has always started in the safe mode
Not booting has started 2x after systemworks 2003 maintenance checks
It's the most frustrating computer problem I have ever encountered

Hope this answers your question and look forward to your answer. Thanks for your help.

Additional info. This computer is very tempermental when it comes to booting normally, seldom does. It will always boot to safe mode.

I have reviewed the bootlog when it tries to boot normally and shows these 2 files failing. The first to fail is ndis2sup.vxd. The last entry is stuck on INITIATING and the file name is ppa3.mpd. Can you tell me what these file are for and can this information be useful?

[AnnMarie]

Hi pawps - this is not really my field but based on research, as far as I can tell, the first entry is not unusual (ndis2sup.vxd failing). It just means that it did not find drivers to support, so it does not load. The second entry (ppa3.mpd) is related to an Iomega Zip Drive. If you do not use the Zip Drive, try uninstalling it.

[pawps]

Hi pawps - this is not really my field but based on research, as far as I can tell, the first entry is not unusual (ndis2sup.vxd failing). It just means that it did not find drivers to support, so it does not load. The second entry (ppa3.mpd) is related to an Iomega Zip Drive. If you do not use the Zip Drive, try uninstalling it.

Thanks for that info. The following may be another clue:

A couple of days ago, I uninstalled SystemWorks2003 in the Safe Mode. When I chose restart the computer, it booted just fine and has been for a couple of days after turning computer off at night. Now this morning after turning computer on again, it did not boot initially. Since I kept Go Back on the computer, I was able to say restore to the last entry the previous day, and it booted normally.

Could it be that something is going wrong when I shut down computer for the night? No error or problems are indicated on shut down. What could it be?

Thanks

[AnnMarie]

I dont know pawps. It may have been a "one off" event. Has it happened since?

If your PC has always been tempermental, perhaps it would be a good idea to consider backing up your important data, reformating and reinstalling Windows.

[pawps]

I dont know pawps. It may have been a "one off" event. Has it happened since?

If your PC has always been tempermental, perhaps it would be a good idea to consider backing up your important data, reformating and reinstalling Windows.

Yes, it happened again this morning when booting. Corrected by reverting in GO BACK to last entry previous day. I am wondering if GO BACK itself could be the problem, since I think it does some recording during shut down. I can uninstall GO BACK and see what happens. If this fails, I probably need to reinstall windows as you suggested.

Thanks

Thanks