Help - Desktop not loading

Hi,
I got a BSOD recently (didn't notice the error code). When I reboot my machine, it seems to boot, but the desktop is just a blue screen. I can reboot in Safe-mode, but that seems the only way for it to boot. I tried to reboot to the last good configuration, but no luck. It seems to me that when I am looking at the blue screen - the machine seems to be running (getting messages about updates in the tray) - I just can't access programs.

I can access the Control Panel and can run programs from there. I was able to run CMD and access a Dos prompt to copy my user files onto an external drive.

The machine I have came pre-loaded with XP (Lenovo T61) and I don't have a CD, but might be able to get my hands on another copy of an XP CD.

Any idea what I can do?

Thank you in advance,

John

 

Since you can access Safe Mode, you may need to run a few recovery programs.

Firstly, click Start, Administrative Tools then Event Viewer. This will give you the number of the error.

It is probably in the Application setting, but could also be in others. Try to recall the approximate time and date when theis happened so you can access the correct event.

Do a Google search for the event by typing Error number ###

You can also run various anti-malware programs from here. I know Elizabeth has her favourites. In this context, mine would be Rkill, then ComboFix, then Malwarebytes.

To get these you will need net acccess from Safe mode

 

JoJo, If it helps to diagnose ... the original failure /BSOD occurred while removing a USB device

 

http://superuser.com/questions/179/why-does-unplugging-my-thumb-drive-result-in-a-blue-screen

read above and tell us how yours is set, it is always better to remove a pen drive with the safely remove hardware icon.

 

Read the link given by Elizabeth.

But what has happened is you took out the drive while data was being exchanged, leaving Windows waiting for it and hanging as a result.

you must also do each of the points I suggested, in sequence. It may take a while.

When you have done these, download and run Slimdrivers. While installing, it offers to install PCBackup or something similar. Remove the tick from the box and click next.

Slim Drivers will check your entire system and download the latest drivers. Each driver needs to be downloaded separately, then a restart.

After each install, run Slimdrivers again and continue until all your drivers are installed,

 

You might also try running this:

http://support.microsoft.com/kb/315265#method2

But run it from your Command line

 

elizabeth23 - I have "Optimize for performance" selected, and cannot "un-select" and select other options.

JoJo - working on the other steps you mentioned. I have been able to run chkdsk but not with the switch of volume c:/f. When I run it with the switch, something starts but very quickly closes the CMD window.

 

I think the error is: Windows Search Service
Event ID 3038 -
The gatherer is unable to read the registry DocIdMapFile.
Context: Application, SystemIndex Catalog
Details: The system cannot find the file specified. (0x80070002)


Also finding Warnings/Errors

Event ID 3 -
The configuration of the AdminConnection\TCP protocol in the SQL instance MSSMLBIZ is not valid.

 

On your event id 3, what is the source??

You want to leave it at Optimize for performance, and then you will remove it only when it says it is safe to do so. (at times there may be a glitch and it will say something is still accessing it, if this happens after waiting a period of time, then turn off pc, remove pen drive, and then restart pc)

If you have search 4.0 installed uninstall it, very unnecessary and very problematic.

also give me the source on the event id 3038

you can copy/paste the entire error event:

when you double click to open an event if you look on the right hand side of the box, third icon down, it looks like an open book,

click on this and it transfers it to clipboard, open a reply here and right click in reply box and choose paste.

 

Elizabeth - here is the error.

Event Type: Error
Event Source: Windows Search Service
Event Category: Gatherer
Event ID: 3038
Date: 8/16/2014
Time: 2:01:27 PM
User: N/A
Computer: JOHN-B3FD2E73
Description:
The gatherer is unable to read the registry DocIdMapFile.

Context: Application, SystemIndex Catalog

Details:
The system cannot find the file specified. (0x80070002)

 

That 3038 was the error posted was from the original failure. When I currently try to boot I also get the following error (in addition to the 3038). Again, I can boot ok in Safe mode with netwkg - but I get these errors from a regular boot


----------------------------------------------------------------------

Event Type: Error
Event Source: Windows Search Service
Event Category: (3)
Event ID: 3028
Date: 9/2/2014
Time: 11:03:52 AM
User: N/A
Computer: JOHN-B3FD2E73
Description:
The description for Event ID ( 3028 ) in Source ( Windows Search Service ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event:

Context: Windows Application, SystemIndex Catalog

Details:
The registry value cannot be read because the configuration is invalid. Recreate the content index configuration by removing the content index. (0x80040d03)
.

 

you did not say if you had windows search 4.0 installed??

go to the control panel and uninstall,

clear all events

reboot

does the error return???

 

Sorry - ... I had Search 4.0 running, uninstalled it, re-booted and still didn't load properly. I have now cleared all application event and re-booted. Receiving 2 warnings.

Event Type: Warning
Event Source: SQLBrowser
Event Category: None
Event ID: 3
Date: 9/2/2014
Time: 1:05:53 PM
User: N/A
Computer: JOHN-B3FD2E73
Description:
The configuration of the AdminConnection\TCP protocol in the SQL instance MSSMLBIZ is not valid.

Then, needed to re-boot into Safe Mode to get here. This msg appeared
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 9/2/2014
Time: 1:08:10 PM
User: NT AUTHORITY\SYSTEM
Computer: JOHN-B3FD2E73
Description:
Windows saved user JOHN-B3FD2E73\John registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

I am wondering that since it boots ok in Safe Mode using my user profile, does this just mean that Windows just won't load my profile?

 

Okay there are 2 things I want you to do at this time

download the UPH tool here:

http://www.microsoft.com/en-us/download/details.aspx?id=6676

and after installing, reboot and see if you can now boot normally.

If this does not clean up your profile, I want you to boot back into safe mode and create another administrative profile.

reboot and choose the new profile from the welcome screen does windows load now??

if it does then I would say your user profile is corrupted and you can transfer your data to the new account and delete the previous one.

 

Tired to download it - but "System administrator has set policies to prohibit this action" Is this because I am in Safe mode?

 

I downloaded it, but when trying to install it I got an error "System Admin has set policies to prohibit this action". I guess windows installer isn't running in Safe Mode? I tried to run "net start msiserver" but no luck. I also looked at the properties of the file and "unchecked" the blocking - no luck.

 

==================

try above fix for that error, and did you create the new account??

==

 

Elizabeth,

Thank you so much for helping me with this issue..... I got my desktop back!

After running the UPH tool, creating the new user profile, rebooting, my original profile is now working. (don't ask my why the new profile impacted this)

Thanks again.

John

 

Great, and you can leave the uph installed, it makes sure everything is closed on your profile before a shutdown.

Keep your system clean and you should be good to go!!

==