Solved Windows 7 is in safe mode, even though it's using normal startup.

[renrav]

I'm trying to resolve an issue(remotely, I'm in California, he's in Kentucky) that my father-in-law is having with his computer after Norton tech support jacked his system, trying to fix his norton install.

I'm not entirely sure what all was done with the system, but I am currently trying to get his wireless card reinstalled, so that we can connect the system to the internet.

After a little digging this system is using a trendnet TEW-441PI wireless adapter. I had him download the drivers to a thumbdrive, copy them to the system and install them. The installation wizard fails because of an issue with windows installer service(We searched for the error, and found another helpful post from this forum), this seems to stem from the fact that the Windows Installer service is not running(According to msconfig services tab).

I had him try to start the service using: "net start MSIServer" on an elevated command prompt, but it fails saying that the service cannot be started in safe mode.

To make sure this process had been going smoothly, I was watching over his shoulder through a hangout session from the other machine, and I can confirm that no safe mode prompt appeared, and the startup appeared as normal as any boot.

After additional searching, I found vaguely similar issues that were resolved either by selecting normal startup under the general tab(his system already had normal start selected), and by unchecking the "safe boot" box in the boot tab(which was already unchecked). As well, all items under Services and Startup are enabled, but many show as Stopped.

If I was there, I would format and reinstall this system from scratch, but as it stands, I would really like to get this system to limp through until our next trip back east.

I could tell from some other checking, that he is still the administrator for the system.
The system does and does not look like it is in safe mode. The desktop shows his background and icons, and I could not see, nor did he mention, the normal safemode words stamped on the background. However, the system is using the windows 95/98 style start menu, etc. Although I know that can easily be selected in the settings for those items.

I also tried forcing the safe mode prompt to make sure we selected normal startup, but that put us in the same situation as above.

I likely won't get to work with him on it again, until tomorrow night, so feel free to pile on the suggestions, so I can run through them, when I get the chance.

If you have any questions that would help, I'll check back tonight and tomorrow to try to answer what I can.

EDIT: System Info
This was an old HP PoS machine I bought when Borders went out of business:
Core 2 Duo
4GB DDR2
80GB Main HDD(OS C:/)
2TB Secondary HDD(E: with docs, pics, music folders directed to it).

I did a clean install from a Windows Home Premium Upgrade disk(non-SP1) and has been kept up to date.

Thanks!

 

[gregrocker]

It is normal for many Services to be stopped as WIn7 sets most to Manual on fast triggers which is the key improvement that makes it lightweight and the best Windows yet. And you do want all msconfig>Startup and >Services (after Hiding All MS Services) disabled except a lightweight AV like MSE or Avast, no more.

What I would do is plug in the ethernet cable which may well load its driver and get connected so you can troubleshoot hands-on the wireless adapter. If it doesn't load the driver then enable Automatically get recommended drivers and updates for your hardware (Step 3) to check again. If problems persist getting connected right click the System Tray Connection Icon to Troubleshoot both adapters which will identify the problem.

Once online run all rounds of Important and Optional Windows Updates with reboots so that WIn7 has the drivers it wants, all performance and security patches are in place.

If Win7 won't run an Aero theme from Control Panel>Personalize type Aero in Start Search box to run the troubleshooter to find out why. The most I'd edit Visual Effects on low resource machines is to disable animations, sliding, fading, dragging intact and selection rectangle from the Visual Effects shown in Optimize Windows 7 - Windows 7 Forums

 

[renrav]

Thanks for the info on the normal state of Services. Is it normal to see the errors I am seeing with the net start command or the installer for the drivers? The error indicating that I am still in safe mode, is what I am particularly concerned about.

A hard connection would be my normal go to for an issue like this, however, I am working with a near novice when it comes to anything technical and the router he would need to plug into is in another room. So, I am not quite ready to ask him to disassemble and reassemble the system upstairs.

Turning Aero on and tweaking it is nothing I'm really concerned about, it just seems to me to be further evidence of something odd going on with the system.

Thanks for the suggestions.

 

[gregrocker]

Has Norton been uninstalled yet? This is the fourth Norton disaster we've seen this week, it's problematic bloatware at best. I'd replace it with Microsoft Security Essentials and also install and run a full scan with Malwarebytes if you can get a stable connection in Safe Mode with Networking.

There might also be a useful System Restore point from before the changes that were made that have caused the problem. However I'd run System Restore from System Recovery Options preferably using the disk which is best when the system is unstable.

Try also from the Command Line running SFC /SCANNOW Run in Command Prompt at Boot to check if System files are damaged.

I'd still have him run the connection troubleshooter from the system tray to see if it reveals the problem. If the installer won't run then unzip the files to browse into them using Driver Install from Device Manager.

 

[renrav]

Norton is still installed, I haven't decided whether or not to push him to remove it since he has more than a year left on his subscription. As well, the issues didn't stem from Norton, instead from Norton Tech Support, as they tried to fix the issue causing Norton to crash after startup.

Normally I do run MSE exclusively, but that's because I trust myself with a computer. Although in the last two weeks it has let me down on both my main desktop, and my HTPC(admittedly, the HTPC was my wife's fault). So I generally don't mind seeing a machine I don't have physical access to, and which is being used by the tech novice, running something I think is a little more robust, even if it is bloated.

I haven't looked at the Restore Points yet, but if the Norton guy got Norton working again, I'm inclined to see if I can get the system back up before resorting to that.

We did run SFC /SCANNOW in an elevated command prompt after boot, it reported that it fixed some non-specific issues, but it didn't seem to resolve the issues we were looking at now.

The connection troubleshooter has been run, but not with me watching, so I may ask him to try again when we talk tomorrow.

One of the things I had tried today, was hunting down the inf in driver package, but it seems like it has it wrapped up in the setup utility. Which baffles me, I've done driver installs like this before, and I often prefer it, so that I can avoid bloatware that usual comes with driver packages, but scanning through all of the folders that came with this driver, I couldn't find anything that even looked like a driver file.

driver/DATA/(contains menu*.[DAW,DAL,DAH,BRL,BRH], two menu* truetype files and a file called amslng.9, so nothing that stood out as a renamed or compressed driver)
driver/DOC/(Contains two pdfs)
driver/utility/xp/setup
driver/utility/vista/setup
driver/autorun.exe
driver/autorun.apm

I would have expected to see some driver related files, but it's almost like they are embedded in the setup utility. Really bizarre. Yes, I do have view hidden files and folders selected.

Any other ideas? Especially about the odd safe mode state?

Thanks again for the extra input, I really do appreciate the suggestions. If I sound dismissive to any of your ideas, I apologize. I'm just trying to be as prepared as possible before I sit down for another potentially multi-hour long session tomorrow.

 

[PeaB4YouGo]

Not for nothing, and I'm sure you've tried it, but I'm thinking... Show the machine what Safe mode really is.

Boot it into Safe mode, on purpose. Right from the start, show the machine what a real safe mode is all about, then, boot normally, and check which mode you're in.

For some reason, this feels like I'm channeling my dad... "I'll give that kid something to cry about..."

 

[renrav]

Since I'm online with him now, I figured I would provide some updates:

1) A hard connection does not work, the system continues to show the red x over the wireless icon.
2) ipconfig shows an ip address, and ipconfig /renew errors out indicating that the rpc server is unavailable
3) Our first system restore attempt failed... and there are no other system restore points...
4) Safe Mode prompt - Last known configuration: Everything works! Not sure why I didn't try that last night, but it's a start.

So now the wired connection is working.

Checked for updates, but none were outstanding.

The wireless driver is now installed, but so far we can't connect using the wireless card.

We're calling it a night since we've been at this for 2 hours and it's getting late in KY.

 

[gregrocker]

Did you enable Automatically get recommended drivers and updates for your hardware (Step 3) ?

What were the results of the Wireless Connection Troubleshooter mentioned twice? Type Troubleshooting in Start Search box, select Network then Wireless during its run.

Run all Important and Optional Windows Updates, reboot if prompted, then check for Updates again.

 

[renrav]

I did not verify that the settings for "Automatic get recommended drivers and updates for your hardware
updates". However, windows was automatically identifying this card as an Atheros card(which I believe uses the Trendnet hardware) and that driver doesn't seem to work; which I recall being the case when I first built this computer. I'll likely start tonight by removing the Trendnet driver, go to device manager and have it search for drivers for the card.

As for windows update, it had always been enabled to automatically install updates and appears to be doing so, but I did not verify it last night. I'll double check it when I get online again tonight. However when I had him open windows update we could see that it had checked for updates a few minutes prior and had no important or optional updates available even when we forced a manual search for updates.

I forgot to mention that we had tried tried the Wireless Connection Troubleshooter a few times throughout this and, as usual, it hasn't been able identify any issues.

I mentioned having him call up Norton to complain about the mess their tech support made with this machine and request a refund for his remaining subscription so we can remove Norton altogether, but he didn't really give me a strong idea if wanted to do that. So we'll see where that goes.

 

[gregrocker]

Norton is troublesome bloatware which is NOT a Best Practice for Win7. So continuiing with it is a bad practice if not a Worst Practice based on tens of thousands of cases we see here.

As with MucAfee which is even worse, simply uninstalling it will sometimes cure such problems. It requires its own special removal tool however like the worst viruses.

Be persistent with WIndows Updates installing whatever it provides, reboot, then check again.

Having Windows Updates set to Automatic is not sufficient because drivers come in under Optional Updates, so it requires Checking For Updates, installing any and all, then rebooting to check again. It may take some time depending upon what's going on with the MS Updates servers.

I'd also try uninstalling the driver along with software, running Updates again to install driver or importing the latest card driver from its Support Downloads website if necessary. If this fails I'd try physically reinstalling the driver checking slot for debris.

 

[renrav]

We started out tonight by removing the TrendNet driver that was installed the night before and uninstalled
Norton uninstalled using the Norton removal tool.

At this point Windows appeared to still have a network connection. So we rebooted and when the system came back up we were by all appearances functional.

The one remaining issue appeared to be Chrome. When we opened chrome the color quality would significantly degrade for the display. As well, we couldn't use the menu or load any webpages. The odd thing was the chrome icon had the UAC shield in the lower right corner.

I finally had him open the properties for chrome and after digging around found that the compatibility mode was set for windows xp sp3 and it was set to run in 256 bit color. No idea how that happened, but it resolved the issue.

During all of this we did some file cleanup and decided to call it night when we told the NVIDIA driver update to start downloading.

So next time we look at the system I plan to do some final scans, but I think at this point we have the system back up and running.

Remaining items:
-Install NVIDIA update
-Verify Windows Update settings and that all updates are installed
All we installed the night before
-Verify settings for Automatically get recommended drivers and updates for your hardware (Step 3)
Appears to be working already, but need to verify
-Run Anti-Malware Tools:
Spybot search and destroy
Malwarebytes
Super anti-spyware
Tdsskiller
Eset online
Combofix-bleeping computer
MSE
-Review Office Activation issue

I guess at this point, thanks everyone for the input. I expect that our scans won't find anything and now that Office has a network connection it will resolve it's activation issue. If anything else interesting shows up from the remaining items I'll reply again.

To summarize the fix -> Wired Connection and Run In Last Known Good Configuration

 

[gregrocker]

Spybot is old school and not recommended by anyone any longer. We recommend SuperAntiSpyware, Malwarebytes and MSE with the Win7 Firewall kept auto-updated.

If one of those doesn't find something then the others are really overkill.

 

[renrav]

I won't argue that SpyBot has probably reached it's EOL. However, the two most recent times I've dealt with malware, SAS and MWB found some items, but failed to completely remove the malware on the system. MSE has always been a joke when it comes to finding and removing most infections, despite how much I like how lightweight it is(I run it on all of my home systems so I don't feel completely naked).

ComboFix was critical for the first instance(it was the last I ran out of the list above).
It was hard to tell what resolved the last issue, since it was preventing me from uninstalling Strong Vault, which I assumed was part of the malware package, but in the end, I had to manually uninstall it.

If you comment was more, don't go through the whole list if those two don't flag something, then you may have a point.

Thanks again for the help. Hopefully this system will go back to being stable now.

 

[gregrocker]

If an infection isn't cleaned up after repeated attempts with reboots then google it and post it up in our Security forum for specialized cleaning tools. We are always wary when we see CombFix being used without prescription and supervision by Security experts.

If MSE isn't sufficient for my installs, I advise the users who get infected regularly to additionally install MB Real Time paid protection in Trial Mode to see if they like it for a month and then if so buy the lifetime protection. THis has ended any of them being reinfected.

 

[renrav]

Thanks for the feedback on security software.

Out of curiousity, why the concern about ComboFix?

 

[gregrocker]

Those I respect from our Security forums have warned me before not to suggest it wholesale without experienced supervision.

I was told there are a number of tools like this that should be prescribed based on the known infection or behavior.