Blank blue screen after sign on screen

Alright, I am at a loss.
Here is the issue:
(Windows XP)
Turn on 'puter
Watch Windows page load (stare at blue scroll do its thing).
Select appropiate user and enter respective password.
Then there is nothing but a blank blue screen. No restart, no error messages, nada.
I can ctrl-alt-del then select New Item. Then I can browse through my drives, etc.
I was able to run a malware cleaner and got rid of a bunch of junk. That did not help.
I have started in Safe mode also - no difference except the screen is blank and it has safe mode written in the corners.
I have started with "restore to last known..." - still nothing.
Any suggestions? Thanks,
Len Q

If I was at work and you called me with this problem the first thing I would be thinking is something in the startup. I would try and get at it with hijackthis or autoruns just to see if there is something that shouldnt be launching or something that is starting and failing.

if you do a ctrl-alt-del can you open taskmanager (taskmgr) and try newtaskrun> www.google.com?

Yes. I can run the task manager and run new tasks. But i did try to run internet explorer and it would not connect to the internet. But i only did it once. i can try it again tomorrow. I am not at that computer at the present.

reboot it, take it out of savemode, reboot and see if you can online. getting some tools on it would be helpful.

Do you have a homeland security build? Seriously.

Not sure about the homeland security build. but i doubt it. according to the owner, it has been working fine until this week.
I will run hijack this on it and see what i find. i will keep you posted.
Len Q

Try running 'explorer.exe'. [without the ''s of course] See if that will give you anything. If you ran malware scans, and cleared off a whole bunch of junk, and are still having problems like this, I would look into reinstalling the OS. I would assume there is still some crud buried in there somewhere. You can try to burrow it out, but you are very likely going to break things in the process, and may never actually have a clean system.

I know it is a pain, but you may want to start looking for those install disks.

Just my two cents. :)

Hi,


Before you do anything too drastic, have you tried all the user accounts?

Quote:

---

Select appropiate user and enter respective password.
Then there is nothing but a blank blue screen. No restart, no error messages, nada.

---

That could be a corrupted user profile, such that it cannot find the desktop to load?

I assume that you have checked the system logs and found nothing? Windows is not terribly good at reporting user profile errors.:(

Have you tried the administrator account?

http://windowsxp.mvps.org/admins.htm

Nihil,
Yep - even tried the admin acct. still nothing

Westin,
explorer.exe does nothing when i try it. unfortunately, we cannot find the install disk.
You think I could burn a recovery disk at home and use it? Hmmm....

Come to think of it, let me add another piece of info to the pie. Upon start up, there pops up a window that says that Windows is not genuine. It gives two buttons - "Genuine" and "Resolve later". Owner says it has been doing that since she bought it. I will need to get some more info on this one.

Is there a license sticker on the machine??

You cant use a recovery disk made one one machine... on another machine....but you maybe able to use the recovery console and repair the registry. You need an XP install disk to do this.

MLF

Yes, you can use the recovery console, although that might not fix your problem.

I seem to recall that it asks for the product key if you try to do a repair install of Windows.

AFAIK MLF is spot on with the recovery disks..............they are machine specific.

You stated taskmanager runs and you are able to run programs using 'new task'. You also stated that you can browse files on your machine. On the input-address line, type "iexplore www.microsoft.com". iexplore or iexplorer? If that works, keep searching the site until you run into windows update.

Do other users get a blank screen? No? Sounds like a corrupted profile in "Document settings" or the registry not launching explorer. The windows upgrade challenge may whip the computer back into shape. Or you could put the Service packs on a usb thumb drive and go for the kill.

I figured as much about the system recovery disk.
Linenoise - yes all users get the blank blue screen. I will check your suggestions and see what happens.

Does the machine have a COA (certificate of authenticity) sticker attached to it? This should have the product code on it.

http://www.microsoft.com/resources/h...nt.aspx?pg=coa

If so you might try this:

http://www.microsoft.com/genuine/sel...d-467a1ed00178

What service pack is the XP installation at?

Where is gore? Isn't this his queue to step in and say something about Slackware? :D

Where did she get the computer from? How long ago? Still under warranty? [I would guess not if she is pursuing other options for repair] ... If it is from a manufacturer, she can more than likely call in and request recovery cds. She may have to pay, if the machine is out of warranty, but I have seen them cost as little as $16 [HP] to as much as $45 [IBM/Lenovo] ... If she got it at a mom/pop computer place, and they have not gone OOB due to the recession [:rolleyes:] ... A trip to that store may prove beneficial.

Nihil,
It does have the COA sticker. I followed the link and entered the hash code. It would not take. Something wrong with the server or something. it said to try again later.
It is as service pack 2.
how is the best route to get to the control panel through the task manager. I cannot find it. I tried Hijack this also, Here is the log.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:33:54 PM, on 2/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AVG\AVG8\aAvgApi.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {57DB41D0-C624-4204-AD4D-4147534C1E0D} - C:\WINDOWS\system32\pmnnn.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: CBHOBJObj Object - {8A406068-D45C-40B9-A096-38AC717FB608} - C:\WINDOWS\BHOBJ.dll (file missing)
O2 - BHO: AVG Security Toolbar - {a057a204-bacc-4d26-9990-79a187e2698e} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
O4 - HKLM\..\Run: [WinfernoUpdate] "C:\Program Files\Common Files\Winferno\WSCUpdtr.exe"
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\RunOnce: [*Restore] C:\WINDOWS\system32\restore\rstrui.exe -i
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\RENEE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: YourScreen.lnk = C:\Program Files\YourScreen\YourScreen.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-c23a-453e-a040-c7c580bbf700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1142208365562
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://cvs.pnimedia.com/upload/activ...pv2.0.0.9.cab?
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: khfecbb - khfecbb.dll (file missing)
O20 - Winlogon Notify: mljgd - C:\WINDOWS\system32\mljgd.dll (file missing)
O20 - Winlogon Notify: vtstt - C:\WINDOWS\system32\vtstt.dll (file missing)
O20 - Winlogon Notify: vtutr - C:\WINDOWS\system32\vtutr.dll (file missing)
O21 - SSODL: FFpTNDpq - {581ADFF6-F2B0-755C-DBEF-A3CC75A372CD} - C:\WINDOWS\system32\xuf.dll
O23 - Service: ArcSoft Connect Daemon (acdaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7824 bytes

This is the error message when trying to validate windows.
"The product key could not be updated on your computer. This may be due to technical difficulties or network connectivity. "

Hi,

<Task Manager>
<New Task>
Control Panel

Then "enter"

The program is:

C:\windows\system32\control.exe

You might be able to start explorer from task manager and get at it that way if the direct route doesn't work?

As for HJT! Get rid of this lot:

02-BHO: (no name)........pmnnn.dll (file missing)
02-BHO.............BHOBJObj (file missing)
There are 4 entries 020- Winlogon Notify with (file missing)

04-HKLM\.....Advanced Cleaner Free\ian_monitor.exe which is VERY BAD!

http://www.bleepingcomputer.com/star...exe-20635.html

i will try the indirect route: C:\windows\system32\control.exe
This does not work:
<Task Manager>
<New Task>
Control Panel

Then "enter"

Thanks for the info from HJT. I will get rid of that tomorrow also.

It appears to be something with the startup. at least to me. but i have run msconfig and tried with "diagnostic start up" and "selective start up" and deselecting start up files. still the same blue screen. I tried with a different user name and it does bring up a wallpaper (as opposed to a blue screen which I am now assuming that is the wallpaper). It just does not have any icons, start bar, or anything.
Also, I tried to right click on the blank blue desktop...nothing happens.


(I tried Microsoft update - no updates found. Mainly because I cannot validate Windows. I will try again tomorrow to do that. )

I also found this as a possible solution. before i try it i would like to get your opinions.
www.kelly-korner-xp.com/xp_tweaks.htm

I am afraid your link doesn't work :(

What make of computer is this? If it is a brand name like HP, Dell, Acer, Lenovo or whatever you are probably limited, and will need to get recovery disks from them.

If it is a small builder or DIY job then you should be able to do a repair install using a similar XP CD and your COA.

What intrigues me is the blue screen. Normally in these circumstances I would expect it to be black with possibly a little white cursor in the top left corner.

• A BSOD always comes with an error message in white characters.

• The fact that you can get into things via Task Manager tells me that Windows has loaded.

• This suggests to me that the problem is with loading the desktop, and, as it is the same for all users this is the general desktop handling mechanism, not the user profile.

Try going into <display properties> and <desktop>. Down the bottom tight you will see a box labeled "color". Is the default blue the same colour as you get on bootup?.................it is not as bright as a BSOD

As it will only take a few minutes, you might try changing the theme, desktop and wallpaper and see if that has any effect.

Another thing I would try is hitting the Windows Key + R. This should bring up the run prompt (if not go through Task Manager). Type sfc /scannow run it (note the space and double "n").

You will need an XP installation CD of the same type (Pro/Home & SP), and it will prompt you to insert one.

You should get the message:

"Files that are required for Windows to run properly must be copied to the DLL cache"

It will then run the Windows systems file check and hopefully fix any problems.

sorry forgot an 's' - www.kellys-korner-xp.com/xp_tweaks.htm look for Number 195.
It is a Dell. I will try your suggestions regarding the properties.
as far as the sfc /scannow - they cannot find the install or recovery disks. it looks like they are going to need to buy them before this is fixed. but i will try a few more things first.

Yeah, that might work, as it does seem to be a general problem with loading the wallpaper and icons?

As you have a Dell, would you just check in your root directory for this:

C:\I389

If you have that folder it is a copy of the XP installation CD. When sfc /scannow asks for the CD, point it at that directory and it should work ;)

You dont really need to buy the disk...you just need a copy of an XP install disk for recovery....any old one will do.

If you were going to reinstall a copy of an OEM XP disk will do...as you have the key on the sticker.

Sometimes they will have a recovery partition on the harddrive...a boot disk will confirm this.

Be very carefull using the recovery from Dell...sometimes it will format the drive.

Best to copy the data and off the drive...format and reinstall is sometimes the fastest most affective approach.

MHO

Tami

Quote:

---

Be very carefull using the recovery from Dell...sometimes it will format the drive.

---

Yes I have seen that sort of thing with several other OEMs. They consider "recovery" to mean restoring the system to its ex-factory state, and they often didn't warn you that that would be what would happen :(

That's why I suggested looking for the I386 folder.

Quote:

---

If you were going to reinstall a copy of an OEM XP disk will do...as you have the key on the sticker.

---

That's the "system builder's" version, not the OEM one that sometimes ships with preinstalled software machines from Dell, HP and the others. They generally check manufacturer and model.

Yes you are right Nihil...the system builder OEM is what I am talking about.

It will install on pretty well anything as long as you have an OEM key.

MLF

HJT - all entries deleted based on suggestions herein.

Cannot find C:\I389 (or I386)

Cannot find control panel through task manager or manually searching c: drive.

kellys-korner tweak also did not fix the issue.

At this stage I would get an OEM System Builders' copy of XP and try sfc /scannow

Obviously, the retail version is the best, as it will run on anything.

How to tell?................... just look under the Windows XP 1-2 Processors heading on the COA label on the donor machine. If it says "OEM Product" it is OK. Also the CD shouldn't have any brand name on it other than Microsoft.

Have you managed to get the current installation authenticated by Microsoft?

EDIT:

I am guessing that C:\WINDOWS\ doesn't have the file explorer.exe in it?

Try copying the file from a working XP2 installation and installing it there.

You might even try this from M$................. it even has one of those fancy new Billygoat Gates will fix it buttons. :lildevil:

http://support.microsoft.com/kb/945402

It won't work because something (probably some anti-malware crapware) has deleted it or moved it into quarantine. However, please do try it just to prove the point.

your right, it did not work.
i will try to get a hold of XP install CD and go from there.

My thanks to all who have tried to help resolve. I will keep everyone updated.
Len

Good luck!

You might first try copying explorer.exe from an XP SP2 machine and rebooting.

Otherwise download SP3 to a CD/DVD or stick drive and try installing that. It might work as it replaces the SP2 version of explorer.

:)

I'm a little shocked no one asked this, but I'm going to so I'm not curious anymore:

What happened to the machine before this happened? I've personally never seen this before. When I first read this I thought for sure a Graphics card issue but then I remembered they said the boot up screen displayed just fine so it couldn't really be that....I don't think.

Anyway, what was happening before this happened? Was there anything changed? Anything installed?

The only thing new that i know of that was done to the box prior to this issue was the SP2 download. There are two computers in the house on the same wireless system. The other computer had the Antivirus 360 malware on it. It cleaned up just fine.
I have run several Avast, AVG, Spybot, Malwarebytes Anti-malware, etc. Everything appears clean now.
It is almost like the files to load the desktop icons and task bar have been deleted or corrupted. Could have also been by something that was cleaned up but now i need to get back over to the machine to see if i can repair it with an install disk/Sp3, etc.

OK. I was just wondering because the problem itself was out of the ordinary. Hope it works with that CD. If you recall, was there anything like desktopshell, or explorer that was marked for deletion from infection?

To all:
It has been fixed.
For some reason, the explorer.exe file was missing. I loaded one from a working 'puter and BAM!. I have the desktop back. WOW you should have seen the updates that were needed once it came back online.
Anyway, thanks to all that helped. Now I think i found the culprit. I will repost in the virus area. I have a Trojan Horse win32/PEpatch.ao that I cannot get rid of. Running AVG but it will not heal it. I think i will have to disable AVG then run Spybot or something. It seems to be a nasty little bugger.

Thanks again for the help.
Len

Hey Len,

Good man yourself sir...............

Quote:

---

I am guessing that C:\WINDOWS\ doesn't have the file explorer.exe in it?

Try copying the file from a working XP2 installation and installing it there.

---

Been there mate! :D

We need to get rid of the crapware then harden the machine?

Stay tuned.............. I would love to help you get rid of the little bugger, and set the minefield ;)

By the way, in case you think that I am "condescending"........... actually I am English :lildevil:

Johnno