The How-To Geek Forums Have Migrated to Discourse


How-To Geek Forums / Windows XP

(Solved) - Windowx XP Blue Screen immediately after user login

(5 posts)
  • Started 7 years ago by CantLoginWinXP
  • Latest reply from CantLoginWinXP
  • Topic Viewed 6224 times

CantLoginWinXP
Posts: 0

I'm using Windows XP Professional, Service Pack 2. I do not have windows backup/recovery enabled, so I unfortunately can not just restore a previous backup.

I am able to login as Safe Mode so I'd guess it's not a hardware issue.

My computer worked fine last night, i did not instal any new software/updates yesterday and I shut down my computer normally, then this issue came up when I turned my computer on this morning. My computer boots up fine until it gets to the Windows screen to choose which user to login as. Once I choose one it crashes within 1-2 seconds after I type my password and hit enter. It just says "Loading user data..." or whatever then crash.

At this point it was previously rebooting, but I logged in as Safe Mode and disabled the "reboot on crash" thing so that I get a blue screen instead. My blue screen says the usual stuff about "a problem was detected... blah blah" then:

"Technical information:
*** STOP: 0x0000008E (0xC0000005, 0xF82B55D5, 0xF820D788, 0x0000000)

*** Ntfs.sys - Address F82B55D5 base at F82B5000, DateStamp 4198e35b

Beginning dump of physical memory
Physical memory dump complete."

One note about this blue screen, in the line "*** STOP: ..." the number 0xF820D788 is different everytime it crashes, otherwise the entry is the same

When I login with Safe Mode and check the Event Viewer (Control Panels --> Administrative Tools --> Computer Management), it has an entry for each crash:
Event ID: 1001
Type: Information
Source: Save Dump
Description: "The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008E (0xC0000005, 0xF82B55D5, 0xF820D788, 0x0000000). A dump was saved in: C:\WINDOWS\Minidump\Mini120710-10.dmp"

I don't know how to read the .dmp files (i tried opening in notepad but it was just random characters), so that was a dead end for me.

My failed attempts at fixing it from Safe Mode follow:
1) I ran a virus scanner (that I downloaded from Avira.com) and deleted a couple of random viruses (I hadn't run a virus scanner in a while), rebooted without safe mode and still getting the blue screen.

2) I checked my ntfs.sys file in the folder C:\WINDOWS\system32\drivers using Safe Mode and it has a date modified of 11/15/2004 so it doesn't look like that file has changed recently. I copied the ntfs.sys file from my other WinXP computer onto the crashing one to see if that would help (the file I copied appears to be a newer one, it has a date modified in 2008). That didn't solve my blue screen problem though, so I switched back to the original ntfs.sys file.

3) Using Safe Mode I checked the Event Viewer to see if there were any suspicious looking entries under System or Application, but didn't find much. Under Application there were 3 Errors, but they all show up in the logs going back a long time apparently at the start of every reboot and always in the same order (i listed them first to last). These have been happening for as long as my logs go back, so I don't think that they're the source of any problems, but I'm no expert so I'm providing as much info as possible in case I'm missing something. They are:

- First one:
Event ID: 10005
Source: DCOM
Description: "DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." attempting to start the service EventSystem with arguements "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

- Second one:
Event ID: 7001
Source: Service Control Manager
Description: "The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it."

- Third one:
Event ID: 7026
Source: Service Control Manager
Description: " The following boot-start or system-start driver(s) failed to load:
Fips
intelppm
SCDEmu"

Any ideas? Require any further details from me?

Posted 7 years ago
Top
 
CantLoginWinXP
Posts: 0

Update: I did get it to boot in non-Safe Mode by first going into Safe Mode and loading msconfig.exe, and under the General tab unchecking every box.

I tried first by unchecking Process SYSTEM.INI File, Process WIN.INI File and Load Startup Items but leaving Load System Services checked and it was still crashing.

So something in the System Services is crashing on login :-/

Posted 7 years ago
Top
 
CantLoginWinXP
Posts: 0

I managed to narrow it down by using msconfig to turn off all services which allowed me to login normally. So I then enabled half of the services, crashed, disabled half of those that I enabled, ...repeat. Until I narrowed it down to the service "Plug and Play" being the source of my crashing. I can login normally with all services except for Plug and Play on.

I used Method #2 here: http://support.microsoft.com/kb/310353/ to narrow down the issue, so if anyone in the future has a similiar problem I recommend they try that. It was still crashing until I got to the optional Step #4, so after that I just started turning things on until it crashed. It took an hour or two but it really did narrow down the issue well (and I felt like I was making progress so that's good :-) ).

Now I need to repair the Plug and Play service or something if I want that to work again, so that's kind of a whole other issue than this topic began at.

I'll post the solution that I find here when/if I find it. Or if anyone knows how to "fix" Plug and Play (repair?) then please post.

Posted 7 years ago
Top
 
marks100
Posts: 0

This may help http://www.resplendence.com/whocrashed

mark.

Accepted Answer · Posted 7 years ago
Top
 
CantLoginWinXP
Posts: 0

Thanks marks100, that program helped. It showed another crash that I was geting involving aec.sys and error code 0x10000008E.

I looked into windows\system32\drivers and found that there was an aec.sys.bak file that was the size that it was supposed to be (142k), and my aec.sys (700k+) was last modified on December 7th, the day that I started having problems. So I went into recovery console and copied the aec.sys.bak file overtop of aec.sys over-writing it.

Problem solved, I can now enabled "Plug and Play" again and everything works fine.

Problem solved!

Posted 7 years ago
Top
 



Topic Closed

This topic has been closed to new replies.