Windows XP THINKS it’s in Safe Mode

Home Forums Client Operating Systems Windows 2000 Pro, XP Pro Windows XP THINKS it’s in Safe Mode

This topic contains 24 replies, has 16 voices, and was last updated by Avatar trevorn676 2 years, 7 months ago.

Viewing 25 posts - 1 through 25 (of 25 total)
  • Author
    Posts
  • Avatar
    sruliwolff
    Member
    #131563

    I have an interesting scenario on one of my clients machines.

    They had a bunch of malware on one of their computers which we cleaned no problem, there was one issue with one of them (Vundo) which gets itself in the winlogon portion of the registry which we fixed using Atribune’s Vundofix tool.

    That was all fixed about two weeks ago and the computer ran fine till last Friday.

    As of friday when the computer is switched on, it boots into normal mode (screen resolution is fine, programs are starting in the taskbar) but most of the services were not running, when I tried to start them manually it says error 1084: cannot start in safe mode. The virus scanner obviously isn’t running because the services aren’t.

    I even tried running a windows repair (inplace upgrade) using the xp sp2 cd but it did the first portion (copying and seting up some of the files) but now everytime it boots it tries to finish the installation but it says it cannot continue in safe mode you have to boot into Normal Mode, but it is in Normal Mode.

    Computer running Windows XP Pro sp2.

    Has anyone come across this before?

    Any help is appreciated.

    Thanks

    Sruli

    Avatar
    sorinso
    Member
    #265765

    Re: Windows XP THINKS it’s in Safe Mode

    Hmmmm…
    Have you checked the Event log?
    What will happen if you DO boot into Safe Mode, and then do a normal restart again?

    Avatar
    sruliwolff
    Member
    #324233

    Re: Windows XP THINKS it’s in Safe Mode

    The only thing in the event viewer is the event of the services trying to start at the bootup and some COM errors with the following error:

    The COM+ Event System detected a bad return code during its internal processing

    Sruli

    Avatar
    sorinso
    Member
    #265767

    Re: Windows XP THINKS it’s in Safe Mode

    Try to boot in Safe Mode and then Restart in Normal Mode.

    Avatar
    sruliwolff
    Member
    #324234

    Re: Windows XP THINKS it’s in Safe Mode

    Tried booting into safe mode and then back into normal mode, but nothing changed.

    I then tried running a repair on Windows XP, but the second stage of the repair (after the copying it boots into windows and resetups all the drivers and windows files) wouldn’t continue because as before “windows repair cannot continue in safe mode”.

    I didn’t have time, so I backed up the data, reinstalled and restored the data.

    Either way, it’s a very interesting issue and one I had not encountered in the number of years working in this field.

    If anyone comes across it and finds a fix I’d be interesteed to know.

    I think it was a registry entry that was corrupt somewhere telling the winlogon and services that it was in Safe Mode when it really wasn’t.

    Thanks for trying.

    Sruli

    Avatar
    sorinso
    Member
    #265783

    Re: Windows XP THINKS it’s in Safe Mode

    I’m sorry that couldn’t help you more…
    Thank you for updating the forum.

    Avatar
    jfox
    Member
    #334752

    Re: Windows XP THINKS it’s in Safe Mode

    sruliwolff,

    I am experiencing the exact same problem and cannot resolve.

    Is my only option to reload the whole system?

    Thanks.

    Jon

    Avatar
    AndyJG247
    Member
    #320601

    Re: Windows XP THINKS it’s in Safe Mode

    It is usually better to make a new post rather than drag up an old one.

    If you are technical it may be worth looking at this post and seeing if you can have a look at these registry settings, maybe something is calling this, especially if you have had a virus/adware problem,.
    http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/
    http://www.pctools.com/guides/registry/detail/213/

    Avatar
    GrantThomas
    Member
    #325427

    Re: Windows XP THINKS it’s in Safe Mode

    system restore will work just fine if you got restore points, if it doesnt ask you to go into system restore (no repair) then goto cmd prompt and type msconfig and goto the system restore.

    Avatar
    sruliwolff
    Member
    #324235

    Re: Windows XP THINKS it’s in Safe Mode

    If you plan on trying to figure it out I can only give you one piece of advice:

    DON”T TRY TO DO A REPAIR.

    I had to format and reinstall the OS as I tried to do a repair and then in the second part of the repair after it copies the files and then reboots to finish the configuation it wouldn’t finish it as it says it could not run the repair in SAFE MODE.

    Every reboot after that tried to finish the repair and wouldn’t run in SAFE MODE even though it was booting into regular mode.

    Sruli

    Avatar
    Salsero
    Member
    #335186

    Re: Windows XP THINKS it’s in Safe Mode

    I have had the same problem, also after having successfully removed various viruses etc from my son’s PC. XP assumed to be in safe mode presumably because of the environment variable SAFEBOOT_OPTION that had been set to “NETWORK”.

    This can for instance be checked by selecting: start-control-system, selecting the tab “advanced” and pushing the button “environment variables”. Scrolling the list of system variables should show whether the (cause of) the problem is the same, e.g. SAFEBOOT_OPTION being listed as having a value (whether NETWORK or MINIMAL).

    If this is the case, then open the registry and look for every instance of “SAFEBOOT_OPTION” and reset the value from 2 to 0 (do not delete the key alltogether!). The 2 essential places where you will probably find the entry are HKCU – environment, and HKLM – system – currentcontrolset – sessionmanager – environment. After rebooting however, the keys re-appeared until I removed the key OPTION(S?) at every occurrence of “Safeboot” under HKLM – Controlset001, Controlset002 etcetera, Currentcontrolset – Control – Safeboot (if I remember correctly, the OPTION key appeared under “Safeboot” next to “Minimal” and “Network” and had a value “NETWORK”. For some reason that I was not able to determine, after rebooting, the system announced that during bootup it had experienced a severe exception error (I did not see it, however), but the system was fully operational thereafter anyway. After a second reboot, the error did not occur anymore and the services necessary to carry out Windows Update could be started again.

    Hope this posting helps jfox and/or anybody else having the same problem. I extensively searched the internet for solutions and found none, before I attempted to find a solution myself.

    If anybody tries to resolve the problem in the same way, please let me know whether it worked for you as well.

    Avatar
    aabbondanza
    Member
    #337554

    Re: Windows XP THINKS it’s in Safe Mode

    Salsero;113527 wrote:
    If anybody tries to resolve the problem in the same way, please let me know whether it worked for you as well.

    Tried it & it worked. Only had to change the first instance of Option to 0 on the one I’m working on. After changing it the others I found were already 0. Rebooted with no error & XP now working great. After the reboot, I delete the blank SAFEBOOT_OPTION variable from the System Variables (as it shouldn’t be there). Thanks.

    AA

    Avatar
    Salsero
    Member
    #335187

    Re: Windows XP THINKS it’s in Safe Mode

    Glad it worked for you as well :razz: Thanks for the feedback!

    Salsero

    Avatar
    hsandlar
    Member
    #339488

    Re: Windows XP THINKS it’s in Safe Mode

    I registered to this forum just to share this solution for people in the future.
    I work as a PC repair technician and encountered this on a customer’s computer a while back.

    1. Go to Start > Run > type ‘regedit’
    2. Edit > Find > ‘SafeBoot’
    3. When the SafeBoot key is found in the registry there should be two subkeys, ‘Minimal’ and ‘Network’, if there is a third subkey ‘Option’, delete the entire option subkey and the problem will be solved

    Havn’t seen this fix anywhere else on the internet. This was my find personally. Hope it helps someone out.

    Avatar
    Salsero
    Member
    #335188

    Re: Windows XP THINKS it’s in Safe Mode

    Salsero;113527 wrote:
    I removed the key OPTION(S?) at every occurrence of “Safeboot” under HKLM – Controlset001, Controlset002 etcetera, Currentcontrolset – Control – Safeboot (if I remember correctly, the OPTION key appeared under “Safeboot” next to “Minimal” and “Network” and had a value “NETWORK”

    The above was posted on the 17th of July. I therefore wonder a bit about:

    hsandlar;117013 wrote:
    When the SafeBoot key is found in the registry there should be two subkeys, ‘Minimal’ and ‘Network’, if there is a third subkey ‘Option’, delete the entire option subkey and the problem will be solved

    Havn’t seen this fix anywhere else on the internet. This was my find personally. Hope it helps someone out

    Neverthless I appreciate the intention to let others share good solutions …

    Regards,

    salsero

    Avatar
    sibe
    Member
    #347118

    Re: Windows XP THINKS it’s in Safe Mode

    Thanks to you, it worked for me ! I was wandering on the web for 4 days searching for a tip on this problem, and now all is fine :D

    But what is the reasoning which drove you to this solution ? I found nothing in Microsoft KB or other places for that… In any case, thank you still !:beer:

    Avatar
    Salsero
    Member
    #335189

    Re: Windows XP THINKS it’s in Safe Mode

    Hi Sibe,

    glad it worked for you !

    If I remember correctly, I started looking at the environment variables simply because I thought this might be one of the information sources from which windows might derive thinking that it was in safe mode.

    Seeing the SAFEBOOT_OPTION with value “NETWORK” made me searching the registry for “SAFEBOOT_OPTION”, finding the locations where it was set.

    As this however did not solve the core of the problem (since the values re-appeared after booting) I searched for the cause of that. I think that the link given in this thread by AndyJG247 (many thanks!) to the blog of Didier Stevens finally put me on the right track. Although the blog relates to a different problem (not being able to enter safe mode), there it is shown what the regular entries under the SAFEBOOT key should look like (the “options” sub-key is not mentioned there).

    Avatar
    Razzler
    Member
    #348321

    Re: Windows XP THINKS it’s in Safe Mode

    Just signed up to confirm these instructions work. I only had to change the HKLMSYSTEMControlSet001ControlSafeBootOption OptionValue setting from 2 to 0. Rebooted the computer and when I heard the Windows startup music knew it worked.

    My original Google search term was “error 1084 this service cannot be started in safe mode computer is not in safe mode“.

    I’m guessing this problem is originally caused by some malicious software tinkering in the registry.

    Thanks to Salsero.

    Avatar
    Affy
    Member
    #348756

    Re: Windows XP THINKS it’s in Safe Mode

    SafeBoot Quandary: :rolleyes:

    Recently, was working with a User who had this problem and could not enable the AntiVirus program or the Firewall. Kept getting Error 1084, etc.
    The following approach, where Option Value is changed with REGEDIT4 from “OptionValue”=dword:00000002 to “OptionValue”=dword:00000000 worked, and the AV and Firewall were enabled:

    [HKEY_LOCAL_MACHINESYSTEMControlSet004ControlSafeBootOption]
    “OptionValue”=dword:00000000
    [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootOption]
    “OptionValue”=dword:00000000

    However, have seen the approach where the Option subkey, which is not a default SafeBoot key, is nuked, and the value SAFEBOOT_OPTION REG_SZ NETWORK is negated with “SAFEBOOT_OPTION”=- as follows:

    [-HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootOption]
    [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerEnvironment]
    “SAFEBOOT_OPTION”=-

    Avatar
    Glock
    Member
    #361944

    Re: Windows XP THINKS it’s in Safe Mode

    Salsero;113527 wrote:
    I have had the same problem, also after having successfully removed various viruses etc from my son’s PC. XP assumed to be in safe mode presumably because of the environment variable SAFEBOOT_OPTION that had been set to “NETWORK”.

    This can for instance be checked by selecting: start-control-system, selecting the tab “advanced” and pushing the button “environment variables”. Scrolling the list of system variables should show whether the (cause of) the problem is the same, e.g. SAFEBOOT_OPTION being listed as having a value (whether NETWORK or MINIMAL).

    If this is the case, then open the registry and look for every instance of “SAFEBOOT_OPTION” and reset the value from 2 to 0 (do not delete the key alltogether!). The 2 essential places where you will probably find the entry are HKCU – environment, and HKLM – system – currentcontrolset – sessionmanager – environment. After rebooting however, the keys re-appeared until I removed the key OPTION(S?) at every occurrence of “Safeboot” under HKLM – Controlset001, Controlset002 etcetera, Currentcontrolset – Control – Safeboot (if I remember correctly, the OPTION key appeared under “Safeboot” next to “Minimal” and “Network” and had a value “NETWORK”. For some reason that I was not able to determine, after rebooting, the system announced that during bootup it had experienced a severe exception error (I did not see it, however), but the system was fully operational thereafter anyway. After a second reboot, the error did not occur anymore and the services necessary to carry out Windows Update could be started again.

    Hope this posting helps jfox and/or anybody else having the same problem. I extensively searched the internet for solutions and found none, before I attempted to find a solution myself.

    If anybody tries to resolve the problem in the same way, please let me know whether it worked for you as well.

    Have just registered here only to say thank you very very much for this.

    I have been working on a clients pc for a few days, to try and cleanup after a mass infestation of Virus’ and Malware.

    The pc was completely at a standstill, with 42 Viruses being present. After a sweep ‘n’ clean, I had some bits and pieces to sort; primarily winsock; however, after all of that I was ‘Stuck’ in safe mode, but NOT actually in safe mode.

    I followed the steps meticulously and it has worked.

    Thank you very very much, I know it’s an old thread, but I really wanted to join just to say; Ta very much! :grin:

    hsandlar;117013 wrote:
    I registered to this forum just to share this solution for people in the future.
    I work as a PC repair technician and encountered this on a customer’s computer a while back.

    1. Go to Start > Run > type ‘regedit’
    2. Edit > Find > ‘SafeBoot’
    3. When the SafeBoot key is found in the registry there should be two subkeys, ‘Minimal’ and ‘Network’, if there is a third subkey ‘Option’, delete the entire option subkey and the problem will be solved

    I too work as a pc repair chap, and must say that this key was a lot easier to find than manually searching for all the Network keys.

    Though I’m sure the finds (ie: yours) were through searching the net, as many must have, and stumbling across this thread.

    Cheers guys. :beer:

    Sorry to bump an old thread, but just had to say ta for a fix which was bloody frustrating and annoying.

    :mrgreen:

    Avatar
    AndyJG247
    Member
    #322970

    Re: Windows XP THINKS it’s in Safe Mode

    Thanks for posting Glock, it is good to get feedback, please stay around! :)
    Thanks also to Salsero for the post. This is what the forums are for.

    Avatar
    skeeter t.
    Member
    #361943

    Re: Windows XP THINKS it’s in Safe Mode

    Add me, too. Thanks!! This was the oddest one yet for me…..problem, that is!!

    Avatar
    bigbearh
    Member
    #366611

    Re: Windows XP THINKS it’s in Safe Mode

    This solution worked for me too! Thanks!

    Scenario:
    I removed virus and malware (Total Recovery) with combofix and then couldn’t do windows updates or install some things (system said I was in safe mode but I wasn’t).
    Also for me, the PC audio device wasn’t recognized, AND the PC booted to
    only a window with a dos ‘cmd’ prompt.

    looked for:
    HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootOption

    I first modified OptionValue dword value from 2 to 0
    reboot and sound worked fine and windows updates started to work fine! (still had dos prompt only)

    Then modified UseAlternateShell dword value from 1 to 0
    Now PC is all better and boots normally into explorer.exe

    Great thread! Hope my story helps others.

    James

    Avatar
    meme
    Member
    #391453

    Eight years after he originally posted his fix, I too joined this forum just to extend my GREATEST THANKS to Salsero for his fix, which worked for me after I spent hours searching for a solution. This was truely a life-saver for me, allowing me to fix a problem for one of my customers that two previous companies had given up on as “unfixable” without an OS reinstall. By the way, this fixed the issue on a Windows 10 PC.

    Avatar
    trevorn676
    Member
    #391657

    Like bdbower, I too joined up in order to offer my sincere thanks to Salsero for the information which resolved this troublesome problem, and without the reinstall that was becoming imminent as each earlier system restore failed. Note too that even as we reach 2017, there is at least one sad person still running XP SP3 who has benefitted from this information still being published in this forum.

    For those who may be searching for similar problems, here is a brief description of my situation, so that others may pick up on keywords:

    1) Avast 2015 not updating and then disabled itself, so removed with “Avastclear” which has to run from SafeBoot (I chose SafeBoot with Networking). Tidied-up with CCleaner.
    2) On Reboot, Peerblock failed – can’t load IP Traffic Filter Driver as in SafeMode!
    3) DeviceManager (Non-Plug and Play Drivers) tried manual start of IP Traffic Filter Driver (see Properties > Driver). Again reports that can’t start in SafeMode.
    4) Found forum and Salsero recipe: in Registry searched for and removed three SafeBoot 3rd values “Option” (left Minimal and Network) and reset three SAFEBOOT_OPTION values to “0”.
    5) In System Properties > Advanced > Environment Variables deleted SAFEBOOT_OPTION environment variable and rebooted. Fixed.

Viewing 25 posts - 1 through 25 (of 25 total)

You must be logged in to reply to this topic.

Register for this Petri Webinar!

Want to Make Your Backup Storage Unlimited & Ready for the Cloud? – Free Thurrott Premium Account with Webinar Registration!

Tuesday, August 27, 2019 @ 1:00 pm EDT

A Scale-Out Backup storage infrastructure is a must-have technology for your backups. In this webinar, join expert Rick Vanover for a look on what real-world problems are solved by the Scale-Out Backup Repository.

Register Now

Sponsored By