mup.sys and 'safe mode'
There are no less than 3 reasons for this error. Hardware 40%, software 40% and unknown 20%. If you can boot normally but cannot boot into 'safe mode' I think I have the definitive answer.
This error is hardware independent and only occurs on systems NOT running a genuine copy of XP. You may need to borrow such a copy to test both the problem and the solution. Please be sure to re-install your genuine XP disk once you have completed testing. However the advice given under "CONCLUSIONS" below might well apply to ALL XP installations.
SUBJECT-
1) How to set up an XP system with no "safe mode" error.
2) How to bring about the error.
3) How to remove it.
4) How to prove the cause, and benefit from the knowledge.
METHOD-
1) Take any machine capable of running XP-Pro and fit a clean HDD.
2) Set up XP+SP2. Stay offline for now.
3) Optionally install a software firewall and turn its logs on. From these you can indepentently verify the conclusions below.
4) Reboot and test "safe mode". It will work.
5) Reboot, set a restore point (see 9 and 11 below), then go online and request a download of all MS Security Updates (from control panel / security center). It sent me 24,
6) Shutdown. Your machine will install the updates before switching itself off.
7) Restart the computer in 'safe mode' and it will freeze at MUP.SYS
8) Restart Windows normally, staying off-line.
9) From (control panel / add or remove programs) remove all security updates. Restore from the "Restore point"
10) Reboot the machine. 'Safe mode" now works correctly.
11) On the 3 unrelated machines I tested the 'Restore point' was not needed, but you can't be too safe.
CONCLUSIONS-
1) Security Upgrades are not only for your personal security. They also benefit Microsoft and agencies friendly with Microsoft.
2) The Security Upgrades are downloaded via SVCHOST.EXE. Data is also uploaded (in most cases without your knowledge) to many sites by SVCHOST.EXE.
3) Although SVCHOST.EXE is an essential file, many software firewalls can limit it to the "Trusted Zone"- ie 127.0.0.1 and 169.255.x.x (Kerio will do it, as will others)
4) Limiting net access to SVCHOST.EXE has NO appreciable effects except for preventing-
a) downloads of MS Security Updates
b) auto setting of the machine's RTC
c) the mysterious sending of data to tens of unknown IPs 100+ times a day.
5) These effects can be easily overcome as follows-
a) Run a full suite of freeware programs. SpybotS&D, Spyware Doctor, SpywareBlaster, AVGFree, Kerio, Peer Guardian, RegscrubXP and Adaware are among the better ones. Combined they aurguably provide MORE security than MS Security Upgrades.
b) Most freeware clocks will download only from sites you specify and without any need of SVCHOST.EXE.
c) I don't like my machine talking to strangers. I'm happy to lose this "undocumented feature".
HOW TO FIX a system that is already 'infected' with the "Safe Mode" bug-
1) Get a software firewall which can limit SVCHOST.EXE to your 'trusted zone'.
2) Install all of the above recommended software or equivalent, update and run it regularly.
3) Uninstall ALL MS "Security Upgrades" and re-boot. You will once again have 'Safe Mode' operating normally.
4) Stop using all MS software which requires access to the internet. Absolutely block IE, Outlook etc with your software firewall. Download alternative software- "Open Source" where possible.
5) Keep an eye open for new software wanting access to the 'outside world'. I have very few programs that MUST be open to untrusted zones- my Browser, Email, the freeware security programs, and a file sharer. Even Kerio is limited to the trusted zone.
