Recurring Windows XP stop error with blue screen

[XMan]

OK, this has happened on this particular machine twice in the past couple of months. The procedure listed on the MS website fixes the problem, but it eventually comes back. Any ideas as to a root cause?

Windows XP
AMD 3200+
Abit NV7
1GB RAM (2x512, matched pair)
Enermax 351VGP 350W PS
Dual WD1200JB's on IDE1
CD-RW and DVD+RW on IDE2
WD800JB on port 1 of Promise Ultra 100
ATI Radeon 9600 AIW
Onboard Sound in use
Onboard Network in use
Some sort of wireless USB Keyboard/mouse . . . Viewsonic I think?

My initial response is to update the NForce chipset and video card drivers, as well as the Promise drivers and BIOS just in case.

Any other ideas as to what might be causing this problem? Memory, perhaps?

 

[jyates]

I would try different memory and give it a chance to prove or disprove
if that's the problem.

 

[OdiN]

Usually this is caused by flaky RAM which causes data corruption, or also a HD that is going out can cause this.

 

[VirtualLarry]

Well, I've known W2K and XP system registry-corruption to occur from several things. Since the registry is stored in RAM, flaky RAM can cause issues when it is written back out to disk. Another thing that can cause it is the type of shutdown that you use, and this also relates to your IDE controller drivers.

Is the XP OS installation, connected to the HD on the mobo IDE controllers, or to the Promise controller?

I'm going to go out on a limb here, and suggest that you probably have your XP system default-configured to actually power-off your system on shutdown. This is probably THE most likely cause of this issue, next to bad RAM. The problem is that Windows' writes out the registry as one of the last things that it does before shutting down, and modern HDs with large caches, with write-cache enabled, will signal to the system that the data is "written", even though it hasn't actually been written to the disk, only to the HD's onboard cache buffer. The Windows' OS, meanwhile, thinks that it is done writing to disk, and then signals the mobo to trigger the switch to shut-down the ATX power-supply. This kills the power to the poor HD, that is in the process of writing that last chunk of data in it's memory-buffer out onto the actual disc platter. Unfortunately, if the power gets cut out too soon, it cannot finish doing that, so it aborts the write and retracts the heads off of the platter so as to not cause a "head crash" when power is cut.

So that last bit of data, which is usually some chunk of the system registry, never gets written to the disc.

When the computer is powered-on again, viola, some critical chunk is missing, and Windows' won't boot.

The worst part of this problem is, it is very much timing-related, and may shutdown without issue hundreds of times. However, you just need to have it happen one little time - "gotcha", and then you are screwed.

However, seeing that you are using XP, and assuming that System Restore is not disabled, then I'm sure that Smilin will probably soon post about how you can restore the system registry file from the registry backup contained within the most recent Restore Point. So all is not lost, hopefully.

My solution, to try to prevent this problem from ever happening, is to NOT install W2K/XP using ACPI, and to leave APM disabled, and disable "PowerDownOnShutdown", or whatever registry key that is. I also configure a Local Security Policy to "Clear Pagefile on Shutdown". That gives me an extra time-delay and ensures that the registry is flushed to disk first (assuming that the registry is written before the pagefile is cleared - I actually don't know if that is the case.) So when I select "Shutdown", it gives me the "Is now OK to power-down your computer" screen, and then I manually turn it off. (Or simply hit Reset if I want to boot another OS, because I run a multi-boot system.)

 

[drak1968]

This is the best way to fix that problem, however it could be stemming from what these folks suggested. This should get you going again though.

http://sillydog.org/forum/viewtopic.php?t=1607

 

[drak1968]

P.S. Some of those commands aren't necessary. They just won't work, but following that is how I fixed several XP pc's that wouldn't boot up with that same problem. A couple folks got new memory and that seemed to fix the problem with it happening.

Hope this helps!

 

[Slikkster]

No need to do any manual backups at all. There's a freeware utility that backs up all your registry hives whenever you want them to. It's called "Erunt".

Everyone with XP/2000/NT4 needs this utility, and it's free! Get Erunt here.

 

[imported_raybay]

I would remove the Promise Drivers, download the latest Promise BIOS and Drivers, and install everything over again, being aware that lots of people reporting to this forum say that the old drivers sometimes work better than the new ones.

Then I would remove and reinstall (with emphasis on the remove) the video drivers, then onboard sound and so on until I had replaced everything.

Move every PCI card to a different slot if you can. Borrow an old but good PCI video card to see if there is a difference.

I would pull the memory modules, re-trying them one at a time.

And finally, go back to the basic keyboard and mouse for a week.

One of those things will make a difference which will help you.

 

[Smilin]

Originally posted by: VirtualLarry
However, seeing that you are using XP, and assuming that System Restore is not disabled, then I'm sure that Smilin will probably soon post about how you can restore the system registry file from the registry backup contained within the most recent Restore Point. So all is not lost, hopefully.

Here I is.

Sounds like he has the fix already.

What can cause it: Same things that cause corruption of any other file - dirty shutdowns, hardware errors etc. Check your system event logs and see if you are getting an event 50-55s (Delayed write failures, corrupt ntfs volume etc.). See if you are getting any 7-11s indicating a controller problem. Memory problems are often indicated by event ID 26s (...the memory could not be 'read'). Definately check driver versions and bios versions.

Also, see what the size of your system hive is. When the hive is initially loaded by ntldr at boot it is very tight on memory. It only has about 16 megs available to it. Once you throw in everything else it needs to load you are left with approximately 10.5 megs for your system hive. If you hit 11 megs you'll get the exact same error even though the registry may not actually have corruption. This is not at all normal though. Either something is adding and removing keys too frequently and leaving whitespace behind (Microsoft can compress this out for you) or something is dumping tons of keys into your registry.

A healthy size for a system hive is about 2-4 megs. If you see yourself getting above 6, make a copy of the hive and get it sent to me. I've got some tools to either strip out the whitespace or find what the growing key is.

 

[Smilin]

Originally posted by: Slikkster
No need to do any manual backups at all. There's a freeware utility that backs up all your registry hives whenever you want them to. It's called "Erunt".

Everyone with XP/2000/NT4 needs this utility, and it's free! Get Erunt here.

All the mentioned operating systems have the built in capability to backup your registry with no need for a 3rd party app.

NT uses rdisk /s
2000 uses ntbackup (Tools | create an emergency repair disk, check box to also backup the registry)
XP uses system restore points

In addition to the above, running a system state backup with ntbackup will also update your repair folder.

 

[Slikkster]

I'm not sure I understand your point. The freeware app I listed takes the guesswork out of command line apps. Plus, you mentioned there are three different ways to accomodate your goals using the different operating systems. This freeware app bridges all of those. No one said there weren't other ways to accomplish the backups.

Additionally, XP's "System Restore" is of limited value. It's great when you can get to the desktop. But if you have a registry hive problem, you're not getting to the desktop. The Erunt app will save your butt when System Restore can't help.

 

[Smilin]

System restore points are accessable from Recovery Console. I use them all the time to get systems booting again.

I checked Erunts website. It seems a pretty clever utility but they are making some false claims about what they do versus the built in tools.

 

[Slikkster]

Originally posted by: Smilin
System restore points are accessable from Recovery Console. I use them all the time to get systems booting again.

That would be news to Microsoft:

Microsoft says System Restore NOT available via Recovery Console

I wasn't aware of the Safe Mode option from the command line, however, so that's a useful tip. However, serious hive problems will prevent you from even getting to the F8 Menu, so Recovery Console would be the only option.

 

[Mutor]

the same thing has been happening to my pc ever since i got my new hard drive. when im in the middle of something the screen turns blue and says something about an error.

Windows XP
AMD Duron 750mhz
320mb ram
20GB hard drive
80GB seagate 2mb cache hard drive

is it 'cause my pc sux that im getting the error?

 

[Smilin]

That would be news to Microsoft:

Microsoft says System Restore NOT available via Recovery Console

I wasn't aware of the Safe Mode option from the command line, however, so that's a useful tip. However, serious hive problems will prevent you from even getting to the F8 Menu, so Recovery Console would be the only option.

No, it's not news to us.

Here are the exact steps to recover from your missing or corrupt system hive problem using restore points from recovery console:

307545 How to recover from a corrupted registry that prevents Windows XP from
http://support.microsoft.com/?id=307545

There is also Chkreg available for download.

Edit:
I didn't mention it's EASY to do a system restore from recovery console for a reason though
It's awesome that you're backing your registry up too. It will save your butt someday.

 

[Sianath]

Bah, who needs registry backups. Psssssh!

 

[Mutor]

i found out that the blue screen error is called BSOD (Blue Screen of Death)
i should run memtest

 

[Sianath]

Technical term is bugcheck.

 

[Slikkster]

Here are the exact steps to recover from your missing or corrupt system hive problem using restore points from recovery console:

307545 How to recover from a corrupted registry that prevents Windows XP from
http://support.microsoft.com/?id=307545

All I can say to that is OUCH! It's nice that that particular set of procedures is available for a catastrophic failure -- meaning no hive backups-- but that's hardly a desirable solution when others that are so much easier are available. The KB you quoted is one convoluted mess of steps, and the type of process that would really only be useful to an expert. But, with no backups, that would certainly save the day.

I can understand why one would want to do it that way vs. just copying the Repair folder files over. Chances are one would have a system back up and running that was configured at a much closer date before the failure than what's normally in the Repair folder (i.e. usually whatever state the pc was in when Windows was installed).

And to be clear, we were talking about apples and oranges. "System Restore" as an application is not available in the Recovery Console. I assumed you were referring to running the actual app from a command line vs. using the points themselves.

You should take Erunt out for a spin. I don't really care about whatever claims they are making. I only care that the hives are being backed up successfully, as well as other personal settings. It's quite simple, and quick.

I think you would agree that Microsoft should make System Restore available as an application in Recovery Console in future OS releases. No one should have to tread through a process such as MS describes in the KB article you cite.

 

[Mutor]

i was running memtest and it was at 550% coverage.........how high is it supposed to go?

 

[Slikkster]

Mutor, a couple of things you need to learn about posting here, if you'll allow me to advise you:

First, don't muddy the waters of a current thread with another problem. If you're having a problem, start your own NEW thread to ask for help. This way, you'll get a lot more people seeing your exact problem vs. hoping someone will see it in conjunction with viewing an entirely different thread about someone else's problem.

Secondly, be specific about the problem. Most "Blue Screens" have information that will more closely identify what type of problem it is. Look at this website and you'll see a picture of a blue screen (there are many, many different blue screen errors):

Blue Screens of Death explained. You're interested in the "STOP:" error message at the top. It's followed by a bunch of numbers, which are also important, like 0x0000blahblahblah. In this message, it also has another helpful identifier after the numbers, where it says "BAD_POOL_HEADER". Your blue screen may have a different set of terms connected by underscores, but it's an important piece of the puzzle, so make note of it and include it in your thread.

So, start your own thread about your problem, state the system you are using (operating system, RAM, video card, cpu, etc.) And try to state word for word the STOP message you see at the top of your Blue Screens. See if there's any filename mentioned in the blue screen; something like xxxxxxx.sys or xxxxxx.dll, where "x" equals a filename.

The bottom line is that if you're having a problem and want help, start your own thread in the Technicqal Support forum. Use the subject line to be descriptive about it. I would title it something like "Blue Screen Stop 0xblahblahblah (where "blah" equals whatever the other numbers are) keeps occuring. Please Help".

Then, list the specifics about the Blue screen, what you were doing when it happened or happens (does it happen while doing the same activity every time?). Is it the same Blue Screen error that comes up?

List your system specs.

List what you have done to try and troubleshoot it yourself, if anything.

The more info you can give, the less someone will have to post and ask you for additional info to help solve the problem.

 

[VirtualLarry]

Originally posted by: Smilin
Here I is.

Sounds like he has the fix already.

What can cause it: Same things that cause corruption of any other file - dirty shutdowns, hardware errors etc. Check your system event logs and see if you are getting an event 50-55s (Delayed write failures, corrupt ntfs volume etc.). See if you are getting any 7-11s indicating a controller problem. Memory problems are often indicated by event ID 26s (...the memory could not be 'read'). Definately check driver versions and bios versions.

Hey, thanks for coming to the rescue, I knew that you would.

Anyways, I have a personal curiousity here, you mention event log errors 7/11/50/55... I have a Promise Ultra100 TX2 with some drives on it, under W2K SP2 (yeah, I know, old SP - but I like it).

When I run HDTach 2.61, I sometimes get some downward "spikes" in the graph. I also get a gaggle of 7/26 errors in the system event log, that I suspect correspond with the downward spikes. It starts with three 7 errors, then is followed by a sequence of 26/7 error pairs. This happens for both my 80GB WD JB and 160GB WD JB, both as Primary Master and Slave.

I recently installed a 250GB Maxtor DM+9 as Secondary Slave, and running HDTach on that, only generates event log error 26s. That drive has not yet been formatted, perhaps that's why it's not generating the corresponding error 7s.

I otherwise haven't seen any indication of bad sectors in SMART data, or otherwise, so I'm simply assuming at this point that it's some sort of driver problem, that is causing a timing issue with the HDTach results, or vice-versa (timing issue with HD, causing event log errors because of drivers). (Not hearing any sector re-reads either from the drive - although I have had two re-mapped sectors on the 80GB WD in the past, but they had the distinctive sound of a re-read, and they showed up in SMART.)