autochk.exe not found, stop 21a

[iamnotageek]

A customer brought his xp home sp2 machine into the shop after it got into a reboot loop. I edited the registry using BartPE & regedit PE to disable the auto restart on crash and can now see that the stop code is a c000021a. The bootup sequence of events is that shortly after the xp banner & progress bar displays, it flashes a message that says "autochk.exe not found, skipping autochk" and then it goes to stop 21a.

He had installed TurboTax the day before with no apparent errors until he tried to boot up the next day. Western Digital's diags show no problem with the hard drive. Ran chkdsk /r from RC and it found and fixed some errors, rebooted, went into RC again, ran it again and it did not find/fix any additional errors.

However, it tries to run autochk for some reason on the subsequent reboot, even though the volume dirty flag would have been cleared by chkdsk /r. It would appear that something else that xp sees when trying to boot is triggering autochk.

When booted into BartPE, I can browse the \system32 folder and autochk.exe is present, with the correct size, version, file date, etc. Just to be sure, I copied autochk.exe from my xp pro sp2 machine into the \system32 folder, but no difference. I did find some entries in \HKLM\software\microsoft\windows\current version\run that were associated with infection and deleted them, but no joy.

I've never seen an xp repair reinstall fix a stop 21a, but I tried it again anyways on this one, since I had never seen the "autochk not found" error, but no joy there either.

I also ruled out the 'hidden partition' problems described in other posts on the web.

Anyone have any ideas?

TIA

 

[linney]

Will it boot into Safe Mode?

Is he running software of the "GoBack" genre? Or any software that is hiding partitions?

STOP 0xC000021a Caused by GoBack

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q316503

156669 - How to troubleshoot a "STOP 0xC000021A" error

http://support.microsoft.com/default.aspx?scid=kb;en-us;156669&FR=1&PA=1&SD=HSCH

Stop 0xC000021A or STATUS_SYSTEM_PROCESS_TERMINATED

http://www.microsoft.com/resources/...all/reskit/en-us/prmd_stp_mtgk.asp?frame=true

STOP 0xC000021A Computer Hangs When you log on to a Terminal Services Session

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q311804

STOP 0xC000021a (STOP 0x21a) Error Message Occurs If You Download a RIPrep Image

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q308299

XP Pro...Opens in safe mode only. Restarts in other modes
thread779-1310257




autochk.exe not found

http://www.techspot.com/vb/showthread.php?s=4d4aaf26b58b5739bfea59406adc45c8&t=7746

http://216.239.63.104/search?hl=en&q=autochk+not+found&btnG=Google+Search

http://groups.google.com/groups?q=a...=Search+the+Web&ie=UTF-8&oe=UTF-8&sa=N&tab=wg

 

[iamnotageek]

No, same stop code in safe mode. 'Last good known' fails the same way. GoBack is not installed. No hidden partitions, according to PartitionMagic and others. I've already done the google searches and ruled out everything I've found...

 

[linney]

Do you get any different error message if you try to boot from floppy (or CD) with these procedures?

How to Use System Files to Create a Boot Disk to Guard Against Being Unable to Start Windows XP (Q314079)

http://support.microsoft.com/support/kb/articles/q314/0/79.asp

Q305595 - HOW TO: Create a Boot Disk for an NTFS or FAT Partition in Windows XP

http://support.microsoft.com/support/kb/articles/q305/5/95.asp

You could try FixBoot and FixMbr from the Recovery Console.

Resetting the Bios to Safe Defaults might be worth a try.

My limited understanding of the problem is that it is not so much that XP can't find the AutoChk file, but more likely that it cannot find the drive that AutoChk is on.

The following are notes from the late Alex Nichol MS MVP (Windows Technologies)

"Go to

http://www.bootitng.com.

look for MBRWORK in the free tolls and download it, put it on a DOS floppy (one made by formatting in XP and taking the MSDOS Startup disk option will do).

Boot that and run MBRWORK
Use options
1 (to back up the current state, so it could be restored with 2)
3 then 4 to delete the current code and tables
there will then be a possibility of using A
which will scan the disk for 'signatures' of partitions and rebuilt the partition table then
5
to install standard MBR code so the disk could be booted

 

[iamnotageek]

Booting from a floppy or CD doesn't prove much - I am already doing that with BartPE.

autochk is on the same drive & partition that contains the mbr, ntldr, and %systemroot% and registry. It is more likely to be a permissions problem than a path problem, since the boot process is started, but the OS load fails because the session manager terminates unexpectedly during its initialization phase. This is typically caused by mismatch of OS files, a permissions problem or newly added software or hardware.

In this customer's case, no new h/w was installed and the only new s/w is turbotax. Hard to see how it could have screwed things up, but it appears to be the culprit. BIOS settings are not the problem - customer is not sophisticated to even know that those settings exist.

It turns out that autochk is a symptom, not the problem. I went into HLKM\system\control\currentcontrolset\session manager and deleted the bootexecute value (autocheck autochk *) so that it would not try to run on bootup. Now it just goes straight to the stop 21a.

 

[linney]

Turbotax has prior convictions for messing with the boot sector. What version has he installed and is that something to look at?


TurboTax Application writes to your hard disk boot sector! (follow the links)

http://www.google.com/search?hl=en&lr=&rls=com.microsoft:en-US&q=turbotax+boot&btnG=Search

http://groups.google.com.au/groups?lnk=hpsg&q=turbotax+boot

"Booting from a floppy or CD doesn't prove much - I am already doing that with BartPE."

Doesn't BartePE boot into/from the CD and is only reading the installed XP when you browse to it through BartPE's Explorer (A45 File Manager)?

Doesn't a bootable floppy use the installed XP files (apart from Boot.ini, NtDetect.com, and NtLdr) and might have (and might not have) given a different error message?

 

[iamnotageek]

Turbotax has prior convictions for messing with the boot sector"

Not true, in spite of all the allegations. They were convicted of writing to sector 33 which is not used by the os or boot loader. Most of the posts on this issue date to 2003. Here is the skinny on what they were/are doing...

http://www.extremetech.com/article2/0,1697,1152025,00.asp

"Doesn't BartePE boot into/from the CD and is only reading the installed XP when you browse to it through BartPE's Explorer (A45 File Manager)?"

Yes.

"Doesn't a bootable floppy use the installed XP files (apart from Boot.ini, NtDetect.com, and NtLdr) and might have (and might not have) given a different error message?"

Yes. But the error messages that it gives are worthless for fixing the problem.

Just for kicks, I went ahead and created one using the instructions at...

http://support.microsoft.com/support/kb/articles/q305/5/95.asp

If I omit the drive letter (c from boot.ini as shown in their example, I get "non-system disk or disk error."

If I add c: to the boot.ini path references to the OS, I get

"Windows XP could not start because of the following ARC firmware boot configuration problem:
Did not properly generate ARC name for HAL and system paths. Please check the Windows XP (TM) documentation about ARC configuration options and your hardware reference manuals for additional information. Boot Failed."

According to the MSKB, this happens if the path that points to the system files is incorrect or includes the drive letter.

 

[linney]

I used the term "prior convictions" loosely, to mean a "bit of history", not in its strictly legal sense.

You lost me with this comment. "If I omit the drive letter (c from boot.ini as shown in their example, I get "non-system disk or disk error."

My boot.ini doesn't have any c: or other drive letter in it anywhere. That said, I am only familiar with basic IDE hard drives, and you haven't said much about what you have there in the way of drives and their types, SATA, Raid, or dual booting etc?

Error message when you start your computer with a non-system disk

http://support.microsoft.com/kb/812492

http://www.duxcw.com/faq/win/nosys.htm

You might like to post your boot.ini file anyway.

I suppose one way to fix this mess would be to back all his valuable data, and format and clean install XP, but who likes doing that and admitting defeat?

 

[iamnotageek]

I used the term "prior convictions" loosely, to mean a "bit of history", not in its strictly legal sense."

Yes, but it makes a big difference in my customer's case whether Intuit is writing to the boot sector or not. If it had GoBack or such installed, there could be repercussions to writing into sector 33, but the partition ID byte on this hard drive is 07h (NTFS).

Regarding what I said about the boot.in, here is what a generic boot.ini looks like for an IDE (same as shown in the MS KB article, same as my customer's machine)

[boot loader]
timeout=5
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

If I use this as-is on the floppy, I get "non-system disk or disk error"

If I edit the paths to be c:\windows instead of \windows, I no longer get the non-system disk error. It executes boot.ini, offers the boot menu and when I proceed to boot into safe mode, I get the xp banner and progress bar, the display of drivers loading and then the 'ARC' error.

In other words, using MS's recommendations for boot.ini, ntldr & ntdetect do not load/execute boot.ini, on this particular machine. If I add c: to the path, then boot.ini does get executed, but the boot process fails at a similar point.

So what would this mean in terms of salvaging my customer's xp installation? Like I said in the first post, I have never been able to recover from a 21a using an xp repair reinstall (about 6 or 8 machines), so unless this avenue is going to let me pull a rabbit out of the hat, it will be another case of a parallel install, reinstalling programs and importing data. Whether it can all be blamed on Turbotax looks iffy to me.

 

[linney]

It is damned hard to offer advise from a distance and not being there in situation, but I feel the "non-system disk or disk error" could be your main problem. Do you think it might be worth looking further at that error and troubleshooting along those lines?

The only time I have seen C: mentioned in the boot.ini is when dual booting with Windows 98 etc., or having the Recovery Console loaded as a startup option, in which case you get a line similar to -

C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /CMDCONS

C:\="Microsoft Windows 9x" (from memory not sure about this line)

There are a couple of more suggestions, besides MbrWork, such as FixNtldr and Bcupdate2, mentioned in this thread.

Boot problem - a question
thread779-1291543

 

[iamnotageek]

Turns out that the 'non-system disk' error was due to a bad floppy drive on the customer's machine. After making sure that it worked on a working xp pro machine, I swapped out the customer's floppy drive, booted from the floppy and got a stop 21a.

Ergo, the problem has nothing to do with the mbr, boot sector, etc, which correlates with what Microsoft says about a stop 21a (below)

Bottom line - the issue was either caused by Turbotax replacing a system file with an incompatible version, a Turbotax driver or service is causing the problem, the problem has been caused by an infection, or the problem is not-related to any of the above.

What would be nice to have in these situation is something like Autoruns that can be run from BartPE. Trying to sort out services and disable them from RC is a PITA.

###

The STATUS_SYSTEM_PROCESS_TERMINATED bug check has a value of 0xC000021A. This means that an error has occurred in a crucial user-mode subsystem.

Cause

This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Run-Time Subsystem (CSRSS), has been fatally compromised and security can no longer be guaranteed. In response, the operating system switches to kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is one of the few cases where the failure of a user-mode service can shut down the system.

Mismatched system files can also cause this error. This can occur if you have restored your hard disk from a backup. Some backup programs might skip restoring system files that they determine are in use.

Resolving the Problem

Running the kernel debugger is not useful in this situation because the actual error occurred in a user-mode process.

Resolving an error in a user-mode device driver, system service, or third-party application: Because bug check 0xC000021A occurs in a user-mode process, the most common culprits are third-party applications. If the error occurred after the installation of a new or updated device driver, system service, or third-party application, the new software should be removed or disabled. Contact the manufacturer of the software about a possible update.

If the error occurs during system startup, restart your computer, and press F8 at the character-based menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time. If this does not resolve the error, try manually removing the offending software. If the system partition is formatted with file allocation table (FAT), use an MS-DOS startup disk to gain access to the computer's hard disk. If the system partition is formatted with NTFS file system, you might be able to use Safe Mode to rename or delete the faulty software. If the faulty software is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file. If a newly installed piece if hardware is suspected, remove it to see if this resolves the issue.

Try running the Emergency Recovery Disk (ERD) and allow the system to repair any errors that it detects.

Resolving a mismatched system file problem: If you have recently restored your hard disk from a backup, check if there is an updated version of the Backup/Restore program available from the manufacturer. Make sure the latest Windows Service Pack is installed.

 

[linney]

Is the problem now fixed? If so what do you think may have fixed it?