XP Home stuck in a reboot cycle 1

[Salem]

Hello,

I've got a Dell Dimension 9100 which seems to have gotten itself stuck in a reboot loop.

The last driver (that's printed anyway) is Mup.sys (see picture).

http://s3.postimg.org/totpqykv7/IMG_0417.jpg

It remains stuck at this point for 5 to 10 seconds before rebooting.

At the boot menu, all the "safe" modes, "last known config", and "start normally" all exhibit the same problem.

I have a XP home install CD and can get into the recovery console, but I'm not sure what to do next (I've looked through

http://support.microsoft.com/kb/314058).

I had thought to use "bootcfg /redirect com1 115200" to hopefully get a more detailed diagnostic of the boot progress, but the machine lacks traditional serial ports. Purchasing a PCI serial card (example) is an option, but this would rely on the card being recognised by the BIOS to be of any use.

Thanks for any info/leads,

--
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.

 

[goombawaho]

Use F8 key and choose "disable automatic restart on system failure" and then see if you can tell us what it does - probably a blue screen. Give any information seen.

The GENERAL things you can do without more information involve a hard drive diagnostic test, a memory test, booting to a bootable CD and running a malware scan AND a CHKDSK. Something like BartPE, Windows PE, ultimate boot cd for windows.

I've seen the CHKDSK alone fix the boot loop, but it depends on what's ailing in your computer. But one of those things I
mentioned should shed light on the exact problem.

 

[Salem]

I've rebooted with restart disabled and got a blue screen reading
[tt]STOP: C0000218 {Registry File Failure}
The registry cannot load the hive {file}:
\SystemRoot\System32\Config\SOFTWARE
or its log or alternate.
It is corrupt, absent, or not writable.

Beginning dump of physical memory
Physical memory dump complete.
Contact your sysadmin....[/tt]

I'm now running memtest-86 on it (for the rest of the evening) and downloading UBCD4Win.



--
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.

 

[goombawaho]

If the memory and hard drive test out okay and you run the chkdsk on the drive, I would proceed to this procedure. It helps you copy backup registry files while the PC is offline. It uses backup registry files in the system restore folder - a manual system restore.

• If possible, run HDD diagnostic utility to check for physical HDD problems.
• Using BartPE or Recovery Console or slaving the hard drive in another system, run chkdsk. Sometimes this alone will fix the problem. You can use the command "chkdsk c: /f" and then chkdsk c: /r if errors are present. (/r checks for bad blocks so it will take a long time.)
• If you noticed any errors fixed, use the exit command at the prompt to restart the machine and see if it will boot. If not, log back into the Recovery Console/Bart PE or keep drive slaved and go to the next step.
• Navigate to the C:\Windows\System32\config folder. You can use the command cd C:\Windows\System32\config
• You can use the dir command to see a listing of the files in the directory.
• Rename your corrupted registry files. I would rename all of them and replace all of them.
rename SYSTEM SYSTEM.bak
rename SAM SAM.bak
rename SECURITY SECURITY.bak
rename DEFAULT DEFAULT.bak
rename SOFTWARE SOFTWARE.bak

Inside the C:\System Volume Information folder you will see another hidden folder named something like: _restore{C6E9847C-AEF5-4523-BE1B-5E7A365553E6). Open it and view everything by date modified. Each of the folders (Labeled RP followed by a number) are different restore points in which to restore from. Choose a folder you would like to restore from and open it. Each RP* folder is different, except for a snapshot folder. Open the Snapshot folder and you will see several registry files.

Copy the following files from the folder:

_REGISTRY_USER_.DEFAULT
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_SAM

Browse to \\Windows\\System32\\config in the corrupted HDD. Paste the files in this folder. Now rename the files to:

DEFAULT
SECURITY
SOFTWARE
SYSTEM
SAM

Some of the above cribbed from:

http://www.overclock.net/t/126252/how-to-manually-restore-the-system-registry-for-windows-xp

If that doesn't work, try this, but this may put the registry too far back and remove some devices and/or software.

http://support.microsoft.com/kb/307545

 

[Salem]

I ran memtest86 for 2 hours with no errors, and passmark "diskcheckup" reported no smart errors.

The two chkdsk commands fixed some issues, including some bad blocks in the above mentioned hive file. However, this has so far failed to fix it. It's late now, so I'll pick up the rest of the workflow tomorrow evening.

Thankyou for the help so far.


--
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.

 

[rclarke250]

Try the manual restore, it works, but is a little tedious, but better than doing a repair install, which is the next step if that doesn't work.

 

[karlisi]

If chkdsk found some bad blocks, your HDD is going to die. I suggest to replace HDD and reinstall. To get your files from current disk, connect it to working PC as second HDD. You can try to repair current Windows but most likely there will be more and more bad clusters and you will end with replace anyway.

===
Karlis
ECDL; MCSA

 

[rclarke250]

I disagree, Just because there are a few sectors bad, doesn't mean the drive is going to die. There is no way to determine that, unless every time you run a utility to check for bad sectors it finds new ones. The HDD is designed to be able to mark the bad sectors, and continue functioning, you can even use tools like HDD regenerator, to repair seemingly "bad" sectors.HERE. It's not 100% but on a drive with a few errors, it works.

 

[goombawaho]

Yes, I agree. The hard drive is not likely to fail immediately with just a few bad sectors, though it's something to keep an eye on. Do the manual system restore (the first LONG part of my post - tedious yes, but not that hard) and see if that gets the computer booting.

If it does boot, make sure you have a good data backup and/or whole hard drive (image) backup going forward to protect you in the future.

 

[Salem]

Thanks to goombawaho (and UBCD4Win - fantastic tool for this job), I now have a system that boots
Now backup time, and some more disk analysis....


--
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.

 

[goombawaho]

Great - assume you used the manual system restore procedure??? The real question is WHY they registry files got hosed - general windows corruption from improper shutdowns followed by no CHKDSK OR something bad starting to happen to the hard drive.

Yeah, those bootable CDs are awesome for all kinds of things and doesn't require a 2nd PC to move the hard drive to.

 

[Salem]

Yes, I used the manual recovery option of copying registry files from the last restore point.
As I commented above, chkdsk found a bad block in the actual hive file causing the issue. I think the drive is getting pretty close to end of life.


--
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.

 

[goombawaho]

It may or not be getting close to end of life. Could just be a coincidence that a bad block happened in the registry. A bad coincidence for sure. Use the manufacturer specific HDD test utility to find out what SMART reports and if it finds anything troubling.

The Ultimate Boot CD (

http://www.ultimatebootcd.com/)

will have all the major HDD manufacturers' tools on it. Another great CD to have in pocket. Create it, boot from it and run the short test first, followed by long test if suggested or if you're paranoid.

 

[jtb]

Some malware also corrupt system files and cause the persistent reboot. Look for a "rescue disk" from your favorite AV vendor...

JTB
Have Certs, Will Travel
"A knight without armour in a [cyber] land."