Can you run SFC from the Recovery Console on the XP Setup CD?

[googlegroups]

John,
Sorry, what do I edit on the ControlSet001 key? Am I adding a new key
(currently, there are no keys in ControlSet001). However, ControlSet001
has four sub "folders":
Control
Enum
Hardware Profiles
Services

Also, and I think this may be what you were looking for earlier (it's
listed as "_REMOTE_SYSTEM", instead of just "SYSTEM", which threw me
off):
There's a CrashControl key here:
HKLM\_REMOTE_SYSTEM\ControlSet003\Control\CrashControl (there are no
other ControlSetxxx under _REMOTE_SYSTEM)

There are 7 keys below CrashControl:
AutoReboot REG_DWORD 0x00000001 (1)
CrashDumpEnabled REG_DWORS 0x00000001 (1)
DumpFile REG_EXPAND_SZ %SystemRoot%\MEMORY.DMP
LogEvent REG_DWORD 0x00000001 (1)
MinidumpDir REG_EXPAND_SZ %SystemRoot%\Minidump
Overwrite REG_DWORD 0x00000001 (1)
SendAlert REG_DWORD 0x00000001 (1)


Is the AutoReboot the key I need to set to (0) to stop it from
"auto-rebooting on errors"?

You are not adding new keys or values, you are just changing the value
data at one value name, nothing else. In the HKLM\_REMOTE_SYSTEM\ look
at the Select Key and then determine which ControlSet is the Default
one, as explained earlier, then, in the same HKLM\_REMOTE_SYSTEM\ tree,
edit the proper ControlSet and edit the AutoReboot value

The key will be:

[HKLM\_REMOTE_SYSTEM\ControlSet00x\Control\CrashControl]

The value name is:

AutoReboot (type REG_DWORD)

Modify the value data, change it from 1 to 0

John,
When I started the Registry Editor PE and selected the SYSTEM hive, it
gave an error saying there was a problem with the SYSTEM hive file, but
a backup copy was available and successfully used in its place.
Then I changed AutoReboot to 0 and (successfully) closed the Registry
Editor. However, when I tried to Restart via the Go button, the system
hung and I had to power it OFF to get it to shutdown.
When I restarted the machine, it still auto-rebooted when Windows tried
to start and the "disable auto-reboot on errors" option still is not
listed on the F8 Safe Mode screen.
I restarted the system via the Bart's PE CD to check the AutoReboot
setting and it's still set to 0.
Is there another Registry setting that may affect this?

 

[John John]

(e-mail address removed) wrote:

John John wrote:


There isn't supposed to be a Select key at the ControlSetnnn, where you
found it is where it's supposed to be. The value (LastKnownGood) is
there as I expected but it doesn't have a different ControlSet
associated to it. As it is when you boot your computer it makes no
difference if you choose to boot normally or to use the Last Known Good
boot option, both point to the same ControlSet, the same set of
instructions from the registry. Edit the ControlSet001 key. Not that
you have much of any other choice anyway, like the Ford Model T you
could have any colour you wanted as long as you wanted black... ;-)


John,
Sorry, what do I edit on the ControlSet001 key? Am I adding a new key
(currently, there are no keys in ControlSet001). However, ControlSet001
has four sub "folders":
Control
Enum
Hardware Profiles
Services

Also, and I think this may be what you were looking for earlier (it's
listed as "_REMOTE_SYSTEM", instead of just "SYSTEM", which threw me
off):
There's a CrashControl key here:
HKLM\_REMOTE_SYSTEM\ControlSet003\Control\CrashControl (there are no
other ControlSetxxx under _REMOTE_SYSTEM)

There are 7 keys below CrashControl:
AutoReboot REG_DWORD 0x00000001 (1)
CrashDumpEnabled REG_DWORS 0x00000001 (1)
DumpFile REG_EXPAND_SZ %SystemRoot%\MEMORY.DMP
LogEvent REG_DWORD 0x00000001 (1)
MinidumpDir REG_EXPAND_SZ %SystemRoot%\Minidump
Overwrite REG_DWORD 0x00000001 (1)
SendAlert REG_DWORD 0x00000001 (1)


Is the AutoReboot the key I need to set to (0) to stop it from
"auto-rebooting on errors"?

You are not adding new keys or values, you are just changing the value
data at one value name, nothing else. In the HKLM\_REMOTE_SYSTEM\ look
at the Select Key and then determine which ControlSet is the Default
one, as explained earlier, then, in the same HKLM\_REMOTE_SYSTEM\ tree,
edit the proper ControlSet and edit the AutoReboot value

The key will be:

[HKLM\_REMOTE_SYSTEM\ControlSet00x\Control\CrashControl]

The value name is:

AutoReboot (type REG_DWORD)

Modify the value data, change it from 1 to 0

John,
When I started the Registry Editor PE and selected the SYSTEM hive, it
gave an error saying there was a problem with the SYSTEM hive file, but
a backup copy was available and successfully used in its place.
Then I changed AutoReboot to 0 and (successfully) closed the Registry
Editor. However, when I tried to Restart via the Go button, the system
hung and I had to power it OFF to get it to shutdown.
When I restarted the machine, it still auto-rebooted when Windows tried
to start and the "disable auto-reboot on errors" option still is not
listed on the F8 Safe Mode screen.
I restarted the system via the Bart's PE CD to check the AutoReboot
setting and it's still set to 0.
Is there another Registry setting that may affect this?

Did you edit the right ControlSet? Did you edit the hive in the
\Windows\system32\config folder?

John

 

[googlegroups]

John,
I don't know if this is related to the autoboot issue (on the Master
drive), but remember I said there were two hard drives that were
originally used as part of a mirrored RAID. The slave drive, which I
disconnected after the autoboot problems began, WAS recognized by the
XP Setup CD when I ran the Repair option. However, the Repair never
completed successfully. The Repair program ran through the MSDOS mode
"coping files" routine without any problems, but shortly after it
switched to the Windows (gui) mode, it stopped with this error:

===
Fatal Error
Setup failed to install the product catalogs. This is a fatal error.
===

When I clicked the OK button in the error screen, it opened the error
log file, which contained dozens of entries like this:

Setup failed to remove the product catalog SP2.CAT

There were numerous similar entries about other .CAT files, both
referencing problems removing and installing each .CAT file. There was
also an entry that said something about Setup being unable to read the
identifier on the Windows XP Upgrade disc. I tried my backup copy of
the disc, but with the same result (both discs are perfectly clean and
have been used to install Windows previously without any problems).

Does any of this help?

 

[googlegroups]

Did you edit the right ControlSet?

John,
On the main hard drive, there are two ControlSets--002 and 003 under
the _REMOTE_SYSTEM\Select key (according to Select, 003 is the active
one).

But before I posted the last reply to you, I re-ran the Registry Editor
again and also set the AutoBoot setting in 002 to "0". I rebooted with
the same result--no "disable auto-boot on errors" option on the F8 Safe
Mode screen and Windows keeps auto-rebooting past the blue screen each
time it try to boot.

Did you edit the hive in the \Windows\system32\config folder?

Yes.
The Registry Editor prompted me to select the "remote Windows
directory" (c:\windows). Once selected, it displayed a browse box
prompting me to "Select the remote SAM hive!" (which defaulted to
c:\windows\system32\config\SAM). It then repeated this for the
security, software and system hive files. The first three hive files
loaded fine, but when I clicked the OK button for the system hive file,
I get this error:

Windows - Registry Recovery:
One of the files containing the system's Registry data had to be
recovered by use of a log or alternate copy. The recovery was
successful.

Once I clicked the OK button on the error box, the Registry Editor
opened.
I just checked the AutoBoot settings in both ControlSet002 and 003, and
both are still set to "0".

 

[googlegroups]

John,
I hope I'm not overwhelming you with info, but
_REMOTE_SYSTEM\ControlSet003/Control/SystemBootDevice lists the boot
paritition as "1".

FDISK won't run from the Bart's PE disc, so I'm not 100% positive, but
I'm pretty sure I specifically parititioned the hard drive with a
single large partition (I had to use Partition Magic to bypass XP's
default partition size limitations), so shouldn't the only (first)
partition on the drive be partition "0"???

 

[John John]

John,
I don't know if this is related to the autoboot issue (on the Master
drive), but remember I said there were two hard drives that were
originally used as part of a mirrored RAID. The slave drive, which I
disconnected after the autoboot problems began, WAS recognized by the
XP Setup CD when I ran the Repair option. However, the Repair never
completed successfully. The Repair program ran through the MSDOS mode
"coping files" routine without any problems, but shortly after it
switched to the Windows (gui) mode, it stopped with this error:

===
Fatal Error
Setup failed to install the product catalogs. This is a fatal error.
===

When I clicked the OK button in the error screen, it opened the error
log file, which contained dozens of entries like this:

Setup failed to remove the product catalog SP2.CAT

There were numerous similar entries about other .CAT files, both
referencing problems removing and installing each .CAT file. There was
also an entry that said something about Setup being unable to read the
identifier on the Windows XP Upgrade disc. I tried my backup copy of
the disc, but with the same result (both discs are perfectly clean and
have been used to install Windows previously without any problems).

Does any of this help?

Do you know what caused the installation to fail in the first place? I
think that the installation that you are working on is completely
fubared. Did you try to boot off the Shadow Mirror? See if this can help:

Steps to Recover a Failed Mirrored System/Boot Partition
http://support.microsoft.com/kb/120227/EN-US/

You might want to try this on the drive and installation that you are
working on: http://support.microsoft.com/Default.aspx?kbid=307545

Use your BartPE disk to carry out the operation. Skip part one
altogether. The final goal of the exercise is to replace the broken
hives in the \Windows\system32\config folder with the most recent ones
available, the ones that were last backed up by System Restore, they are
in the System Restore Snapshot folder.

John

 

[John John]

John,
I hope I'm not overwhelming you with info, but
_REMOTE_SYSTEM\ControlSet003/Control/SystemBootDevice lists the boot
paritition as "1".

FDISK won't run from the Bart's PE disc, so I'm not 100% positive, but
I'm pretty sure I specifically parititioned the hard drive with a
single large partition (I had to use Partition Magic to bypass XP's
default partition size limitations), so shouldn't the only (first)
partition on the drive be partition "0"???

No, partition entries start at 1. Drive entries start at 0.

John

 

[googlegroups]

No, partition entries start at 1. Drive entries start at 0.

Could that be the problem then, that Windows is trying to boot from
partition 1 and the system files are on partition 0? If that's the
case, is there a text editor in Bart's PE I can use to change the
SystemBootDevice to point to the 0 partition? That seems too simple,
but I thought I should ask....

 

[googlegroups]

Do you know what caused the installation to fail in the first place? I
think that the installation that you are working on is completely
fubared.

The RAID controller failed (smoked), so I removed it and reconnected
the two EIDE drives as Master and Slave on the Primary IDE socket on
the motherboard. Initially, it booted up just fine. But, then, it
wouldn't start the next day. That's when I tried running the XP Setup
CD Repair (which failed to see the Windows install on the Master drive
and failed half way through on the Slave drive) and then the Restore
Console. At this point, I disconnected the Slave drive and just
concentrated on running the mbr and boot fixes that're available via
the Restore Console on the Master drive.

As I mentioned earlier, I was doing fine for awhile, just rebooting and
selecting the "disable auto-boot on error" command so the system
stopped when it hit a blue screen during the install. Then I just
expanded the faulty .dll file listed in the blue screen from the XP
Setup CD and rebooted until it blue screened out again on another .dll
file. I kept doing this until, all of a sudden, the option to "disable
auto-boot..." disappeared from the F8 Safe Mode screen and it kept
auto-booting past the blue screen. That's when I posted the message in
the newsgroup here.
If it helps, I wrote down the last three files I fixed from the blue
screens:
sfcfiles.dll
lz32.dll
olecli32.dll
Then, it halted saying this file was corrupt or missing:
\windows\system32\config\system
The file was there, but I couldn't tell if it was corrupt, so I copied
the file from the XP Setup CD \i386 folder to the c: drive. I think
that may(?) have been when the "auto-boot" option disappeared from the
F8 screen. But I'm not positive because I'd been trying a number of
things on the Restore Console around the same time...

Did you try to boot off the Shadow Mirror? See if this can help:

Steps to Recover a Failed Mirrored System/Boot Partition
http://support.microsoft.com/kb/120227/EN-US/

I think I tried that early on.

You might want to try this on the drive and installation that you are
working on: http://support.microsoft.com/Default.aspx?kbid=307545

Use your BartPE disk to carry out the operation. Skip part one
altogether. The final goal of the exercise is to replace the broken
hives in the \Windows\system32\config folder with the most recent ones
available, the ones that were last backed up by System Restore, they are
in the System Restore Snapshot folder.

Depending on your response to this message, I'll try that.
David

 

[John John]

Could that be the problem then, that Windows is trying to boot from
partition 1 and the system files are on partition 0? If that's the
case, is there a text editor in Bart's PE I can use to change the
SystemBootDevice to point to the 0 partition? That seems too simple,
but I thought I should ask....

There are no partition zero, ever. Partitions are always numbered
starting at one (1) on any MBR disk. That is not the cause of your
problem, if it were you would not even get a reboot problem, you would
get a black screen with an ntoskrnl error message or hal error or a
disk geometry error... or something along these lines.

Look at this key in the proper ControlSet:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00x\Control\Session Manager\Memory
Management

There you will see an entry for value name:

PagingFiles

For the PagingFiles value you will see a value data that will look
something like this:

C:\pagefile.sys nnnn nnnn

where nnnn nnnn are numbers representing the minimum and maximum
pagefile size (in Megabytes). Set it so that the MINIMUM (the first set
of nnnn) is GREATER than the amount of RAM in your machine by 1 MB. For
example if you have 768MB RAM make the value data like so:

C:\pagefile.sys 769 769

Then check key:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00x\Control\CrashControl

and set value data for CrashDumpEnabled to 1

John

 

[John John]

The RAID controller failed (smoked), so I removed it and reconnected
the two EIDE drives as Master and Slave on the Primary IDE socket on
the motherboard. Initially, it booted up just fine.

Did you then properly break the mirror?


But, then, it

wouldn't start the next day. That's when I tried running the XP Setup
CD Repair (which failed to see the Windows install on the Master drive
and failed half way through on the Slave drive) and then the Restore
Console. At this point, I disconnected the Slave drive and just
concentrated on running the mbr and boot fixes that're available via
the Restore Console on the Master drive.

As I mentioned earlier, I was doing fine for awhile, just rebooting and
selecting the "disable auto-boot on error" command so the system
stopped when it hit a blue screen during the install. Then I just
expanded the faulty .dll file listed in the blue screen from the XP
Setup CD and rebooted until it blue screened out again on another .dll
file. I kept doing this until, all of a sudden, the option to "disable
auto-boot..." disappeared from the F8 Safe Mode screen and it kept
auto-booting past the blue screen. That's when I posted the message in
the newsgroup here.
If it helps, I wrote down the last three files I fixed from the blue
screens:
sfcfiles.dll
lz32.dll
olecli32.dll
Then, it halted saying this file was corrupt or missing:
\windows\system32\config\system
The file was there, but I couldn't tell if it was corrupt, so I copied
the file from the XP Setup CD \i386 folder to the c: drive.

That file doesn't exist on the Windows CD, it's created when you install
Windows. It's made up according to what type of computer hardware you
have and the information that the Windows setup program gathers during
the installation.


I think

that may(?) have been when the "auto-boot" option disappeared from the
F8 screen. But I'm not positive because I'd been trying a number of
things on the Restore Console around the same time...

It's not surprising that the boot options then changed and that it
failed completely. Your earlier step completly destroyed the System hive.

I think I tried that early on.





Depending on your response to this message, I'll try that.
David

Replacing the hives in the config folder with the ones in the Snapshot
folder is the last and only thing left to try. Copy from the newest
Snapshot folder and replace ALL the hives together as a matched set (not
just the System hive), as it instructs you to do so in the article.
That is your last hope. If that fails salvage your data and reinstall
Windows.

John

 

[googlegroups]

There are no partition zero, ever. Partitions are always numbered
starting at one (1) on any MBR disk. That is not the cause of your
problem, if it were you would not even get a reboot problem, you would
get a black screen with an ntoskrnl error message or hal error or a
disk geometry error... or something along these lines.

John,
Oops.... I don't know if this is good news or bad, but the very first
blue screen referenced a damaged or corrupt HAL.DLL file. When the XP
Setup CD's Repair program failed to "see" the Windows installation on
the original Master hard disk, I first tried coping the HAL.DLL from
another XP machine to this one, but it didn't help. That's when I first
tried some of the commands in the Restore Console.

Look at this key in the proper ControlSet:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00x\Control\Session Manager\Memory
Management
There you will see an entry for value name:
PagingFiles
For the PagingFiles value you will see a value data that will look
something like this:
C:\pagefile.sys nnnn nnnn
where nnnn nnnn are numbers representing the minimum and maximum
pagefile size (in Megabytes). Set it so that the MINIMUM (the first set
of nnnn) is GREATER than the amount of RAM in your machine by 1 MB. For
example if you have 768MB RAM make the value data like so:
C:\pagefile.sys 769 769

It's currently set to:
c:\pagefile.sys 1536 3072

The machine has 1gig of RAM (I think that translates to 1024 MB).
I've reset it to 1025 1025. Ok?

Then check key:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00x\Control\CrashControl
and set value data for CrashDumpEnabled to 1

It's already set to 1.
I rebooted the machine, but it's still auto-booting and the "disable
auto-boot on error" option isn't listed on the F8 Safe Mode screen.
Here are the options listed on the Safe Mode screen:

Safe Mode
Safe Mode with Networking
Safe Mode with Command Prompt

Enable Boot Logging
Enable VGA Mode
Last Known Good Configuration (your most recent settings that worked)
Directory Services Restore Mode (Windows domain controllers only)
Debugging Mode

Start Windows Normally
Reboot
Return to OS Choices Menu


I've tried everything except Directory Services Restore Mode.

 

[googlegroups]

Did you then properly break the mirror?

I think so. When I started the machine, just before Windows begins to
boot, I told the RAID controller to "Delete the RAID" and it
acknowledged that the RAID set had been returned back to two
stand-alone drives. Does that sound right?

But, then, it

That file doesn't exist on the Windows CD, it's created when you install
Windows. It's made up according to what type of computer hardware you
have and the information that the Windows setup program gathers during
the installation.

Then I must have just renamed or deleted the original SYSTEM and then
renamed the SYSTEM.SAV to SYSTEM. Again, I've been going 'round and
'round with this for several days and I'm a bit hazy on some of the
details.

I think

It's not surprising that the boot options then changed and that it
failed completely. Your earlier step completly destroyed the System hive.

I think you're right.

Replacing the hives in the config folder with the ones in the Snapshot
folder is the last and only thing left to try. Copy from the newest
Snapshot folder and replace ALL the hives together as a matched set (not
just the System hive), as it instructs you to do so in the article.
That is your last hope. If that fails salvage your data and reinstall
Windows.

Am I still skipping Part One -- You don't want me to rename the current
hive files for backup just in case??

 

[John John]

John,
Oops.... I don't know if this is good news or bad, but the very first
blue screen referenced a damaged or corrupt HAL.DLL file. When the XP
Setup CD's Repair program failed to "see" the Windows installation on
the original Master hard disk, I first tried coping the HAL.DLL from
another XP machine to this one, but it didn't help. That's when I first
tried some of the commands in the Restore Console.






It's currently set to:
c:\pagefile.sys 1536 3072

The machine has 1gig of RAM (I think that translates to 1024 MB).
I've reset it to 1025 1025. Ok?







It's already set to 1.
I rebooted the machine, but it's still auto-booting and the "disable
auto-boot on error" option isn't listed on the F8 Safe Mode screen.
Here are the options listed on the Safe Mode screen:

Safe Mode
Safe Mode with Networking
Safe Mode with Command Prompt

Enable Boot Logging
Enable VGA Mode
Last Known Good Configuration (your most recent settings that worked)
Directory Services Restore Mode (Windows domain controllers only)
Debugging Mode

Start Windows Normally
Reboot
Return to OS Choices Menu


I've tried everything except Directory Services Restore Mode.

Your machine is completely borked! If you can't restore the hives as
explained earlier or if restoring these hives doesn't fix things you
will have to reinstall Windows. Either that or get to work on the
Shadow Mirror, the one you are working on is next to hopelessly screwed.

John

 

[John John]

I think so. When I started the machine, just before Windows begins to
boot, I told the RAID controller to "Delete the RAID" and it
acknowledged that the RAID set had been returned back to two
stand-alone drives. Does that sound right?

Yes, the mirror appears to have been broken properly.

Then I must have just renamed or deleted the original SYSTEM and then
renamed the SYSTEM.SAV to SYSTEM. Again, I've been going 'round and
'round with this for several days and I'm a bit hazy on some of the
details.




I think you're right.





Am I still skipping Part One -- You don't want me to rename the current
hive files for backup just in case??

What's the use of them? They're completely broken. If you want to save
them it's up to you, easy to save them if you wish.

John

 

[googlegroups]

Your machine is completely borked! If you can't restore the hives as
explained earlier or if restoring these hives doesn't fix things you
will have to reinstall Windows. Either that or get to work on the
Shadow Mirror, the one you are working on is next to hopelessly screwed.

John,
Did you say I should use the Bart's PE to restore the hive files or
should I use the XP Setup CD? The Microsoft article says I need to log
in as Admin...does Bart's PE do that (I don't think it's prompted me to
log in or enter a password even one time so far)?

 

[googlegroups]

John,
I went ahead and started running through Part 2 of the Microsoft
article using Bart's PE, but I ran into what I think is an unrelated
(and probably minor) issue (not quite a problem):

After I copied all 5 of the hive files from the most recent (27 Nov
2006) Snapshot folder to c:\windows\tmp, I started renaming the files.
Oddly, after changing the filename and hitting enter to save the
renamed file, the A43 file manager tool in Bart's PE seems to hang.
That is, it sits there with an hourglass cursor for about 10 minutes
and its status is "not responding" until the file Rename process
completes. I'm actually writing this (from another computer) while
awaiting for the 3rd Rename process to complete.
But, so far, so good....

 

[John John]

John,
Did you say I should use the Bart's PE to restore the hive files or
should I use the XP Setup CD? The Microsoft article says I need to log
in as Admin...does Bart's PE do that (I don't think it's prompted me to
log in or enter a password even one time so far)?

Either way will work but it's easier with the PE disk, it a matter of
preference for the user.

John

 

[John John]

John,
I went ahead and started running through Part 2 of the Microsoft
article using Bart's PE, but I ran into what I think is an unrelated
(and probably minor) issue (not quite a problem):

After I copied all 5 of the hive files from the most recent (27 Nov
2006) Snapshot folder to c:\windows\tmp, I started renaming the files.
Oddly, after changing the filename and hitting enter to save the
renamed file, the A43 file manager tool in Bart's PE seems to hang.
That is, it sits there with an hourglass cursor for about 10 minutes
and its status is "not responding" until the file Rename process
completes. I'm actually writing this (from another computer) while
awaiting for the 3rd Rename process to complete.
But, so far, so good....

It shouldn't take that long to do. There might be file system or drive
corruption in the picture. You might have to run a chkdsk on the drive
(using the Recovery Console).

John

 

[googlegroups]

John,
Success (after one more minor adjustment)!
After copying the (renamed) Snapshot hive files to
c:\windows\system32\config and rebooting, I noticed that the commands
that load (on screen) during a Safe Mode boot went further than they
had before. It still auto-rebooted, but I figured that's because the
old SYSTEM hive file was probably configured that way. So I went back
into the Registry and, sure enough, the AutoBoot key had been switched
back to "1". I set it back to "0" and rebooted. Now, although the
system still doesn't boot into Windows, at least it's stopping on the
blue screen so I can see what file's causing the problem.

Now that I've made headway back to my original problem (blue screens
during boot), if you have any recommendations for a shortcut or batch
method for checking/correcting all of the boot-related files (as
opposed to my continuing the process of rebooting and
replacing...rebooting and replacing...etc.)...
Here's an example of the latest blue screen message:

Stop: c0000221 {Bad Image Checksum}
The image olecnv32.dll is possibly corrupt. The header checksum does
not match the computed checksum.

It's probably too late this evening, but if you have any further
recommendations tomorrow, I'm certainly sold on your expertise.
In any case, John, MANY THANKS for sticking with this and getting the
system back to....well, back to where I can deal with it.
David