sfc problems?

[Guest]

Hi all,

I want to use sfc to troubleshoot XP SP2 machines that have been BSOD'ing
recently. Has anyone had any bad experiences with it? For instance was the
computer worse off after running it? Also, is creating a system restore
point before running sfc a sufficient backup strategy?

 

[Peter]

It shouldn't cause any problems at all, but it makes you feel better go
ahead and create a restore point first.
Some hints here: http://www.updatexp.com/scannow-sfc.html

 

[Galen]

In gregski had this to say:

My reply is at the bottom of your sent message:

Hi all,

I want to use sfc to troubleshoot XP SP2 machines that have been
BSOD'ing recently. Has anyone had any bad experiences with it? For
instance was the computer worse off after running it? Also, is
creating a system restore point before running sfc a sufficient
backup strategy?

SFC replaces system files with the proper ones. I've never once had it cause
any issues so a restore point's not entirely out of the picture. What's the
BSOD error? SFC might be just a waste of time.

--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/

"We approached the case, you remember, with an absolutely blank mind,
which is always an advantage. We had formed no theories. We were simply
there to observe and to draw inferences from our observations." -
Sherlock Holmes

 

[Guest]

Thanks for the responses.

BSOD errors? This may mean a new thread, but I'll go ahead anyways.
I'm managing a network of about 100 workstations, a mix of XP SP2 and 2k SP4
boxes. Common software amongst them all are Sophos Antivirus, MS
Antispyware, and MS Office 2k2 or 2k3. Boxes are Dell, IBM, and no-names.
We also run WSUS.

For about three weeks, the XP machines have been randomly BSOD'ing (but not
the 2k machines). This was not happening prior. Updating video, audio and
nic drivers has helped somewhat but not totally.

Common BSOD error codes are: 0x19, 0xC2, 0x8e. I've checked out
www.aumha.org/win5/kbestop.htm and have run windbg with some of the minidump
files. I'm not a hardware programmer, so I'm limited in figuring out the
clues from the above sources.

So I'm using SFC as another tool in my arsenal. Could MS updates be the
cause of these sudden BSODs?

 

[Galen]

In gregski had this to say:

My reply is at the bottom of your sent message:

Thanks for the responses.

BSOD errors? This may mean a new thread, but I'll go ahead anyways.
I'm managing a network of about 100 workstations, a mix of XP SP2 and
2k SP4 boxes. Common software amongst them all are Sophos Antivirus,
MS Antispyware, and MS Office 2k2 or 2k3. Boxes are Dell, IBM, and
no-names. We also run WSUS.

For about three weeks, the XP machines have been randomly BSOD'ing
(but not the 2k machines). This was not happening prior. Updating
video, audio and nic drivers has helped somewhat but not totally.

Common BSOD error codes are: 0x19, 0xC2, 0x8e. I've checked out
www.aumha.org/win5/kbestop.htm and have run windbg with some of the
minidump files. I'm not a hardware programmer, so I'm limited in
figuring out the clues from the above sources.

So I'm using SFC as another tool in my arsenal. Could MS updates be
the cause of these sudden BSODs?

Yes, updates could have been but the errors point to you having already been
doing what you should have been doing. Had I seen that particular batch of
errors I'd have figured drivers as well. I wonder if maybe there's an update
to your Sophos? I'm sure you've done the malware check and all... Hmm... I'd
wonder, the XP systems that are crashing - is there any hardware in common
among them?

--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/

"We approached the case, you remember, with an absolutely blank mind,
which is always an advantage. We had formed no theories. We were simply
there to observe and to draw inferences from our observations." -
Sherlock Holmes

 

[Guest]

Thanks for the reply.
No, there is no common hardware among them. The boxes are a mix of P3 and
P4's. Makes are IBM, Dell, and no-names we've assembled ourselves. The
other common software among them is VNC. Also, our WSUS only downloads
critical updates.
Any good guide out there for using windg? I think this is my best chance
for troubleshooting. I've downloaded XP SP2 retail symbols, but still get
many missing symbols when running windbg. Are there any more I can get?
Thanks!

 

[Gerry Cornell]

You might do best to troubleshoot a single or a strictly limited number of
machines. The experience may help resolve all but you can better control
what you have done and determine what measures work.

Are the Stop Error messages occurring during the boot process, the
Shutdown or otherwise? Is there a defined pattern?

Some suggestions:

1. Turn off automatic restart whilst troubleshooting. That way you get the
chance to record all Stop Error Messages.

2. Monitor all Warning and Error Reports in Event Viewer particularly
those within a minute or so of the Stop Error message appearing.

3. Test to see if the Errors appear in Safe mode.

4. Check in Device Manager for yellow question marks.

5. Use sigverif to determine which drivers are unsigned ( this approach
may get you too many drivers to check out ).

6. Post copies of full Error messages / Reports -partial reports invariably
leave out bits others find helpful even if you do not.

How have the latest Windows Updates been applied? Is it from a central
source? Could there be a problem there?

You could try uninstall the updates and reinstalling to the local machine
and observe the effect.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

Thanks for the reply.

I've been using Device Manager and Event Viewer as my starting point. I
then update the video, audio, and nic drivers and resolve any unknown
devices. From there I try dissect the crash error codes and minidump files.

These are production desktops, so it's not easy getting a lot of time on
them. Getting users to run in safe mode really isn't an option.

Our software updates are downloaded and installed via a WSUS server on our
network. I test them first before approving the downloads. After that, they
are auto downloaded and installed. Workstation hardware varies, so I can't
cover all variables there during testing.

The crashes have slowed in the past few days, so we're getting there!

 

[Gerald Fay]

Glad you haven't. I cannot run sfc /scannow without the
system rebooting into a BSOD.

I can reinstall XP sp2 with no problems, but if I run
SFC it will happen every time.

 

[Peter]

Sounds like the installation is corrupted. If it were me I'd format and
reinstall. You could try a repair install.

 

[Gerry Cornell]

Gerald

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Right click
on the My Computer icon on the Desktop and select Properties,
Advanced, StartUp and Recovery, System Failure and uncheck
box before Automatically Restart.

Do not re-enable automatic restart on system failure until you have
resolved the problem. Check for variants of the Stop Error message.

There will also be Error Reports in Event Viewer. Please post copies.

You can access Event Viewer by selecting Start, Administrative Tools,
Event Viewer. When researching the meaning of the error, information
regarding Event ID, Source and Description are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&Product=winxp

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Double click the button and close Event
Viewer. Now start your message (email) and do a paste into the body of
the message. This will paste the info from the Event Viewer Error Report
complete with links into the message. Make sure this is the first paste
after exiting from Event Viewer.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Gerald Fay]

Tried a 3rd time with a new XP PRO disc with SP2
same thing

This is not a reboot. It is a BSOD stop screen. I am
stuck and can do nothing.

Interestingly I can boot into Safemode, all hardware
components seem fine.

This was originally a fresh install of the OS.

If I reimage the drive with Acronis all is well

I have no confidnece in SFC.

 

[Gerry Cornell]

Gerald

Why don't you post a full copy of the Stop Error message.
Without real information it is difficult to know what is happening
or why SFC is relevant!

A tip for posting copies of Error Reports! Run Event Viewer and double click
on the error you want to copy. In the window, which appears is a button
resembling two pages. Double click the button and close Event Viewer. Now
start your message (email) and do a paste into the body of the message. This
will paste the info from the Event Viewer Error Report complete with links
into the message. Make sure this is the first paste after exiting from Event
Viewer.

--

Hope this helps.

Gerry
~~~~
FCA
Stourport, England

Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~