A bug bite that stings

[Jason Dunn]

<a href="http://www.tek-tips.com/gviewthread.cfm/lev2/67/lev3/70/pid/779/qid/101860">http://www.tek-tips.com/gviewthread.cfm/lev2/67/lev3/70/pid/779/qid/101860</a><br /><br />This has nothing to do with our Pocket PCs, but I think this is important enough to pass on to you. Have you ever booted up your Windows 2000 or Windows XP computer only to be presented with a message that says something about the "windows\ system32 \config \system" directory? It might say the HIVE file is corrupt, the registry is corrupt, or that your system.log file in the /software directory is corrupt. There are around six variations on this error, but they all result in the same thing: a completely dead OS that is very difficult to recover from. Searching the Microsoft Knowledgebase at the time, I discovered nothing of any help. A complete reinstall seemed to be the only choice.<br /><br />Last year I was installing Windows 2000 onto several brand new computers for my church. Two of the four computers received this error - I wasn't sure what to make of it. All the machines were ASUS A7V mobos, Duron CPUs, and ATA-100 hard drives. Over the next six months, two more of the machines had the same problem. I suspected flaky ATA-100 hardware or drivers. Fast forward to today - my own XP machine (also an ASUS A7V) died with the same error two weeks ago. This was the third time I'd seen this problem on my rig - twice with 2000, once with XP. What was going on? <br /><br />I decided to research the problem more thoroughly than last time, and on the site linked above I found hundreds and hundreds of people who had the same problem. They all had different motherboards, RAM, CPUs - the only commonality was Windows 2000 or XP (and newer hardware, typically fast ATA-100 hard drives). The theory that makes the most sense is this: Windows 2000/XP have accelerated shutdown routines, and they shut down the machine before the registry is finished being written to. Sometimes this causes the registry to mis-report its file size, and on the next boot the OS will report it as being corrupt. The same thing can happen to other critical system files. The fix is to get into the recovery console and copy the backups over, but when I did this I ended up with a blank profile in XP and the computer asking me to reinstall every piece of hardware over again - it was easier for me to restore a backup from two weeks earlier.<br /><br />I'm not normally one to believe in conspiracies, but I believe Microsoft has known about this problem for over a year and they've done nothing about it. Someone re-published a KB article that seemed to address the problem, but it doesn't exist on the live site anymore. The only way to prevent this (hopefully) is to reboot your machine instead of powering it down, and when it reboots to the BIOS screen, punch the power button. Every other solution I've seen seems to be only partially successful (slowing down RAM speed, etc.). I could be completely wrong on this, but I've seen this problem enough times to know how serious it is - and I wanted to warn you all about it.

[paulv]

I simply loaded the 2 second delay patch for my motherboard a year ago when I read about it. Certainly no prob so far but then again we are talking about MS here :-)

[docangle]

I have avoided this problem by using 'Hibernation' instead of Shutdown, much faster than reloading XP or 2000. But from what I have heard is that this problem tends to occur with VIA chip sets and AMD CPU's, I beleive that AMD has a patch.

I myself have never had this problem on any of my personal machines, but I have seen this problem several times, but strange as it may sound it has only happend using VIA chip sets and AMD CPU's in combination with Maxtor and Western Digital ATA-100 HD's, and have never had this problem with IBM ATA-100 HD's. Most of my personal systems are built around the Abit KT7-100 or MSI KT3 Ultra Motherboards and I always use IBM HD's (Models 120GXP and 60GXP, but not the 75GXP(they have had reliability problems))

Just my observation - YMMV

[johnm]

Oh yeah I had this happen at least three times a year ago with a new system I built last year running 2k. The motherboard was MSI (I forget the model) with a 133Mhz system bus Anthlon. I was also running the bus mastering driver for ATA 100. There was no recovery. Believe me I tried. I re-installed Win2k twice, and on the 3rd crash I gave up and ran Win98 for a while. This machine would also lock up occasionally doing video stuff. It ran rock solid under Win98.

About Summer of 2001, I was pursuaded to try Win2k again after hearing of some big improvements made to the BIOS. When I went to the site to grab a bios update I found that they were releasing new drops about every other week for the first 7 months the board was out. I flashed the BIOS, wiped the drive and put 2k back on and it was rock solid. Now I run Xp on it and still stable.

So my guess is that is might be BIOS firmware problems with specific chipsets. Good luck.

JohnM

[Mr. Anonymous]

It's so ironic that this was posted today, as I had the same problem myself this morning and am planning on reinstalling XP this weekend on my rig (Asus A7V133, 1.33 gig Athlon Thunderbird, 80 gig Maxtor hard drive).

My solution so far has been threefold. First, I install XP without ACPI (press F7 during XP install) to disable automatic shutdown. Second, I regularly backup my registry with the excellent ERUNT (http://home.t-online.de/home/lars.hederer/erunt/). When my registry gets corrupted, I boot up with the blank default registry and restore my registry. Third, I disabled write caching in the driver properties tab for my hard drive.

It doesn't work all the time, but it's pretty good. I've looked for patches for my processor/motherboard, but can't seem to find anything. Must not be looking hard enough...

Of course, on my recent install of XP I still had an unexpected reboot the other day, and now I'm getting lots of random errors in IE and Outlook. This has happened a couple of times as well, and the only way I've found to fix this is to reinstall XP. On the plus side, I've got my entire reinstall process from scratch down to 2 hours.

[Hugh Nano]

I've had endless BSOD problems (not with this particular error message, but similar) ever since I got my AMD Duron machine. Have upgraded the memory and the OS from Win98 to WinMe, but with little apparent success in shaking these inexplicable crashes, and was beginning to wonder whether a too-rapid shutdown might be the cause of some of my problems. Has anyone tracked problems of this sort to over-rapid shutdowns with AMD Duron machines running WinMe, and, if so, do you know if there's a fix for it?

[jeff]

I've had the same problem with systems with AMD processors. It's far, far less likely to happen if you're using NTFS for the boot partition.

A safeguard is to run the registry backup utility every so often. Go to Start > Programs > Accessories > System Tools > Backup and choose Create an Emergency Repair Disk. Check the box that says, "Backup Registry" and run the utility. Your registry files will be backed up to WINNT\Repair\Regback. I usually rename that folder to today's date so I have multiple restore points.

Jeff

[Robotbeat]

I don't have this problem because my XP box isn't fast enough! 96 MB of 66 MHz RAM (iPAQs have 102 MHz SDRAM and some have as much as 256 MB!) and a 4 gig ATA (pretty sure it's 33) HD is all ya need! 333 MHz all the way! I betcha that I'll get a 400 MHz Pocket PC before I fix my 1.2 GHz Athlon beast. Basically, Pocket PCs have pretty much totally eclipsed my current PC, and my PC is perfectly fine and runs the latest OS fine, as well.

[entropy1980]

I have had this problem numerous times it is rediculous. Oh and not on just one machine.... several different machines!

[Dave Conger]

...Have upgraded the memory and the OS from Win98 to WinMe, but with little apparent success in shaking these inexplicable crashes, and was beginning to wonder whether a too-rapid shutdown might be the cause of some of my problems....

WinMe is just trouble by itself. Almost every ME system I have worked on has had some quirk (though I rebuilt my parents machine with ME and it has been working fine...knock on wood). 2K and XP shut down differently then 9x series Windows. Have you ever just FFR'ed (FDisk, Format, Rebuilt) your system? Could be helpful to fix some of the problems that have been created along the way.

[st63z]

Some at SR believe moving to dynamic disks yield better performance than basic disks because MS never fixed the bugs in basic mode and has to throttle down performance or whatnot. Anyways, to the person who said he turns off write cache on his HDDs, wouldn't you get a significant decrease in performance?

But yeah, I've had similar BSOD bootup problems at work where I've had to reinstall W2K... A couple of them were due to hardware/BIOS changes if I recall (for others, they were a mystery that I figured would take longer to figure out than a full reinstall in those cases)... I remember there was one very stupid instance when I must've been out of my head. I installed an IDE RAID controller card and switched the HDDs to it all in one step, without bothering to load the card's driver beforehand :roll:

If the hardware hasn't changed, I find HDD imaging to be a complete catchall backup method for my personal home machines (both for OS/app and for data). You just have to be dedicated in performing regular imaging, which is a pain. I've already rambled in the past on my personal methods, so I won't bore everyone again :)

[SiliconAddict]

Sounds very familiar. I have a homemade system with a MSI 6380 mobo with VIA chipset, AMD Athlon XP 1700+ and a Maxtor ATA-100 hard drive. I run Windows XP Professional.

When I run chkdsk it always reports corruption. When I try to run Diskeeper defrag I won't run because it 'sees' corruption on the hard drive. So I first have to do a boottime defrag and then Diskeeper wil run. Very annoying.

:cry:

[Janak Parekh]

For the record, I've never had this problem on W2k or WXP, using a wide variety of mainboards and a wide variety of installs (100+ machines).

Be aware that a poorly-written ATA100 driver could cause this, or an application. For example, pcANYWHERE 10.5 causes a WinXP machine with a nVidia card to become toast if you run CHKDSK /F (black screen on startup after the CHKDSK runs). I tend to install my machine with the latest Promise drivers, latest BIOS updates everywhere, etc. Sometimes, the ATA100 drivers bundled with the OS might not be the latest and greatest (but in other cases they might be the most stable).

I'm sure Microsoft could be doing more to help all the users with this problem, but I'm far from convinced that it is omnipresent.

Good luck, Jason. :)

--bdj

p.s. Docangle has some good points... maybe some drives have write-back caches that don't write back so fast. Microsoft did release an "IDE shutdown update" for 9x and Me that slows down shutdown... maybe they need something similar here. Having said that, I've set up Athlon mainboards with WD hard drives without problems (so far... ::knocks on wood:: )

[Jason Dunn]

Have you ever just FFR'ed (FDisk, Format, Rebuilt) your system?

Every rebuild of my system I do this - I always start from scratch and rebuild my system with loving care. :-)

[krisbrown]

Solution, don't upgrade to XP/2K bloatware :D

[Perry Reed]

This has happened to my wife's Compaq PC several times since she upgraded to XP. It never used to happen with Win98.

I'd be very interested to know what the problem and/or solution is. It's a real pain in the backside to keep rebuilding her machine (and she loses her data each time).

[Jason Dunn]

I'd be very interested to know what the problem and/or solution is. It's a real pain in the backside to keep rebuilding her machine (and she loses her data each time).

Does she shut down her computer often?

[Perry Reed]

Does she shut down her computer often?

Very rarely, actually. Should she shut it down more often??

[docangle]

SiliconAddict,

Your problem sounds as though you need to enable or disable your PCI Delay Transaction setting

[Janak Parekh]

Every rebuild of my system I do this - I always start from scratch and rebuild my system with loving care. :-)
I have to admit, I used to enjoy doing this and look at the nice "clean" machine. But today, it takes me 3-4 hours to reinstall all the programs (and this on a really fast machine), so I hate doing it.

What happened to the good ol' days when it took an hour to format a 20MB (yes, MB) hard drive and 10 minutes to copy the 5 1.2MB floppies containing WordPerfect, and that was it? :lol:

--bdj

[Madoc Owain]

The problem is, hard drives today have rather large caches compared to a few years ago. The ATA-100/133 drives cache data but don't get enough time to dump that data to the platter before the power is cut. What's in that data? Oh, little things like your registry state (hive in XP)! If that data is incomplete or corrupted, you will suffer problems when you next boot up. There's a couple things you can do to keep this from happening:

1. Patches, we don't need no steenkin' PATCHES! Or do you? Before installing your Windows OS, make sure you have any relevant patches and drivers available for your system - I'm talking about VIA 4-in-1 (or 3-in-1) drivers as well as the OS Service Packs. The very first thing you should do immediately after the OS is installed is to install the VIA drivers you need for your particular setup. THEN apply the OS patches/service packs, and lastly apply the drivers/patches for your other hardware devices. This will solve 9 out of 10 problems you have in getting your new system going. Assuming both MS and VIA/Intel/Whoever have their IDE drivers properly patched for your OS, your system will have a 2-second delay, allowing the drives to finish writing their cache data, saving your hive/registry data properly.

2. ACPI circumvention. This could be done another way, perhaps an OS setting, but this keeps you from having to worry about it, ever. Turn off ACPI in your motherboard's BIOS, and while reinstalling 2000/XP, hit F6 when it tells you to hit F5 if you have SCSI drivers to install. This will allow you to install the OS without the ACPI options. Now that ACPI is turned off, you will lose your "sleep" functions, but will be assured of not losing your registry/hive when shutting down Windows. Just remember to hit the power button when Windows tells you it's safe to turn off your computer.

Now, neither of these options will save your HD from corruption if you happen to reset it/power off while data is being written to your HD - nothing can do that - so keep in mind that this is a work-around to a problem that will always exist.

Hope that helps some of you, I know from some of your descriptions that this has been plaguing the community for some time.

M.O.
http://www.madocowain.com

[Jason Dunn]

and drivers available for your system - I'm talking about VIA 4-in-1 (or 3-in-1) drivers as well as the OS Service Packs. The very first thing you should do immediately after the OS is installed is to install the VIA drivers you need for your particular setup


Great post - thanks for the info. But you know what? I had been running my current install of XP on this machine for three months, I installed the VIA patches, and within four days I had the problem I mentioned. Might be a coincidence, but I'm leery of trying again... 8O

[BevHoward]

"Solution, don't upgrade to XP/2K bloatware"

However, based on current experience, that could mean that you won't be able to sync newer PPC's ;-/

[Ed Hansberry]

FWIW, I have never had this problem, and I have about 30WinXP/2K workstations around. But we also never power down. Reboot, yes, but power down, no. Not here and at home. At work, the backup and AV does its work at night. at home, I need the SETI@Home crunch time. :lol:

[klinux]

Solution, don't upgrade to XP/2K bloatware

Yeah, great idea, why don't I go back to running DOS so I don't get them BSOD? :roll:

[Dave Conger]

Solution, don't upgrade to XP/2K bloatware

And run what? I guess you would have to go with klinux and load DOS, cause though you might be able to install Win95 in 32mb, you can't do anything with it...98 is slow and doesn't compare to the features of 2K....ME, are you kidding me, it blue screens before you even configure it.

[medic119]

I KNOW of this problem very well and I have the best solution I have found so far.

First of the problem only occurs in Win2K/XP and not 98,98SE or ME.

Second M$ has in fact known of this problem since Win2K before sp1, they just haven't cared to fix it.

Now my solution.
I had this happen twice. Never with 2K just XP. Once on my desktop and I re-installed everything and went the long way around. The second time was on my laptop.
I did some reasearch and found the stuff mentioned about booting to the console and re-copying the registries over. I did that and had to re-install software, etc

I went on a search and found a great little program called ERUNT (I can't remember where, but it shouldn't be hard to find). Its free and it does one thing:
I makes backups of all the registry files and other files corrupted by this bug. It comes with a restore utility too and its free. Works for NT,2K, and XP.
Basically, I make a backup of my registries with this program once a week or so. If the HIVE bug recurs, I just boot to console, go to the directory I backed up my registries to, and run the recovery app. It does all the copying and stuff for me. I reboot and I'm done.

The bug hasn't recurred since last time, but if it does I am ready this time.

[Hugh Nano]

...Have upgraded the memory and the OS from Win98 to WinMe, but with little apparent success in shaking these inexplicable crashes, and was beginning to wonder whether a too-rapid shutdown might be the cause of some of my problems....

WinMe is just trouble by itself. Almost every ME system I have worked on has had some quirk (though I rebuilt my parents machine with ME and it has been working fine...knock on wood). 2K and XP shut down differently then 9x series Windows. Have you ever just FFR'ed (FDisk, Format, Rebuilt) your system? Could be helpful to fix some of the problems that have been created along the way.

Yup. At least twice with WinMe, but probably more like three or four times. Seems to help for a little while, but then performance gradually deteriorates. The system has been more stable since I made a habit of logging off first, then using &lt;Ctrl>+&lt;Alt>+&lt;Del> to shut down from the task manager.

[stevehiner]

Sometimes these types of problems occur because of the size of your primary partition. Even modern BIOSs are not able to see past about 7.8GB (I think that's the right number) so if one of your system files end up beyond that point you won't be able to boot.

You can sometimes fix the problem by putting the drive in a good system, move all non-system folders off the drive, defrag the drive completely and copy the non-system files back onto the drive. You need to move the non-system files so all the boot related files will be moved below the 7.8GB barrier.

This particular issue doesn't explain all the problems described in this forum since the registry isn't accessed during the early boot process so it doesn't matter where it is on the drive. The reason why it might work for a while and then bomb out is because Windows XP defrags in the background. If it happens to move a system file used during low level boot-up then you may not be able to boot.

One of the best ways to avoid this problem is to make sure your primary partition is less that 7.8GB. If you have less than 7.8GB on the partition you can use Partition Magic to adjust the primary partition down.

Like I said, this doesn't explain all the problems listed in this thread but it would account for some of them, including some of the ones in the initial post. There is an article on this subject in a recent issue of the newsletter put out by Executive Software (makers of the Diskeeper defragmenter). You will find it in the current issue of their Insight eLetter at
http://www.executive.com/eletter/current/eletter.asp#a2

Hope this helps.

[Jason Dunn]

There's a hotfix from Microsoft that you can get if you have this problem:

http://support.microsoft.com/search/preview.aspx?scid=kb;en-us;Q318159

You'll need to call them in order to get it though. :evil: :evil:

[Ed Hansberry]

And how are you supposed to apply this hotfix if your machine doesn't boot?

[Jason Dunn]

And how are you supposed to apply this hotfix if your machine doesn't boot?

Damn good question. Heck if I know! :evil: