[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1011
  • Last Modified:

Repairing Corrupted Windows XP on Lenovo Laptop

I have a client with a Lenovo 3000 V200 laptop. Originally it came with Windows Vista installed, but client retrograded back to Windows XP Pro soon after purchasing the laptop. Today the computer started crashing at boot time. Trying to boot into Safe Mode also crashes the system.

I tried booting from a Windows XP Pro CD in order to do a repair re-installation of Windows XP. However, I never get an option to reinstall the OS. It will show the NTFS partition there with the options to delete that partition or reformat it before installing. I told Windows to install w/o altering the partition. As expected this installed Windows into a separate folder (Windows.0). I can now boot with no problem into that 2nd Windows. Once at the desktop, I installed and ran MalwareBytes and ComboFix to rule out malware as the cause of the crashes. ComboFix did remove some files and directories. However, I still can't boot into the first Windows install.

I'm guessing that there a corrupt driver file or Windows startup file that is causing the crashes. I do see a BSOD before the system crashes, but it flashes off in less than a second before the system reboots, so I can't read which file or driver is causing the crashes.

Would appreciate advice on how to proceed with this.  How can I check the crash/error reports from that 1st install?
0
anuneznyc
Asked:
anuneznyc
  • 19
  • 7
  • 6
  • +4
8 Solutions
 
bigeven2002Commented:
Hello,

Unfortunately, XP does not have a startup repair option, from boot or by CD.  However, this link shows a Microsoft diagnostic utility (30- day trial) that might help.  It should enable to you activate System restore which may fix the problem by rolling back the machine to a workable time.

http://www.winhelponline.com/blog/perform-system-restore-rollback-on-non-bootable-xp-computer/
0
 
torimarCommented:
The crash dump file(s) will be located in c:\windows\minidump

While it should be possible to access that folder via the Recovery Console, you will not be able to copy it onto removable media for use on another computer - unless the laptop has a floppy drive. So you will need to boot with either a WinPE bootable or a Linux boot CD. I recommend Parted Magic: www.partedmagic com

Boot off that CD with a flash drive inserted, mount the HDD and flash drive via the Mount tool on the desktop, then copy the dump file(s) and analyse them on another PC which has Microsofts WinDbg debugger installed and configured. Alternatively, you could also try Nirsoft's BlueScreenView on it:
http://www.nirsoft.net/utils/blue_screen_view.html
0
 
anuneznycAuthor Commented:
Here is another odd thing. I tried running SFC /scannow and I keep getting prompted for the Windows XP Professional SP3 CD, which is what I used to install Windows. Well, that CD is already inside the drive! So why is telling me I have the wrong version of the CD installed?? Is it maybe b/c it doesn't match the CD that was used to originally install Win XP years ago (the version that is corrupt, not the one on Windows.0)?
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
bigeven2002Commented:
Actually nevermind, the link is invalid.
0
 
torimarCommented:
Edit:

The download location for the boot CD got truncated. Of course, it needs to read: http://partedmagic.com
0
 
torimarCommented:
Sorry, I did not notice that you could actually boot the machine. In this case, ignore the first part of my answer.

You might as well get the dump files from the other installation, and post them here.
0
 
Rob MinersCommented:

If you haven't already performed this task, consider it step 1.

1.      Press the WinKey + Pause
2.      Click Advanced and under Startup and Recovery select Settings.
3.      Uncheck Automatically restart.
4.      Click on the dropdown arrow under Write debugging information.
5.      Select Small memory dump (64 KB) and the output is %SystemRoot%\Minidump.
6.      Restart the PC normally as this will allow the System to Blue Screen with a Stop error code and create a Minidump file.

The location of the Minidump Files can be found here. eg: C:\WINDOWS\Minidump\Mini000000-01.dmp

 Zip them and post them here. Someone here will be able to check them for you.
0
 
anuneznycAuthor Commented:
rrjmin0, I followed your instructions, then rebooted into the 1st Windows and it crashed. Now I do see *.dmp files in that directory, but there are none from today. They range in date from 3/10/09 to 6/24/11.

I don't understand how that can be? Seems like the crash info is not being written at all?
0
 
anuneznycAuthor Commented:
Zipped file of the Minidump directory is attached. Thanks.
Dump.zip
0
 
Rob MinersCommented:
The first one may not have the setting to collect the dump files set. Copy the last one from the original and the ones from the second install so that we can see whats happening.
0
 
anuneznycAuthor Commented:
The 2nd install doesn't show a Minidump folder. Guessing that's b/c it's not crashing. There are 6 files under Minidump in the 1st install, all of which I zipped and attached in post 37012259. Thanks.
0
 
Rob MinersCommented:
Ok if the second install is stable I would backup all of the clients data, wipe the hard drive and reinstall. I normally use Darik's Boot and Nuke to prepare a drive and it will remove any nasties that may still be on it.

http://dban.sourceforge.net/

OK things have changed a bit since I've been activly involed in this industry, there is a bootable CD version here:

http://www.dban.org/download

Documentation that you should read.

http://www.dban.org/documentation

Autonuke should do it.

0
 
anuneznycAuthor Commented:
Wipe & reinstall is not an option. Client needs laptop back soon and no way I have time to back up, wipe & reinstall inside of 2 hrs. Not to mention all the programs loaded on there.

Anyone have other suggestions for me?
0
 
torimarCommented:
The only dump file that was from this year reported a crash due to memory corruption, in association with dwtrig20.exe - the DrWatson trigger module for Microsoft Application Error Reporting.
But it is 4 months old, thus possibly in no way related to the present problem.

If I had to deal with this, I'd get EruNT: http://www.larshederer.homepage.t-online.de/erunt/

- use to make a backup of Windows.0 registry
- backup the registry of the old windows (c:\system32\config)
- use the SYSTEM hive copied by EruNT (c:\windows.0\ERDNT\<date>\) to replace the SYSTEM hive of the old Windows
- try booting the old Windows

If the crash is driver related, this should help avoid it. Should the old Windows boot up again, make sure to check whether all hardware is correctly installed.
0
 
anuneznycAuthor Commented:
Torimar, that seems like a pretty good idea. However, replacing the registry of the original windows install will mean that all the application programs installed on there will no longer work, right?

Would there be a way to re-import just the application registry entries so that they will still be accessible?
0
 
anuneznycAuthor Commented:
Oh wait. I just read your post more carefully, Torimar. I only need to import the SYSTEM hive, right?
0
 
torimarCommented:
Yes, that was my suggestion.
This way, you would not touch the software settings, only hardware and driver related keys would be replaced by a known working configuration.

No guarantee that this will work, but pretty good chances, given the fact that almost 80-90% of such boot crashes turn out to be registry related.
In your case, because of the malware cleaning, the crashes could also be caused by a deleted required system file, that's true. But maybe you will obtain at least a readable error output.
0
 
anuneznycAuthor Commented:
Can I just copy & paste the new SYSTEM file into c:\Windows\system32\config??

Or do I need to import that in using REGEDIT?
0
 
andrewmccCommented:
Hi,
If you do the math on the time and effort you will spend trying to reinstall Windows over the top of an existing installation or repairing it, it generally is not worth it.
My honest, practical advice, is to backup all and any data you need to keep, documents, application check list, favourites, check the pst files, outlook mk2 files, outlook express, etc.
Format and do a clean install, this time after the initial installation, of Windows XP, copy the i386 folder (including system files etc) to the root c:\ drive.
Then install Windows XP recovery console, and set it as a delayed boot option, you can google how to install that part, have provided a link to the Microsoft installation guide.
Once you have installed Windows XP, up and running, drivers installed, service packs applied and locked down the desktop via a/v and i/s software, happy it is running, simply use something like Norton Ghost to a removable usb drive or dvd/rw, check the image and away you go.
Total job - suggest half a day.
If you follow everyone else's instructions - being polite, you are going to have nothing but problems of "reinstall of top of existing windows issues, conflicting internal versions of windows, registry issues" and you are never going to be able to honestly work out whatever caused the problem, hence waste of time.
As a paperwork exercise it is worth while finding out sometimes, though invariably it is better to start again from scratch.  I've been doing the job for the last 15 years, if it is taking more than an hour to sort it, it is quicker and more practical to do the above.
If you are worried about loosing any data, a replacement laptop harddisk is not expensive, so buy a spare, use that to install Windows XP on it, then use an external usb caddy/drive unit to transfer your old data from the old drive once you have it up and running.
If you get stuck let me know.
The other guys have helped, though as an overview, your time is precious, value both chains of thought.
0
 
torimarCommented:
You can just copy and paste.
But you cannot do it directly, since the registry on a running system is locked. That's one of the reasons why you would have to use EruNT. It applies shadow copy to copying a registry in active use. You may then copy the copy made by EruNT.
0
 
torimarCommented:
And don't forget to backup the original hive on the old system first.
0
 
anuneznycAuthor Commented:
Thanks. Understood. I copied the entire c:\Windows\system32\config directory into a backup folder. I will now try copying & pasting the backup of SYSTEM into the original Windows install and see what happens.
0
 
nobusCommented:
i would run a ram and disk disk diag in this case, just to be sure about the basics - doing repairs on a bad disk is asking for more trouble
i suggest to download ubcd, and run memtest86+ for ram, and the disk diag for your diak brand
http://www.ultimatebootcd.com/      

then we can proceed running a chkdsk on the drive to correct system problems
0
 
anuneznycAuthor Commented:
Copying & pasting the backup of SYSTEM into the original Windows install did not solve the problem, although the boot process do go considerably farther. But in the end still resulted in a BSOD.

Nobus, that's a good point and something I thought of last night. So I ran Spinrite overnight to analyze/fix the HDD and it did find one unrecoverable sector. That's probably where the critical system file was located that is now causing the crash. Thanks Murphy's Law!!
0
 
anuneznycAuthor Commented:
Since copying & pasting the backup of SYSTEM into the original Windows install didn't work, how about if I copied and pasted the SOFTWARE section of the original Windows install into the current working Windows install. Would this allow me to run all the apps that are already installed on this system?
0
 
nobusCommented:
i have used spinrite also - try the free trial of HDDRegenerator, to see if it repairs it : http://www.dposoft.net/hdd.html      
i found it repairs more than Spinrite does
0
 
anuneznycAuthor Commented:
Andrewmcc, your point is well taken (as well as others who suggested it)...9 out of 10 times, I just back up all the data, wipe the HD and reinstall the OS and all apps from scratch. Almost always the best solution in the long run. But now I'm obsessed with seeing if I can get the system working with these registry manipulations.
0
 
anuneznycAuthor Commented:
Thanks, Nobus. Running HDDRegenerator now.
0
 
andrewmccCommented:
Hi,
Its cool re options.
Would suggest for speed and time wise, pull the harddisk if you an external caddy use to.
Do a chkdsk  with /f /r on it.
Make sure the drive is physically intact and ok.
Quickly ghost the drive.
Then rename both the documents and settings, windows & windows.0 plus the program files folders to .bak or something similar.
Do a clean install into a new windows (c:\windows) install, as any other apps you might try to install will probably screw up if they detect more than one instance of a windows folder on the root.
Also, have you tried a safe mode boot via system log, ie. loading the services and drivers etc one by one, to see what is actually causing the original install to crash / bsod?
Ghost it now and you'll have time to play around with the image on another system later if need be.
0
 
anuneznycAuthor Commented:
Thanks Andrew. How do I force a a safe mode boot via system log?
0
 
andrewmccCommented:
Look up;
http://support.microsoft.com/kb/315222

What you want to pay attention to is;
•Enable Boot Logging: This option turns on logging when the computer is started with any of the Safe Boot options except Last Known Good Configuration. The Boot Logging text is recorded in the Ntbtlog.txt file in the %SystemRoot% folder.

This is a secondary boot option via F8, select boot logging and it should (should being the operative word) hang or show you wherever XP is having a bad hair day :) - ie whichever driver and application or component within Windows XP is messed up.

Back in the good old days of Windows 98 whenever a friend got a bluescreen, he found the file and deleted it, then his problem went away!
Regretfully in Windows XP, you can't really do that.

With what you were trying with the System File Checker, I think I might have an idea why you were having a problem, if you initially used a plain version of Windows XP (ie. with no service pack in it), then installed SP1, SP2 and SP3, etc.  Then you might be having a problem with SFC itself, as the version of file on the install media might be a different service pack version.

If you have time later, look up;
http://www.theeldergeek.com/
Useful site, you can slipstream in the new big service packs into your own version of Windows XP, hence saves time having to install, do updates and apply service packs, just be careful.

I take on board what you said about trying to get it fixed, etc.
Though I would have done the same some time back, now I use Ghost to image the drive, if need be put in a new harddisk, install Windows on that, then give the client an external drive caddy and let them browse through it at their leisure.
If you don't have the time or the client might delete something they should not, simply fit a big enough drive, install Windows and then do a data dump from the old drive (just copy all critical folders, application folders, and user files to a backup folder) leave all the original files on the old drive).
Some people get funny when you format or delete files they may need some time later.
Fitting a new drive is probably the most practical.
0
 
andrewmccCommented:
If the objective is to get a working laptop with os running, basic apps installed and gives the client time to do what they need to do, then I would suggest using a licensed copy of ghost, image the old drive, install ghost onto the laptop, then make a complete image of the old drive and copy that image onto the laptop, so you should be able to both access the data at the same time as being able to possibly restore what you can in the mean time.
(Had the same predicament some time back, ended up doing that as client refused to buy another drive)
0
 
nobusCommented:
any results from HDDReg ?
0
 
anuneznycAuthor Commented:
Nobus, HDDReg scanned the entire HDD and reported 0 bad sectors, which I thought was odd b/c Spinrite did find 1 unrecoverable sector ealier. Maybe b/c Spinrite marked that bad sector off the FAT and so HDDReg didn't see it??

In any case, I had to get the laptop back to the client yesterday as he was leaving the country. The Windows.0 boots up with no problems. I created a shortcut on the desktop to his data. He will have to reinstall his applications.

So this was pretty much another case where backing up data, wiping and reinstalling from scratch would have been the best solution if there had been enough time.

Thank you to everyone who contributed their advice.
0
 
nobusCommented:
>>  which I thought was odd b/c Spinrite did find 1 unrecoverable sector ealier   <<   it probably repaired it
and yes, fresh install is always the best
0
 
andrewmccCommented:
Hi
Hope advice was helpful.
All the best.
0
 
anuneznycAuthor Commented:
Nobus, is HDDReg your first choice for repairing HDs? Spinrite has a great reputation but it has yet to come through for me in all the times I've used it to try to repair a HD or recover data.
0
 
Crackx2008_INFOTECCommented:
Brother, Remove the hard drive and do a manual system restore, that fixed the issue many times for me.

If you need to know how to get it done let me know.

you will need a sata or IDE to USB adapter and a working computer do so...

0
 
nobusCommented:
Yes it is; i used to have spinrite - but found HDDrge faster, and repairing more than spinrite
hddreg repaired up to now about 6 drives of the dozen or so i tried it on - zilch with spinrite (but it can be a coincidence) -  i still use it for maintenance
0
 
anuneznycAuthor Commented:
Crackx2008, how does one do a "manual system restore"?
0
 
Crackx2008_INFOTECCommented:
Here you man, hope this helps...

This is how to manually revert to a previous system restore point in Windows XP. Use these steps when your computer fails to boot into Windows in normal mode or safe mode, AND the affected hard drive is connected to another working system via a USB enclosure or an IDE/SATA to USB adaptor.


1. Create a folder called "temp".

2. Goto C:\WINDOWS\SYSTEM32\CONFIG on bad hard drive.

3. Copy the following files from the CONFIG folder and into the "temp" folder.

system
software
security
sam
default

4. Modify the 5 filenames by adding the ".bak" extension to the end them.

5. Ensure your system's Folder Options is set to un-hide OS Files and Hidden files, and disable Simple File Sharing.

6. Goto the folder named "System Volume Information" the root C: drive of the bad drive. Change security/permission settings in order to access the folder.

* If the System Volume Information folder does not exist, then System Restore was never enabled from beginning. Game over. Transfer any important files from the bad hard drive onto a backup location and reinstall windows on the bad hard drive.

7. While inside the "System Volume Information" folder, there will be some folders named "_restore{some HEX digits}". Open the folder with the most recent date.

8. Then open the most recently dated folder named "RP##"

9. Open the "snapshot" folder

10. copy the following five files into the "temp" folder.

_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_USER_.DEFAULT

11. Modify the filenames by removing ALL text except for SAM, SECURITY, SOFTWARE, SYSTEM and, DEFAULT on the end.

12. Copy these five files into C:\WINDOWS\SYSTEM32\CONFIG

14. Reboot and verify successful restore!!

* If system is working, but loaded into the wrong restore point, then try a different restore point via START menu.
0
 
anuneznycAuthor Commented:
Thanks Crackx2008. That sounds like it could be useful next time I come across this type of situation. I would also need to copy over the entire "Program Files" folder from the old HDD as well, in order to avoid having to reinstall all the applications on the new HDD, right?
0
 
Crackx2008_INFOTECCommented:
That is right my friend... You got it :)  good luck man!
0
 
Crackx2008_INFOTECCommented:
That is right my friend... You got it :)  good luck man!
0
 
nobusCommented:
actually that is what ms says in this article : http://support.microsoft.com/kb/307545
----------------------------------------------------------------------------------------------
An easier way is to boot from a Bart PE CD (or UBCD4Win CD) and use the file manager for manipulating files. Here  the procedure :
1. rename c:\windows\system32\config\SYSTEM to c:\windows\system32\config\SYSTEM.bak
2. Navigate to the System Volume Information folder.
it contains some restore {GUID} folders such as "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}".
The restore points are in  folders starting with "RPx under this folder.
3. In such a folder, locate a Snapshot subfolder. This is an example of a folder path to the Snapshot folder:  C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot
4. From the Snapshot folder, copy the following file to the c:\windows\system32\config folder
 _REGISTRY_MACHINE_SYSTEM
5. Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM
6. Exit Bart PE, reboot and test

Use a fairly recent restore point from at least a day or two prior to problem occurring .

** you can add the other hives also with this procedure

http://www.nu2.nu/pebuilder/       BARTPE
http://www.ubcd4win.com/            UBCD4WIN
0
 
bigeven2002Commented:
My initial post is my final recommendation.  Thanks!
0
 
anuneznycAuthor Commented:
Sorry for the delay, guys. I will assign points & close. Thanks.
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

  • 19
  • 7
  • 6
  • +4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now