Corrupted Registry XP

[Seth]

Hey all,

I'm having a hardware issue that I could use some suggestions on.

I keep getting boot file corruption a few hours or a few days after a clean install of XP with a retail cd. I've replaced the IDE hard drive twice. The hard drives weren't new, but a full scandisk and manufacturer's diagnostics show no problems with the drives.

I can't remember the first error (boot files though), and now the second time around Windows can't start because the windows\system32\config\system is missing or corrupt.

Diagnostic notes:

1) The system is, and has always been clean of malware. It's a customers computer that is used for the occasional e-mail, and minor internet usage.

2) The only third party program installed after the clean install is Mcaffee.

3) I thought perhaps the error wasn't accurate, as in the files were fine but something else was occuring. I confirmed system file corruption, as the XP cd can't even detect the installed XP.

4) This issue is almost always attributed to a bad hard drive (but again, I've replaced it twice). I've read that it also may be caused by bad ram or a power issue. Well, I fail to see how bad ram can cause file corruption, but I ran a memtest anyway and that was fine. I also fail to see how a power issue could cause this problem.

In the past I've had bad drives that showed good with an XP scandisk and manufacturers diagnostics, yet showed cluster problems when testing the drive with a full scandisk using a 98 boot floppy. I believe that the 98 surface scan is far more thorough than XP's or the mnf diagnostics, as it takes WAY longer.

I'm going to perform the full surface scan with the 98 boot floppy. If it's not the drive, then what the hell is going on?

[dbarrow]

Believe me... a ram problem can erode files in XP like you wouldn't believe.

Is the problem with all/many XP files ie: stuff won't work when you go to load it because the file is missing/corrupt
or, is it just boot problem with blown config file?

These are two different issues...
The latter can be caused by too quick a shutdown, there is an MSKB article I recall and a way to delay the shutdown until all writes are complete. Problem caused by super fast machines that complete shutdown before XP can finish writing the reg file on exit.

The other, general corruption, problem can creep up pretty fast from unstable overclock, failing CPU, ram and ram timing problems.
An unstable overclock will produce similar symptons in short order chewing all kinds of holes in the OS.
Third, and least likely, is a small HD or partition and Page File size set to automatic management where it can expand too much. XP will eat its own files to make room in the process.

[Seth]

Thanks for the reply.:)

Believe me... a ram problem can erode files in XP like you wouldn't believe.

I'll research this later, but I still can't see how bad ram can corrupt files on the hard drive.

Is the problem with all/many XP files ie: stuff won't work when you go to load it because the file is missing/corrupt
or, is it just boot problem with blown config file?
Just boot files (good clue here!). This may indicate the quick shutdown below...

These are two different issues...
The latter can be caused by too quick a shutdown, there is an MSKB article I recall and a way to delay the shutdown until all writes are complete. Problem caused by super fast machines that complete shutdown before XP can finish writing the reg file on exit.
I remember that as well and think you're on to something here. I'll check it out later. But why would an operating system need to re-write a boot reg file?

The other, general corruption, problem can creep up pretty fast from unstable overclock, failing CPU, ram and ram timing problems.
An unstable overclock will produce similar symptons in short order chewing all kinds of holes in the OS.
Ok. I'm obviously missing something here because I'm not understanding how any of that could corrupt stored boot files.

Thanks again!

[dbarrow]

Ok, I think this sounds like a shutdown exit problem, if no other files have been corrupted, ie: chkdsk didn't return a bunch of lost strings, show bad blocks and sectors, there is no long list of recovered temp files.

One of the last things that XP does on exit (Saving Your Settings) is write to config hive with current desktop and screen, vid, sound settings. That's how it remembers any changes you made and your system state on exit. Sound cards/chips/driver software often write a reg key saving your last volume/environment settings. There are a bunch of things that write a reg key on exit.

Without digging up the MSKB article, as I recall, under circumstances where a fast mobo chipset and ram exist, this write can get cut off mid-stream as the drive has not finished completely when the mobo executes reboot/shutdown command and drops power to hd.
You can extend the shutdown timer several seconds to prevent this to ensure the drives complete all writes.

#2: Make sure to turn off reboot on all errors.
There could be a program or service not responding to the shutdown and hanging. That can result in the same thing.
You want it to hang, BSOD, or write an error to the event log rather than rebooting, ie: the error is sending the reboot signal before the write on exit completes.
Seen this before and it does not complete a mini-dump.

#3. HAL corrupt.
A hardware device is not responding fast enough on shutdown. Fancy vid cards, and for that matter, ATI drivers that save reg keys after a vid card state/settings change, cause a similar delayed write exit problem and cause the HAL hive to corrupt.

When you encounter this...
HAL or CONFIG is missing or corrupt on boot and you can't boot Windows.

Easiest method, other than restoring an image:
Boot from XP cd
Select first "r" repair option to enter Repair Console
Logon to XP build and enter Admin pw
You will be at a DOS :> prompt in Repair Console.
CD /Repair
Copy SAM, SECURITY, software, system files to
\Windows\System32\Config
(Or start by just trying the system file which is the config)
This is replacing the corrupt hive file in System32\Config
with the Repair copy that XP stores in Repair folder every so many reboots or days.
Exit Repair Console and reboot and it should come back up normally.

System Restore performs about the same function as there is another copy of the reg stored there but you can't get to it if the HAL is corrupt and it halts before a partial boot to the boot menu where you can choose System Restore.

Unstable OC, ram, CPU problem causes similar write delay on exit as something just does not respond right or fast enough due to error.
There is a list somewhere of all the files XP writes on exit but I can't remember where to find it. Point being, XP must complete these saves on exit or the file(s) get blown with an incomplete write and fail to load on the restart.
Depending on which one, mostly reg hives, XP can't boot again as they are required = can't load error or BSOD with STOP error.

The info is in the MSKB... of course, finding the right articles takes searching and reading.
I've been down that road before and found them where I picked all this up.
I do recall making some exit adjustment on this machine when I built it but cobwebs prevent me from remembering it exactly.
I've seen this with a slightly unstable OC that otherwise acts normal with a few minor quirks but frequently blows the files on shutdown.
I've seen this with a "hanging exit" where it seems XP is stuck and you have to push the reset button to get it to reboot.
I've seen this with a hard BSOD where a driver issue, like a vid setting causing a game dump stalls the OS but it still continues to try an exit write.

If the cause of all this is a regular event, you will have to hunt it down and find it or it will continue to do it.
There is another similar problem where, for some reason, the exit write never happens. XP will reboot, fixing itself with an automatic repair drawing from one of the backup reg files. Changes you made before exit never get saved ie: a program you just installed won't load and does not appear to be there as the reg changes the install made were not saved or were eliminated when XP replaced the file with the backup copy.

Rest assured, it will drive you insane!

[Seth]

Well dbarrow (it's Doug right?)...

I believe one of the following was causing the reg config corruption:

1) The only significant error in Event Viewer was "Plug Play Manager". The description was "LG cd rom disappeared from the system without first being prepared for removal". So there's a problem with the firmware, driver, or the mobo's IDE controller. I disconnected the cdrom.

2) I noticed a "clicking" sound (like a relay sound) coming from the network card. It would occur two or three times while the system booted, as well as when it shut down. I replaced the card.

I then paid my 11 year old to repeatedly cold boot the system for an hour.:D So far, no sign of reg corruption. Thanks again!

[kelly]

A clicking sound coming from the NIC? How can that be? What would be clicking?