Boot errors (redirected)

[StarStrider]

Hey guys...I was told to start a new thread here. My first thread about this problem is here, and I'll be copying/pasting the background info from that if it's all right.

I have a Gateway 2004/5 laptop running WinXP sp3. It has Norton anti-virus 2010, and I do have MalwareBytes on it, but I'm sure it was out of date as I hadn't used the laptop in several months. Either way, I hadn't fun Mbam for a while (yeah, I know...).

Right now I'm using the family desktop, as I can't do anything other than run the laptop from a CD boot.

Everything started yesterday afternoon with a kernel stack inpage error [ 0x00000077; 0xC000000E, 0xC000000E, 0x00000000, 0x02CB200 ]. When I restarted, it came to the unmountable boot volume blue screen. I'd encountered that several years ago, so I put in an XP sp3 slipstream disk (I do own my version legally, though; I'd had to make a slipstream disc to install recovery console startup option on the desktop last winter). I brought up the recovery console and started with chkdsk /r. That first time it listed my C:/MiniNT as the (only) partition option.

After that finished, I restarted and the same unmountable boot volume error came up, but when I went into the recovery console again it wouldn't list the C:/ drive and only gave me my D:/MiniNT option (my D drive is a bare system restore partition that was done when I'd purchased the laptop). I tried fixboot as well as chkdsk /r a few more times (occurring over several restarts and into recovery console again). I then tried bootcfg /scan which stopped with an error saying the scan had failed and told me it might be too corrupt. Thus, bootcfg /rebuild also will not work.

With that I tried to repair the XP install with the slipstream disc (the non-destructive repair install), but it would not give me the option to repair the installation and told me C:/'s file system was either unknown or too corrupt to read and wanted me to reformat. I canceled out, just in case there's still a way to save it.

Now when I restart instead of the unmountable boot volume error, I just get a black screen saying that hal.dll boot file is missing.

Is there anything I can do? Should I just continue with chkdsk /r until it doesn't find things to fix (it does every time I run it)? I do have the majority of my files backed up, so I'd mainly be loosing what music/photo/novel files I hadn't yet backed up this month as well as all my software installations. So, it wouldn't be the end of the world, but, it'd still be a setback.

The other thing, do you think this was caused by malware/virus? My laptop has been slowly dying. The USB ports have started not working--the computer either doesn't recognize them at all, blames devices for not starting, or tells me that they're not 2.0 ports (which they are). (Which is why I haven't been able to back things up consistently.) The troubleshooting I've done on that leads me to believe the hardware is starting to go, so from that angle I suppose this could be just the hard drive finally giving up?

Yardbird told me to go through through the cleaning instructions post and then post here.

I only posted in the PC help forum because since I CANNOT BOOT, I don't see how I can do anything. I couldn't do any of the steps from the cleaning instruction post. The only things I CAN do when I turn on the laptop are to 1) go into the Bios menu or 2) go into the boot menu (prompts boot to CD, boot to hard drive, or boot to LAN). CD only takes me to the blue menu screen that takes me either into XP setup or the recovery console. If I try to get further into the boot (usually where you have the option to get into safe mode, etc) I just get the black screen error that says hal.dll boot file is missing.

Thanks in advance,

StarStrider

[Elise]

Hello, if you have your XP CD, please do the following:

Let's try to boot your computer using a Boot CD.

Please print this guide for future reference!

You will need a blank CD, your Windows XP install disc, a clean computer and a flash drive.

Please follow the steps below and let me know if you were successful. Please tell me what error messages you got and/or what steps you got hung up on.

1. Download the PE Builder to your desktop

http://www.nu2.nu/download.php?sFile=pebuilder3110a.exe

• Double-Click on the PE Builder that you just downloaded to your desktop.
  
• Follow all of the instructions/prompts that come up.
  

2. Insert your XP CD with SP1/SP2/SP3 into a CD Rom drive

• Double-Click on PE Builder.exe located on your desktop.
  
• Click NO to Search for Windows Installation Files
  
• Make the following selections from the Main Screen that pops up:
  • Builder
    • Source:(path to Windows installation files)
      • Enter the path to the drive where your XP CD is located.
        
      • You can click on the "..." button on the right to navigate to the path as well.
        

      [*]Custom: (include files and folders from this directory)

      • No information is necessary, leave blank.
        

      [*]Output:

      • Keep the default
        

  • Media output
    • Choose Create ISO image
      
    • Do not choose Burn to CD/DVD
      • Download the RunScanner plugin and save it to your desktop
        

      http://www.paraglidernc.com/Files/RunScanner10025.cab

      Please note: You will be prompted for the folder that it shall be saved. By default it appears as runscanner10025. It should be modified to just runscanner <--- Important!!!

      • Press the Plugin button on the PE Builder interface
        
      • Press the Add button and navigate to the location of the RunScanner plugin to install
        
      • Please note: If you are using a Windows XP disc with sp2 then highlight RpsSS needs to launch DComLaunch and then press Enable
        

      [*]When your done press Close and the PE Builder interface will re-appear

  3. Click on the "Build" button

  • You will see the Windows EULA message. Click on I Agree
    
  • You will now see the Build Screen. Let it run it's course
    
  • When the Build is finished you can click close, then exit
    

  4. Burn your ISO file to CD

  • Please see http://www.petri.co.il/how_to_write_iso_files_to_cd.htm on how to burn an ISO to CD.
    

  ==========

  Next........

  From your clean computer..

  Please download OTLPE.zip and save it to a flash drive.

  http://oldtimer.geekstogo.com/OTLPE.zip

  http://www.itxassociates.com/OT-Tools/OTLPE.zip

  Double click and unzip OTLPE.zip to its own folder on your flash drive. Name it OTLPE <-- Important!!

  ==========

  Plug your flash drive into your sick computer now and do as instructed below..

  ==========

  1. Restart Your sick Computer Using the PE Builder ISO CD That You Have Created

  • Insert the CD in to one of your CD/DVD drives.
    
  • Restart your computer.
    • The computer should choose to boot from the CD automatically. If it doesn't and you are asked if you want to boot from CD, then choose that option.
      

    [*]Once the desktop appears, you will receive a message asking: Do you want to start Network support?

    • Click on No
      

    [*]After it loads press the Go button in the lower left and do this....

    • Go
      
    • System
      
    • Display
      
    • Screen Resolution
      
    • 1024x768
      

    Next choose....

    • Go
      
    • Programs
      
    • A43 File Management Utility
      

  ==========

  In A43File Management you should see your flash drive

  Navigate to the OTLPE folder that you saved to your flash drive.

  Open the OTLPE folder and double click Start.bat.

  • When asked "Do you wish to load remote user profile(s) for scanning", select Yes
    
  • Ensure the box "Automatically Load All Remaining Users" is checked and press OK
    
  • OTLPE should now start
    Change the following settings
    • Change Services, Drivers, Standard and Extra Registry to Use Safelist
      
    • Uncheck LOP and Purity check
      

    Please note: Stay with your computer during the course of the scan. If "Entry Point Errors" are encountered simply press "ok" and allow the program to continue. <-- Important!!

    [*]Push

    [*]A report will open named "OTL.tx"t and another will be minimized to the system tray named "Extra.txt". Save both log's to your flash drive. Copy and Paste them in your next reply.

[StarStrider]

Thanks Elise,

I did encounter some problems.

I had to use the sp3 slipstream xp cd rather than my original xp cd because when I tried to build the iso file with PE Builder it came up with an error saying, " "D:\i386\ntdll.dll" is version 5.1.2600.0 should be 5.1.2600.1045 or higher. Must use XP Service Pack 1 or Server 2003 version of Windows!" Using the Service Pack 3 slipstream disc didn't cause any problems with PE Builder, though. (It did display a warning in the log that "Building from an OEM version of Windows can mean trouble..."--my copies of Windows are OEM, though.

Everything else proceeded normally until I tried to run the A43 File Management Utility in Bart PE. It simply wouldn't show up. I let it sit for a long while thinking maybe it was just taking a long time to load, but it wouldn't come up. When I would click on it from the Go menu, the loading hourglass cursor would display, but then nothing would happen. I did try opening the task manager from the Go menu, which listed a43.exe among the processes, but again, not under running applications or anything. I also tried the Bart PE's

"Run..." to start a43.exe that way, and it would say that "a43.exe could not be found."

[Elise]

Can you please reboot your computer using the Bart PE CD and see if it works now.

[StarStrider]

Sorry for the delayed response. My (immediate email) subscription didn't notify me of your response...

Just tried. Twice. A43 still won't show. =/

[StarStrider]

Erm. Never mind. It popped up when I went to try a third reboot. How annoying. XD I will start the last bit of your instructions now and reply when it's done with the logs. Sorry for the extra strange round-about.

[Elise]

Okay, no problem.

[StarStrider]

Just want to double check something, as it's not proceeding quite as your instructions indicated.

In my OTLPE folder I have a "Start.cmd" rather than .bat. When I double click on that it brings up a (rather slow responding) dialogue asking me to choose Windows Directory. Is this asking me for the stable copy on the Bart PE cd or the copy that needs to be scanned? So far everything I tried either comes back with an error saying it couldn't find a windows installation or that it wasn't a 2000 or later version. When I select the BartPE it tells me that's the current installation. Am I just supposed to double-click OTLPE.exe or is something awry?

[Elise]

You need to choose there you c:\windows directory, then click Open, that should do the trick.

[StarStrider]

So...Um, yikes?

There's no + next to the C drive like there should be, and when I select the C drive and click OK it tells me there's a RunScanner error that "Target is not Windows 2000 or later."

[Elise]

Go in A43 filemanagement to your C drive, right click on it and choose the option to check the volume for errors. Make sure you check the options to automatically repair errors and do a surface scan (it there, they might be named slightly different).

[StarStrider]

I have a feeling it's a lost cause...? I right-clicked on the C drive, pulled up the properties tab, and first noticed that the little pie chart diagram was solid blue (used space) but the breakdown was like this:

Used space: 0 bytes of 0 bytes

Free space: 0 bytes of 0 bytes

Capacity: 0 bytes of 0 bytes

I went to the Tools tab anyway and checked the options for checking the drive for errors, clicked Start, the little status bar would fill up in about a second, then it would disappear and not say anything like how it's supposed to.

Also, on the Hardware tab, it apparently doesn't recognize the drive or something. It tells me the model type/number, but then it says "unknown' for everything and that it's located at Location 0 (0), and no information about its driver is available or known.

[Elise]

It might be a simple case of the drive not being recognized due to missing drivers. How big is it supposed to be, do you know if it is SATA or RAID?

[StarStrider]

That would be nice. It should be 100 GB I believe. And, I have no idea if it's SATA or RAID...that's probably something I should have known though.

[Elise]

Can you please give me the computer's specs. I can then look up the details.

[StarStrider]

Gateway 8510GZ Notebook

Serial # T225701007262

http://support.gateway.com/support/srt/doc...n=T225701007262

If that helps (and if it shows up for you)

The hard drive is HTS541010G9AT00

Let me know what else you need.

[Elise]

That looks unfortunately like a HD problem. Lets see if we can troubleshoot it.

You're going to need a program called TestDisk. It's a free and open source disk recovery program.

Step 1: Download the TestDisk executable for Windows here: Download and save it to a flashdrive.

Step 2: Extract the downloaded zip file using your favorite archive extractor.

Step 3: Boot from BartPE, insert the flashdrive, open it and double-click on the testdisk_win.exe file (found in the win folder of the extracted archive)

Step 4: You will now be at a scary looking text-based command window:

Press Enter here to create a new log file.

Step 5: TestDisk will now detect all local hard drives, and present them in a list like this:

You have indicated that there is only one hard drive attached to your computer, with two partitions. So, use the arrow (up and down) keys to highlight the disk called /dev/sda.

Note: If /dev/sda isn't listed or you have more than one hard drive, STOP and post back here.

With /dev/sda selected, press Enter

Step 6: Now we need to specify the type of partitions that are on your disk. Select Intel (even if you have an AMD processor).

Press Enter.

Step 7: Select Analyse and press Enter.

Step 8: The next screen will list all found partitions. Press Enter to run a Quick Search.

When asked, say No to this screen:

Step 9: If your missing partition is found, it should show up in the list:

At this point press Q until you exit and post me the Testdisk log (will be found in the Win folder on the flashdrive).

[StarStrider]

(Took a while to get A43 to cooperate for me to open the testdisk.)

It actually lists my flashdrive as /dev/sda. But it appears the hard drive is listed as /dev/sdb:

"Disk /dev/sdb -- 100 GB / 93 GiB -- HTS541010G9AT00"

Is it all right to proceed by highlighting /dev/sdb?

[Elise]

Yes, thats quite okay.

[StarStrider]

Here's the log:

==

Mon Sep 20 13:26:44 2010

Command line: TestDisk

TestDisk 6.11.3, Data Recovery Utility, May 2009

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

OS: Windows XP

Compiler: GCC 4.3, Cygwin 1005.25 - May 6 2009 20:35:43

ext2fs lib: 1.41.4, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20080501

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=1027416576

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=100030242816

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=1027416576

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=100030242816

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=92674229760

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=1027384320

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=7345142784

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=163481600

file_pread(4,1,buffer,2006927(1990/15/63)) lseek err Invalid argument

file_pread(5,1,buffer,195382529(12161/254/63)) lseek err Invalid argument

Hard disk list

Disk /dev/sda - 1027 MB / 979 MiB - CHS 1990 16 63, sector size=512 - SanDisk U3 Cruzer Micro

Disk /dev/sdb - 100 GB / 93 GiB - CHS 12161 255 63, sector size=512 - HTS541010G9AT00

Drive X: - 163 MB / 155 MiB - CHS 38 64 32, sector size=2048 - QSI DVD+-RW SDW-082

Partition table type (auto): Intel

Disk /dev/sdb - 100 GB / 93 GiB - HTS541010G9AT00

Partition table type: Intel

file_pread(5,1,buffer,195382529(12161/254/63)) lseek err Invalid argument

Analyse Disk /dev/sdb - 100 GB / 93 GiB - CHS 12161 255 63

Geometry from i386 MBR: head=255 sector=63

FAT32 at 0/1/1

Info: size boot_sector 14345976, partition 14345982

FAT1 : 34-14016

FAT2 : 14017-27999

start_rootdir : 28000 root cluster : 2

Data : 28000-14345975

sectors : 14345976

cluster_size : 8

no_of_cluster : 1789747 (2 - 1789748)

fat_length 13983 calculated 13983

set_FAT_info: name from BS used

NTFS at 893/0/1

get_geometry_from_list_part_aux head=255 nbr=4

get_geometry_from_list_part_aux head=8 nbr=1

get_geometry_from_list_part_aux head=16 nbr=1

get_geometry_from_list_part_aux head=32 nbr=1

get_geometry_from_list_part_aux head=64 nbr=1

get_geometry_from_list_part_aux head=128 nbr=1

get_geometry_from_list_part_aux head=240 nbr=1

get_geometry_from_list_part_aux head=255 nbr=4

Current partition structure:

1 P FAT32 0 1 1 892 254 63 14345982

2 * HPFS - NTFS 893 0 1 12159 254 63 181004355

Ask the user for vista mode

Allow partial last cylinder : No

search_vista_part: 0

search_part()

Disk /dev/sdb - 100 GB / 93 GiB - CHS 12161 255 63

FAT32 at 0/1/1

FAT1 : 34-14016

FAT2 : 14017-27999

start_rootdir : 28000 root cluster : 2

Data : 28000-14345975

sectors : 14345976

cluster_size : 8

no_of_cluster : 1789747 (2 - 1789748)

fat_length 13983 calculated 13983

set_FAT_info: name from BS used

FAT32 at 0/1/1

FAT32 0 1 1 892 254 57 14345976

FAT32, 7345 MB / 7004 MiB

NTFS at 893/0/1

filesystem size 181004355

sectors_per_cluster 8

mft_lcn 786432

mftmirr_lcn 5901879

clusters_per_mft_record -10

clusters_per_index_record 1

HPFS - NTFS 893 0 1 12159 254 63 181004355

NTFS, 92 GB / 86 GiB

get_geometry_from_list_part_aux head=255 nbr=4

get_geometry_from_list_part_aux head=8 nbr=1

get_geometry_from_list_part_aux head=16 nbr=1

get_geometry_from_list_part_aux head=32 nbr=1

get_geometry_from_list_part_aux head=64 nbr=1

get_geometry_from_list_part_aux head=128 nbr=1

get_geometry_from_list_part_aux head=240 nbr=1

get_geometry_from_list_part_aux head=255 nbr=4

Results

* FAT32 0 1 1 892 254 63 14345982

FAT32, 7345 MB / 7004 MiB

P HPFS - NTFS 893 0 1 12159 254 63 181004355

NTFS, 92 GB / 86 GiB

interface_write()

1 * FAT32 0 1 1 892 254 63 14345982

2 P HPFS - NTFS 893 0 1 12159 254 63 181004355

simulate write!

write_mbr_i386: starting...

write_all_log_i386: starting...

No extended partition

TestDisk exited normally.

[Elise]

Hi, TestDisk doesn't indicate problems.

Two possible causes: either something went wrong while burning the BartPE CD or there is another hardware problem.

You said this:

When I restarted, it came to the unmountable boot volume blue screen. I'd encountered that several years ago,

Was that on the same computer and if so, what did you do to fix it.

There are a few things you can do:

• Test your RAM with Memtest.
  
• Try to reburn the BartPE CD on a lower speed.
  
• Do a repair installation of XP (this should leave personal data intact).
  

[StarStrider]

When it happened several years ago it was with the same laptop, but it was a pretty simple fix of going into the recovery console, running chkdsk /r then fixboot. Which is why those were the first things I tried when it happened again recently, but not only did they not do anything, but after doing those it seemed to get worse as it wouldn't get as far into the boot before saying hal.dll boot file was missing. (I also tried bootcfg /scan and /rebuild but nothing would work at all because the initial scan would fail.)

I did try a repair installation, but it wouldn't offer an installation of windows to repair, and when I did force it to show me the list of drives, highlighting the C drive only prompted it to tell me that the file system was unknown or too corrupted and needed to be reformatted. I didn't want to do that since I wasn't sure it was a lost cause at that point, plus I wasn't sure reformatting would actually fix the problem. It also baffled me that in the recovery console I generally get two options to choose from: 1. C:/windows and 2: D:/MiniNT, and all I've been able to get after that first time is 1: D:/MiniNT

I'll try things again, just to be thorough, though, plus the new disc and MemTest.

[Elise]

That doesn't sound too good. I would say this sounds like harddisk failure.

If all those options mentioned don't change anything, we can try Tesktdisk to attempt a fix, but that is only as a last resort.

[StarStrider]

No difference with the re-burned Bart PE disc.

Same issues with trying to repair the XP installation--drive is either too full, damaged, not formatted, or incompatible, and must be reformatted to continue.

I understand that MemTest needs to run for a long time for best results? If so, I'll wait until later this afternoon and start it to leave running overnight, I think. I remember running it on the desktop I've been using because I was having issues with it--ironically enough, I was told this desktop's drive would fail, and that was like a year ago or something. Just my luck that the laptop would go first. XD

And...I probably should have asked first, but I went ahead and booted it with Knoppix (http://www.knoppix.net/) just to see if it would be able to read any data from the disk, and it actually did (I backed up some of my newly purchased music). The main "C" partition was listed right off the bat, listed as being 97.3 GB I think it was, and quite a bit of the data was still readable. Granted the things that I'd wanted to backup were ghost folders (they were listed in the explorer, and were listed to contain the right amount of files, but when opened they didn't contain anything), but the Windows folder was seemingly intact. I didn't do anything but look through it, of course. I just thought it was really odd that XP Bootable CD and the Bart PE CD could barely register the C drive as existing and Knoppix is able to browse it? Anyway.

[Elise]

If you can access it from knoppix, try and see if knoppix has a check disk sort of utility (try right clicking the drive and see if it has an option for that).

I recommend you to try and recover any important files (if possible) using knoppix. This really sounds like a bad drive and its just a question of luck (or lack thereof) which tool sees the drive best. Knoppix is a good choice.