XP boots OK, but safe mode BSOD 0x0A error! ??? 2

[torandson]

Hi,

XP Pro boots normally just fine. But Safe Mode = BSOD. ???

This is after "ntfs.sys" problems that crashed XP which I have been troubleshooting and trying to repair.

Anyone have any clues?

Synopsis:

After a motherboard powerdown during XP installation formatting which left the NTFS partitioned drive(s) in a state from which simple reformatting was ineffective, I zeroed the system drive with Seatools, repartitioned, reformatted FAT32 and reinstalled XP (unattended install with nVidia nForce3 SATA RAID drivers slipstreamed) onto IDE 0 E:\ = FAT32, etc. After that I succesfully installed a ton of pro audio applications on G:\Program Files (FAT32). When I went to group copy eight 1.9 GB audio sample files from the RAID 0 array (NTFS, not previously corrupted, no history of errors) to IDE 1 L:\ (NTFS) (corrupted during previous XP install and reformatted, but not completely zeroed first as the system drive was) I got a BSOD with a 0x50 ntfs.sys error again.

Disconnecting IDE 1 allowed me to boot into XP, but safe mode still BSOD'd. Paragon Drive Backup's linux-on-a-CD allowed me to rename the ntfs.sys file, and then XP booted with the corrupt drive attached so I could use the DVD burner to get the OS images off of its FAT32 partition.

Reformatted the IDE 1 NTFS partitions. Restored ntfs.sys.

But again, reformatting was ineffective, kept getting "XP wants to check one or more of your drives" messages on bootup and got another "ntfs.sys" BSOD error when I tried to copy a 5MB folder onto one of the newly reformatted IDE 1 NTFS partitions.

Wouldn't boot XP normal or safe again.
(I assume that the safe mode BSOD is related to the ntfs.sys problem, but...?)

So I zeroed IDE 1 (Seagate 200GB takes all night and half a day) and repartitioned/reformatted (using the procedure that had successfully restored the system drive on the previous goaround).

So now, I can boot into XP pro just fine and see all the drives/partitons in Windows Explorer, though I'm hesitant to do too much till I find the source of the problem. I no longer get the "Windows wants to check some of your drives" message on bootup. But the strange thing is, I cannot boot into Safe Mode. Safe Mode still gives me a 0x0A BSOD.

Anyone have any ideas? Is there some registry entry or log entry that safe mode is preoccupied with while the full OS can see around it? Or is there still some (possibly other) root problem cause lurking in there somewhere that the normal mode OS can't see? Somehow, this combination doesn't make sense to me.

When in the XP desktop environment I've saved all the data to DVD using the Nero software that came with the drive. Works OK. I can poke around here and there with no problems, run regedit, use the control panel, etc. but I'm not going to attempt that fateful file copy again till I try some other things. How can this be? Windows is happy to boot normally, but it absolutely will not boot into safe mode!

Anyone have any insights and/or suggestions?

I have a documented history of the problem and detailed system specs, minidump, etc. but I'll hold on that unless it's requested. Possibly relevant, though, is: 1GB RAM (memtest86 says it's OK), "Pagefile" = 50 MB on E:\ (5.5GB) plus 1.5 GB on D:\ (2GB) partition; and "Documents and Settings" on F:\ (6GB).

--torandson

 

[bcastner]

Help me out a bit.
A 0x50 error is not an NTFS.SYS error:

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prmd_stp_ccgm.asp

It can be thrown by an improper SCSI termination.

The 0x0A error indicates a BIOS issue, hardware configuration issue, or a faulty driver:

http://support.microsoft.com/?kbid=314063&sd=RMVP

The "traditional" stop code for NTFS.SYS is 0x24:

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prmd_stp_swhw.asp

 

[aquias]

In reference to the 0x0A error...

http://support.microsoft.com/?kbid=314063

In reference to the 0x50

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prmd_stp_ccgm.asp

and another page

http://support.microsoft.com/kb/q183169/

 

[aquias]

Really Bill, I was researching when you posted those links!!!

 

[torandson]

Hi bcastner & aquias,

Yes, you're right, the 0x24 error is specifically an ntfs.sys error. I've seen all 3 of these at one point or another in the history of this problem, actually.

BTW, I've been all over the MS KB site and have already read some of the links you provide. Still on the steep part of the learning curve WRT tracking down the source of the errors, though. How can I identify the drivers pointed to by these error signatures? I've read an MS KB article on debugging these codes but it was a bit dense for me. I'm also a programmer, but not a Windows programmer. I can follow indexed and indirect addressing if I know what I'm doing, what to look for and where. Unfortunately, in this case, I don't, I don't and I don't.

Anyway...

With NTFS drives disconnected safe mode 0x0A signature was:

"IRQL_NOT_LESS_OR_EQUAL

STOP: 0x0000000A (0xF7D4E354, 0X000000FF, 0x0x00000001, 80512922)"

But I don't know how to track down the driver in question.

Following the reformatting of NTFS partition(s) in question, I tried to copy a folder to L:\ and got a BSOD with the following signature:

"The problem seems to be caused by the following file: ntfs.sys

PAGE_FAULT_IN_NONPAGED_AREA

STOP: 0x00000050 (0xB0980000, 0x00000001, 0xB0D20A20, 0x00000000)

Ntfs.sys -- Address B0D20A20 base at B0D1E000, Datestamp 3d6de5c1

Beginning dump of physical memory"

Now, with IDE 1 zeroed, repartitioned and reformatted, I'm booting OK into XP normally, but still get the following error when I try to boot into safe mode:

"IRQL_NOT_LESS_OR_EQUAL

STOP: 0x0000000A (0xF7D4E354, 0X000000FF, 0x0x00000001, 80512922)"

When I built the system I disabled the onboard VIA firewire and installed a TI firewire PCI card in slot 2 (slot 1 is empty because it is very close to the AGP heatsink) and a DSP card in PCI slot 3. The firewire appears to work just fine as the outboard sound gear is functioning OK. The DSP card also seems to be working, (and its diagnostic window says so) but I will remove these selectively and see what happens after I finish backing up the current configuration. Another possible cause: because I was unsure if a (poorly documented) audio sofware installation had gone correctly, I repeated it. Perhaps it is not safe to assume that the repeated installation was benign. I can roll back to a previous system state if need be, but I want to track down the problem as best I can before doing that so that I don't get hit with a "gotcha!" somewhere down the road in the middle of a production if I can help it.

The BSOD's have shown up on three occasions in which a file was being copied from one drive to another, corrupted or previously corrupted, drive, which seems to be the common denominator here and with what I have read in the MS KB documents about corrupted drives being possible cause for these errors.

Might there be a kernal nonpaged file interaction with a memory leak (something I've read) in here somewhere?

But the central question still remains, "What is indicated by the fact that XP boots in normal mode just fine when it will produce the above BSOD in safe mode?"

A related question is, how can I debug this in Windows normal mode, since I'm able to boot into it?

Many thanks for your swift responses, guys. I'll follow those links to see if there's something I missed, try some more troubleshooting, and return.

--torandson

 

[aquias]

I'm, actually, starting to lean towards some kind of drive problem. The only thing that has me a bit baffled on this one is the BSoD on safe mode...

What kind of hard drives are you using?

This is a moderately lengthy discussion on BSoD on SATA and Windows XP with various drives.

http://www.techspot.com/vb/topic5460.html

The safe mode issue may be caused by this as well, but that'll take some more time to research.

 

[aquias]

Another BSoD link

http://aumha.org/win5/kbestop.php

http://support.microsoft.com/?kbid=271955&sd=RMVP

 

[torandson]

bcastner,
I read all three of those links before, but went there again anyway to see if there was anything that I missed when I read them before. The following paragraph from the third link was a flashing sign this time:

"If you are not using the NTFS file system, and the system partition is formatted with the file allocation table (FAT16 or FAT32) file system, long file name (LFN) information can be lost if hard disk tools are started from an MS-DOS command prompt. A command prompt appears when using a startup floppy disk or when using the command prompt startup option on multiple boot systems that use FAT16 or FAT32 partitions with Microsoft® Windows® 95 OEM Service Release 2 (OSR2), Microsoft® Windows® 98, or Microsoft® Windows® Millennium Edition (Me) installed. Do not use tools meant for other operating systems on Windows XP Professional partitions."

I don't know if this is related or not, but it could be. I tried to use the DOSNavigator from Paragon without success, and then renamed ntfs.sys to ntfs.old and back to ntfs.sys using the stand-alone CD-based memory-resident linux app on the Paragon Drive Backup CD. This wouldn't explain where the problem came from, though.

With what tools can I safely edit a FAT32 XP pro system partition, then, when I can't boot?

Does this exclude the use of Norton Ghost2003 and Paragon Drive Backup, then? For confident production on this system I need to be able to back up the system partition when XP is not running.

--torandson

 

[bcastner]

http://www.windowsubcd.com/index.htm

 

[bcastner]

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q244617

http://support.microsoft.com/defaul...port/kb/articles/q308/5/14.asp&NoWebContent=1

 

[torandson]

aquias,
IDE 0 = Seagate Barracuda 120 GB. C:\ = FAT16 (DOS), other partitions = FAT32, IDE 1 = Seagate Barracuda 200 GB containing FAT32 & NTFS (64K clusters) partitions plus some unused linux partitions. SATA RAID 0 array made from 2x 160 GB Seagate SATA containing several NTFS partitions and one FAT 32 partition.

It was while copying a folder containing eight 1.9 GB audio sample database files from the RAID array to IDE 1 that this first BSOD occurred (first, that is, after reinstalling XP several times till I got the slipstreamed nVidia RAID drivers installing unattended without a hitch=otherBSODs, which was after RMAing a motherboard that kept shutting down during a second standard installation of XP after the first standard installation gave me an ntfs.sys BSOD after tweaking for audio with no add-ons or software installed) (yes, this project has been an ongoing nightmare so far... I feel so near to getting it working, now... and yet still so far away.)

--torandson

 

[torandson]

Hi Guys,
Thanks, bcastner, for the drivers debugging link. I'll check it out. It'll take a while, though. I'll post back later when I know something new.
Also, aquias, that link to the techspot article may be on the mark, there certainly are many similarities there. One thing, though, my SATA RAID array seems to be ok, it was IDE 1 that crashed the boot screen when ntfs.sys was enabled before I cleaned IDE 1. Another point, though, Seatools file system test failed all of my NTFS partitions, both the IDE ones and the SATA ones, and passed all of my FAT partitions. I'm suspicious of that, though, despite all that was said on that site, since a) the drives are all new, and that many mechanical failures in one place is unlikely, and b) the SATA RAID array seems ok. I put 15 GB of data on it without a problem. Perhaps it is simply that all of my NTFS partitions are 64K clusters that Seatools does not like, since XP doesn't create them, Partition Magic does. Also, before cleaning IDE 1, the system booted fine with the SATA RAID array connected if IDE 1 was disconnected, but would not boot in any case if IDE 1 was connected. I don't know what to think. One thing points this way, another that way.
Will get some sleep, try some experiments and post back.
-- torandson

 

[torandson]

Hi,
UPDATE: bcastner, aquias, I finished making a complete
backup of the system drive to DVD and did some experiments.

1. Removed DSP card from PCI slot 3. Safe Mode 0x0A BSOD.
2. Removed firewire card from PCI slot 2. SM_0x0A_BSOD.
3. Uninstalled USB MIDI driver. SM_0x0A_BSOD.
4. Disconnected all hard drives except IDE 0 (no NTFS partitions on the system at this point). SM_0x0A_BSOD.
5. Disabled (nonpresent) DSP card
from its proprietary control panel. SM_0x0A_BSOD.

*******************
CONCLUSION: this is probably NOT a hardware problem. (mobo?)
*******************

The sampler software that came with the 15GB of sample files which caused the initial BSOD when I tried to copy them from one drive to another has no uninstall.

QUESTION: the BSOD screen says "disable or remove" any newly installed hardware or software... How can I disable a software application when I can't uninstall it from the start menu? (i.e. it has no uninstaller). Will the Add/Remove programs feature in the Control Panel work for this purpose? (If I roll the system back to a backup, several packages will remain under suspicion. I want to selectively remove or disable things.) Is there a way to simply disable a software application and its associated drivers without removing it?

STRONG HUNCH: I still think that this is the Safe Mode seeing a log entry or other record of a subsequently corrected problem and not being up to date WRT it having been repaired -- just as I thought when I started this thread (which is why I'm looking for answers to this particular problem in this forum, rather than simply taking on face value that the MS KB articles I've read thus far have the answer.)

Any further suggestions would be greatly appreciated. Especially if anyone can interpret the meaning of this particular BSOD message and the file/driver/code that it refers to.

--torandson

 

[bcastner]

I think the intention of the "software" reference was something that involved a device driver. CD or DVD burning software, for example.

 

[torandson]

Hi bcastner,
Would this include an audio sample player that interfaced with the system sound card? Or would that simply interface with soundcard drivers? What I mean is, for example, nearly every program interfaces with the video display in some way or other, but installing/uninstalling a document reader program shouldn't have any effect on the video drivers, right?
Must it be the case that this stop error unequivocally implicates a hardware driver? And if so, why then does normal mode not detect the problem?
-- torandson

 

[bcastner]

The Safe vs. Normal mode is a puzzle.
I can only assume that something in the startup programs assumes wrongly that a critical service is running.

 

[torandson]

bcastner,
You think that something in the normal mode or something in safe mode assumes wrongly? Thanks. Yes, it is a real puzzle.
--torandson

 

[torandson]

bcastner,
Oh. Right. You answered my question. You think that normal mode is confused. Now, if I could just interpret what the BSOD means...
--torandson

 

[aquias]

What I would suggest to be the next step is to begin to disable peripheral devices from loading their drivers and see what/if any stop the BSoD from happening.

And what BCastner is looking to, is for you to run msconfig and take a look at all programs/services starting up. Disable everything that isn't a required service, boot up and see what service causes the BSoD to return (provided it goes away after disabling all services).

Did you try loading up into VGA mode? Just a thought that occured to me, see if you still BSoD when going into that mode.

 

[torandson]

aquias,
Thank you. This is just the kind of troubleshooting help I need. I understand generally what you are suggesting, but can you be more specific? i.e. step-by-step How_to? I realize that's asking a lot. Perhaps you have a link to a site that explains these things in terms even a Linux programmer can understand. FWIW I know how to search the registry for a string, modify/rename/delete a key. I don't know what in particular to look for.
Many thanks.
--torandson