P pvivekm Member Joined Oct 8, 2020 Posts 24 Oct 13, 2020 #1 My laptop has crashed and won't boot without bootable USB. Tried all the options - DISM, SFC, BCDBoot, BCDEdit, BootRec but didn't work. I tried the BSOD Data collection tool from command prompt after booting from a bootable USB created using MCT. But it won't run in PE environment. In this situation, how do I go ahead with collection of data for submission in this scenario?
My laptop has crashed and won't boot without bootable USB. Tried all the options - DISM, SFC, BCDBoot, BCDEdit, BootRec but didn't work. I tried the BSOD Data collection tool from command prompt after booting from a bootable USB created using MCT. But it won't run in PE environment. In this situation, how do I go ahead with collection of data for submission in this scenario?
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,188 Location %systemroot% Oct 13, 2020 #2 Check the following directory path for any dump files and then attach them as a zipped folder: Code: %systemroot%\Minidump
Check the following directory path for any dump files and then attach them as a zipped folder: Code: %systemroot%\Minidump
P pvivekm Member Joined Oct 8, 2020 Posts 24 Oct 13, 2020 #3 Thanks @x BlueRobot for your response. There was no file in %systemroot%\Minidump but found dump in the root folder of Windows installation drive. Attaching the same along with some other files I thought relevant. Attachments BSOD-Data.zip 47.6 KB · Views: 3
Thanks @x BlueRobot for your response. There was no file in %systemroot%\Minidump but found dump in the root folder of Windows installation drive. Attaching the same along with some other files I thought relevant.
xrobwx71 Administrator Staff member Joined Sep 27, 2019 Posts 2,629 Location Panama City Beach, FL Oct 13, 2020 #4 So far: Can't boot from a cloned disk.
P pvivekm Member Joined Oct 8, 2020 Posts 24 Oct 13, 2020 #5 xrobwx71 said: So far: Can't boot from a cloned disk. Click to expand... Looks like the only thing remaining to try is BSOD dump analysis.
xrobwx71 said: So far: Can't boot from a cloned disk. Click to expand... Looks like the only thing remaining to try is BSOD dump analysis.
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,188 Location %systemroot% Oct 13, 2020 #6 pvivekm said: Looks like the only thing remaining to try is BSOD dump analysis. Click to expand... How? You haven't had any BSODs. I would suggest simply clean installing Windows again as the others have suggested in your original thread.
pvivekm said: Looks like the only thing remaining to try is BSOD dump analysis. Click to expand... How? You haven't had any BSODs. I would suggest simply clean installing Windows again as the others have suggested in your original thread.
P pvivekm Member Joined Oct 8, 2020 Posts 24 Oct 13, 2020 #7 x BlueRobot said: How? You haven't had any BSODs. I would suggest simply clean installing Windows again as the others have suggested in your original thread. Click to expand... I need to keep my user accounts, their user data/profiles etc. Besides, I do get the BSOD during boot time itself with the stop code 0xC0000135. That's why I created this thread in the BSOD section. My previous post has the dump.... pvivekm said: Thanks @x BlueRobot for your response. There was no file in %systemroot%\Minidump but found dump in the root folder of Windows installation drive. Attaching the same along with some other files I thought relevant. Click to expand...
x BlueRobot said: How? You haven't had any BSODs. I would suggest simply clean installing Windows again as the others have suggested in your original thread. Click to expand... I need to keep my user accounts, their user data/profiles etc. Besides, I do get the BSOD during boot time itself with the stop code 0xC0000135. That's why I created this thread in the BSOD section. My previous post has the dump.... pvivekm said: Thanks @x BlueRobot for your response. There was no file in %systemroot%\Minidump but found dump in the root folder of Windows installation drive. Attaching the same along with some other files I thought relevant. Click to expand...
x BlueRobot Administrator Staff member Joined May 7, 2013 Posts 10,188 Location %systemroot% Oct 13, 2020 #8 pvivekm said: Besides, I do get the BSOD during boot time itself with the stop code 0xC0000135 Click to expand... That's not a stop code, that's a NTSTATUS code. pvivekm said: My previous post has the dump.... Click to expand... There's no dump files in that folder, just a .dat file and .tmp file named "DUMP4074".
pvivekm said: Besides, I do get the BSOD during boot time itself with the stop code 0xC0000135 Click to expand... That's not a stop code, that's a NTSTATUS code. pvivekm said: My previous post has the dump.... Click to expand... There's no dump files in that folder, just a .dat file and .tmp file named "DUMP4074".
P pvivekm Member Joined Oct 8, 2020 Posts 24 Oct 13, 2020 #9 pvivekm said: Thanks @x BlueRobot for your response. There was no file in %systemroot%\Minidump but found dump in the root folder of Windows installation drive. Attaching the same along with some other files I thought relevant. Click to expand... x BlueRobot said: That's not a stop code, that's a NTSTATUS code. There's no dump files in that folder, just a .dat file and .tmp file named "DUMP4074". Click to expand... Ohh.... I got confused due to its name... here is what I get during boot... looks very similar to BSOD How to proceed with analysis of the same?
pvivekm said: Thanks @x BlueRobot for your response. There was no file in %systemroot%\Minidump but found dump in the root folder of Windows installation drive. Attaching the same along with some other files I thought relevant. Click to expand... x BlueRobot said: That's not a stop code, that's a NTSTATUS code. There's no dump files in that folder, just a .dat file and .tmp file named "DUMP4074". Click to expand... Ohh.... I got confused due to its name... here is what I get during boot... looks very similar to BSOD How to proceed with analysis of the same?
Z zbook Member Joined Oct 2, 2015 Posts 919 Oct 13, 2020 #10 Would a reset save files equivalent be a viable fix? This would require the reinstallation of drivers and applications.
Would a reset save files equivalent be a viable fix? This would require the reinstallation of drivers and applications.
P pvivekm Member Joined Oct 8, 2020 Posts 24 Oct 13, 2020 #11 zbook said: Would a reset save files equivalent be a viable fix? This would require the reinstallation of drivers and applications. Click to expand... As I said, I need the user accounts also ... hence need to repair the existing installation itself.
zbook said: Would a reset save files equivalent be a viable fix? This would require the reinstallation of drivers and applications. Click to expand... As I said, I need the user accounts also ... hence need to repair the existing installation itself.
Z zbook Member Joined Oct 2, 2015 Posts 919 Oct 13, 2020 #12 If users folders are saved what prevents a reestablished user account?
P pvivekm Member Joined Oct 8, 2020 Posts 24 Oct 13, 2020 #13 Things like the registry entries, system settings, (user principals?), credentials ... and much more, I believe
Things like the registry entries, system settings, (user principals?), credentials ... and much more, I believe
xilolee Moderator Staff member Joined Dec 31, 2013 Posts 3,670 Location World, Europe, Italy Oct 13, 2020 #14 Can you find (then post here) c:\windows\system32\logfiles\srt\srttrail.txt ?
Z zbook Member Joined Oct 2, 2015 Posts 919 Oct 13, 2020 #15 pvivekm said: Things like the registry entries, system settings, (user principals?), credentials ... and much more, I believe Click to expand... Users accounts can become corrupt and can be replaced.
pvivekm said: Things like the registry entries, system settings, (user principals?), credentials ... and much more, I believe Click to expand... Users accounts can become corrupt and can be replaced.
axe0 Administrator, BSOD Academy Instructor, Security Analyst Staff member Joined May 21, 2015 Posts 3,307 Location Holland Oct 13, 2020 #16 pvivekm said: Thanks @x BlueRobot for your response. There was no file in %systemroot%\Minidump but found dump in the root folder of Windows installation drive. Attaching the same along with some other files I thought relevant. Click to expand... Unfortunately, neither are useful. Bootstat.dat is a log file Windows uses to keep track of whether the last boot was successful. The TMP file is a temporary file, a space filler for a to become dump file, indicating the process of creating a dump file could not finish. It really needs to be a file with a .dmp extension for it to be useful.
pvivekm said: Thanks @x BlueRobot for your response. There was no file in %systemroot%\Minidump but found dump in the root folder of Windows installation drive. Attaching the same along with some other files I thought relevant. Click to expand... Unfortunately, neither are useful. Bootstat.dat is a log file Windows uses to keep track of whether the last boot was successful. The TMP file is a temporary file, a space filler for a to become dump file, indicating the process of creating a dump file could not finish. It really needs to be a file with a .dmp extension for it to be useful.
P pvivekm Member Joined Oct 8, 2020 Posts 24 Oct 13, 2020 #17 xilolee said: Can you find (then post here) c:\windows\system32\logfiles\srt\srttrail.txt ? Click to expand... Here it is: Attachments SrtTrail.txt 12.5 KB · Views: 5
xilolee said: Can you find (then post here) c:\windows\system32\logfiles\srt\srttrail.txt ? Click to expand... Here it is:
xilolee Moderator Staff member Joined Dec 31, 2013 Posts 3,670 Location World, Europe, Italy Oct 14, 2020 #18 Load the hive system. Then launch the following command from an elevated command prompt, zip the file you'll find on your desktop and upload it here. Code: reg query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services /s /t reg_dword /v start > "%userprofile%\desktop\services-start-values.txt" NB: You have to change "system" with the name you gave to your loaded system hive.
Load the hive system. Then launch the following command from an elevated command prompt, zip the file you'll find on your desktop and upload it here. Code: reg query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services /s /t reg_dword /v start > "%userprofile%\desktop\services-start-values.txt" NB: You have to change "system" with the name you gave to your loaded system hive.
P pvivekm Member Joined Oct 8, 2020 Posts 24 Oct 14, 2020 #19 xilolee said: Load the hive system. Then launch the following command from an elevated command prompt, zip the file you'll find on your desktop and upload it here. Code: reg query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services /s /t reg_dword /v start > "%userprofile%\desktop\services-start-values.txt" NB: You have to change "system" with the name you gave to your loaded system hive. Click to expand... Here is the file: Attachments services-start-values.zip 5.6 KB · Views: 2
xilolee said: Load the hive system. Then launch the following command from an elevated command prompt, zip the file you'll find on your desktop and upload it here. Code: reg query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services /s /t reg_dword /v start > "%userprofile%\desktop\services-start-values.txt" NB: You have to change "system" with the name you gave to your loaded system hive. Click to expand... Here is the file:
xilolee Moderator Staff member Joined Dec 31, 2013 Posts 3,670 Location World, Europe, Italy Oct 14, 2020 #20 The dism log in your other thread shows kernel32.dll, atl.dll and other dlls as corrupted. But the copies of those files are not present in the indicated folders. Read More: Code: 2020-10-08 14:47:28, Info CBS (p) CSI Payload Corrupt (n) 2020-10-08 14:47:28, Info CBS Repair failed: Missing replacement payload. Code: amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.423_none_ef43a2884ee1438c\NewWindowIcon.scale-150_contrast-black.png amd64_microsoft-windows-d2d_31bf3856ad364e35_10.0.19041.329_none_85aecaaebaad5d7e\d2d1.dll amd64_microsoft-windows-nfcmediaprovider_31bf3856ad364e35_10.0.19041.329_none_74c6eac1407919e6\NfcRadioMedia.dll amd64_microsoft-windows-atlthunk_31bf3856ad364e35_10.0.19041.329_none_6bf870392fda3529\atlthunk.dll amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.19041.292_none_717d15cbb5470209\kernel32.dll amd64_microsoft-windows-atl_31bf3856ad364e35_10.0.19041.329_none_893223b0b86ed133\atl.dll amd64_microsoft-windows-d..ctoryclient-onecore_31bf3856ad364e35_10.0.19041.329_none_e21f36410cd796ce\DeviceDirectoryClient.dll I think the guys in the windows update forum could help you to replace those files; therefore, my advice is to open a new thread there.
The dism log in your other thread shows kernel32.dll, atl.dll and other dlls as corrupted. But the copies of those files are not present in the indicated folders. Read More: Code: 2020-10-08 14:47:28, Info CBS (p) CSI Payload Corrupt (n) 2020-10-08 14:47:28, Info CBS Repair failed: Missing replacement payload. Code: amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.423_none_ef43a2884ee1438c\NewWindowIcon.scale-150_contrast-black.png amd64_microsoft-windows-d2d_31bf3856ad364e35_10.0.19041.329_none_85aecaaebaad5d7e\d2d1.dll amd64_microsoft-windows-nfcmediaprovider_31bf3856ad364e35_10.0.19041.329_none_74c6eac1407919e6\NfcRadioMedia.dll amd64_microsoft-windows-atlthunk_31bf3856ad364e35_10.0.19041.329_none_6bf870392fda3529\atlthunk.dll amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.19041.292_none_717d15cbb5470209\kernel32.dll amd64_microsoft-windows-atl_31bf3856ad364e35_10.0.19041.329_none_893223b0b86ed133\atl.dll amd64_microsoft-windows-d..ctoryclient-onecore_31bf3856ad364e35_10.0.19041.329_none_e21f36410cd796ce\DeviceDirectoryClient.dll I think the guys in the windows update forum could help you to replace those files; therefore, my advice is to open a new thread there.