Had similer think on a vista laptop the other day the only conclusion i came up with was it was infected but anti virus ripped it out before i saw machine so everything came back clean.
Combofix i dont like running on vista machines due to having a few problems with it before
none the less they have meant to of sorted it.]
Ended up re install
I think i have seen something similar before with regard to it not saving changes on a normal desktop, iirc that was down to a corrupt registry, registry looked ok when viewing through regedit but eventually surrendered some useful information through event viewer that pointed to the machine basically not being able to load the registry so what you were viewing through regedit was its best attempt to create a temporary registry on startup
Boot from a liveCD and run a virus scan, just in case there's a nice stealth type nasty hiding in the background - especially when drivers with no names fail to load, and things like chkdsk give really strange results...
Can you actually write to the drive? The controller hasn't marked it as read only or something stupid like that has it?
must be able too write to drive otherwise scan programs would not install
How about this If you disable the restart on error
find FBISM.EXE and turn it off then you may be able to get a reason why.
also worth trying
start in safe mode with networking as one of the office laptops had a corrupt file for the wireless software.
If so back it up and reinstall the software for a quiet life
FROM liam
Done the 'do not restart after failure' option and the problem is, there is no filename listed as being the cause of the problem. Safe Mode with Networking works fine. See my first post about what happens when you try and disable a device or remove it's software thoughOriginally Posted by work2drift
How about this If you disable the restart on error
find FBISM.EXE and turn it off then you may be able to get a reason why.
also worth trying
start in safe mode with networking as one of the office laptops had a corrupt file for the wireless software.
If so back it up and reinstall the software for a quiet life
FROM liam. Cheers though
.
yep, can write to the drive perfectly. Malwarebytes installed and even updated (Safe Mode with Networking worked that far).
Chkdsk would only find a small fault after it crashing when trying to boot into Normal mode. After clearing that minor problem, chkdsk would come back clean and would continue to be clean until the next attempt at booting normally.
I'll try the virus scan from a boot CD, but even having booted on my Windows 7 disc, I couldn't see any unusual files in the usual locations. However, I will give it a go quickly before wiping as it's about the only thing left.
@Draven - the registry looks about as complete as any registry I've looked through. All the various elements are there for the software that's installed. Obviously I can't look through the whole thing, but at a cursory glance it looks OK.
What annoys me is that I'm not going to learn anything from this job. It will remain, as far as I'm concerned, uncompleted. Yes, I'll get the customer up and running but I won't know why it went wrong, what exactly went wrong and how to fix it. It's why I normally love this job - every day is a learning experience and no day is the same as the last. All I've learnt on this job is how to piss 7 hours up the wall
Last edited by Cluck; 11-01-2011 at 18:16.
Maybe check the boot configuration data file with something like easyBCD and see if there is any fvckwittery going on in there.
Its the replacement for boot.ini and could be the jizz stain causing issue or at least pointing to it.
Nothing some good old hammer time won't sort out.
I would have said it was booting to last known good, hence it keeps reverting.
Only way to test that would be to delete (move) the contents of windows\lastgood and see.
It would essentially make it not boot.
ooh, I hadn't thought of that. That's possibly a very good call
I'll let you guys know. I will be speaking to the customer tomorrow to arrange the re-visit.
Thanks again for confirming that I didn't miss something blazingly obvious
Quick bump to say it was definitely driver related. I've run a Sony factory restore and it's currently restoring all the user data (Vista is up and running OK).
I had another bash at it this morning, before wiping it, but it was still blue-screening. The error was always a STOP 0x0000008E with a consistent memory address and no filename specified. I tried removing all non-Microsoft driver files from the drivers folder to no avail. Windows would still boot in safe mode but crash shortly after the user login screen (regardless of whether you clicked on the usernames or left it for ~10 seconds) when trying to boot in any other mode.
Jonboy - Full virus scan, from a boot CD, came back clean.
pyro - It looks like Vista has abandoned the 'lastgood' folder. There are backup registry files in the system32\config folder which I guess is what it uses. I tried those, but with exactly the same result. Also tried removing them, with no joy.
I think it's fair to say I exhausted every feasible avenue before wiping it, but I still feel dirty for 'giving in'
Last edited by Cluck; 18-01-2011 at 16:46.
I give the guys a few hours at the most to solve a problem now before asking them to blitz the machine, i just cannot afford the staff time.
Of course if its a repeat issue and comes up often then i would rather it was dealt with and a proper resolution found but for a lot of things ... its nuke it from orbit.
That's understandable in most environments. Being self-employed, I am under no such constraints and I would rather see a problem fixed irrespective of the time taken. I see it as a personal afront that a computer can beat me
Tron.I see it as a personal afront that a computer can beat me
Last edited by Silane; 18-01-2011 at 17:04.
I really dont like problems beating me either, i have one issue at the moment with oracle odbc links to an off campus data base and it just will not fooking work right giving me all sorts of **** errors.
I am at the stage where i am happy for someone else to remote in and fix it and i will look a twat.
Can you configure the machine to do a memory dump when it blue screens?
Then try and get the memory dump off the machine and do a crash analysis on it.
You should be able to rebuild the stack and see the offending thread.
Get hold of a copy of crashfinder and get it to analyze the dump file. It will even tell you the offending bit of code in the dll or exe etc
Nope, it wouldn't write a dump file. It seems that because it couldn't create a swapfile (it would only create a temp swapfile when booting into safe mode) it wouldn't allow dump files to be created. No matter what settings I tried for setting a swapfile, Windows ignored it in the same way it ignored any other changes I tried to make (howsoever those changes were attempted).
The system is wiped now anyway and back up and happily running. Just got a few more things to load (printer drivers etc) and it's then going back to the customer. The customer will be happy it's up and running. I'll still be miserable knowing that I'll never know what caused the problem in the first place
Sometimes you just dont get the answers you want, sometimes the problem is just unsolvable.
And
Most of the time the problem exists between keyboard and chair - Pebkac
Yeah, bitch when that happens...Nope, it wouldn't write a dump file
The system is wiped now anyway and back up and happily running. Just got a few more things to load (printer drivers etc) and it's then going back to the customer. The customer will be happy it's up and running. I'll still be miserable knowing that I'll never know what caused the problem in the first place
It was porn. It's always pornI'll still be miserable knowing that I'll never know what caused the problem in the first place
Reply With Quote
