boot in safe mode fails at fltmgr.sys

[swaddo]

I've got a clients machine (XP Pro) that stops booting at fltmgr.sys. Wont boot in safe mode.

Found that heatsink was clogged and it was hot as, also PSU fan had failed. Fixed these and it now boots fine using UBCD and Ubuntu live disks (as well as other live disks) but no joy from the HDD.

Memtest shows no problems, I've tested the HDD and there appears to be no bad sectors, chkdsk found filesystem errors and repaired them. (subsequent checks show no errors). I've also attempted a repair install and still failing at the same spot.

Any tips on where to go from here?

edit: i'm heading toward a full reinstall but i'd like to avoid it if possible. it is the clients till server and that would mean a few days downtime while we hunt down the disks for the reinstall

 

[DarDar]

system restore?
or copy the file from an xp cd using the recovery console?

 

[Crollins]

I'd suggest doing an in-place upgrade. (Boot up into your xp cd and click enter for the first option, f8, and then highlight the partition and click r for repair.) This will replace core system files without harming the data. It will usually fix problems such as this. You could use the recovery console but sometimes its a pain and with this you can just start it, walk away, and 30 minutes later you have a fixed laptop (usually).

 

[swaddo]

Thanks DarDar.

Not sure how to do an offline system restore for an unbootable XP install (never had to do it before). It appears that the tool for the job (Microsoft diagnostics and recovery toolset) is no longer available? (i'll keep hunting for it though) [found a copy]

I've dropped a new copy of the file in but no joy.

 

[hyfidel]

I've seen similar problems occur with bad hard drives. Try something a little more robust than chkdsk.

 

[swaddo]

I'd suggest doing an in-place upgrade. (Boot up into your xp cd and click enter for the first option, f8, and then highlight the partition and click r for repair.) This will replace core system files without harming the data. It will usually fix problems such as this. You could use the recovery console but sometimes its a pain and with this you can just start it, walk away, and 30 minutes later you have a fixed laptop (usually).

sorry Crollins, missed your post before. I've tried running repair with no success.

I reckon I might try cloning the drive and running repair on the new copy.

 

[swaddo]

I've seen similar problems occur with bad hard drives. Try something a little more robust than chkdsk.

Hyfidel, what would you recommend. I've checked with HD tune and it reported no errors but would welcome any other suggestions.

 

[Crollins]

Hyfidel, what would you recommend. I've checked with HD tune and it reported no errors but would welcome any other suggestions.

I don't know what he would suggest but I find seatools for windows to be a very nice hard drive tester. Just grab yourself a copy of hirens if you don't have one and use that. Also can you ellaborate on "boot in safe mode fails at fltmgr.sys." Does it blue screen, hang, etc. Does this just happen in safe mode?

 

[B Trevathan]

Will it not boot into normal mode and when you try to boot into safe mode the last file you see on the screen is fltmgr.sys?

What happens when you try to boot into normal mode?

When you try to boot into safe mode mode if it is showing fltmgr.sys then I think that means it has loaded that driver and is now trying to load the next one. I think the next driver to load after fltmgr.sys is sr.sys

Have you checked to see if the files that safe mode is trying to load is on the hard drive?

Have you tried booting into safe mode and safe mode with networking? Both safe modes have different registry keys telling them which drivers to load.

Have you used a live CD like Dr. Web to check for malware? Lots of malware block you from booting to safe mode or delete the safe mode registry keys.

Have you check the boot log file? A boot log file, Ntbtlog.txt, is automatically created every time the computer is started in Safe Mode. If a boot log file using that name already exists, the new data is appended to the existing file.

After you ran chkdsk and it repaired the errors did you run any other commands like fixboot or fixmbr? Note: be careful with fixmbr if you have a custom mbr like from Dell you don't want to run fixmbr.

 

[swaddo]

I don't know what he would suggest but I find seatools for windows to be a very nice hard drive tester. Just grab yourself a copy of hirens if you don't have one and use that. Also can you ellaborate on "boot in safe mode fails at fltmgr.sys." Does it blue screen, hang, etc. Does this just happen in safe mode?

Boot just hangs after loading fltmgr.sys, no bsod. It happens in all modes.

Will it not boot into normal mode and when you try to boot into safe mode the last file you see on the screen is fltmgr.sys?

What happens when you try to boot into normal mode?

booting in safe mode jsut hangs, booting in all various safe modes hangs after displaying fltmgr.sys

When you try to boot into safe mode mode if it is showing fltmgr.sys then I think that means it has loaded that driver and is now trying to load the next one. I think the next driver to load after fltmgr.sys is sr.sys

Have you checked to see if the files that safe mode is trying to load is on the hard drive?

I'm still cloning the drive but I'll check sr.sys after this finishes

Have you tried booting into safe mode and safe mode with networking? Both safe modes have different registry keys telling them which drivers to load.

yeah, see above.

Have you used a live CD like Dr. Web to check for malware? Lots of malware block you from booting to safe mode or delete the safe mode registry keys.

I've run a few different malware scanners (AVG rescue disk, MAB) and nothing has shown up but i will chase this futher if the clone doesnt solve it.

Have you check the boot log file? A boot log file, Ntbtlog.txt, is automatically created every time the computer is started in Safe Mode. If a boot log file using that name already exists, the new data is appended to the existing file.

I'll look into the log file after the clone finishes too.

After you ran chkdsk and it repaired the errors did you run any other commands like fixboot or fixmbr? Note: be careful with fixmbr if you have a custom mbr like from Dell you don't want to run fixmbr.

i've run fixmbr. Its a generic OEM version so no custom MBR AFAIK

BTW, thanks for the help folks. Much appreciated.

 

[B Trevathan]

You may want to manually restore the Windows XP registry also:
http://www.aitechsolutions.net/winxpnoboot.html


For comparison, here is part of a boot log:
Loaded driver disk.sys
Loaded driver \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
Loaded driver fltmgr.sys
Loaded driver sr.sys
Loaded driver KSecDD.sys
Loaded driver Ntfs.sys
Loaded driver NDIS.sys
Loaded driver sisperf.sys
Loaded driver sisidex.sys
Loaded driver SISAGPX.sys
Loaded driver RecAgent.sys
Loaded driver Mup.sys
.....

 

[swaddo]

boot log is not being created however Dr Web has found multiple trojans that AVG and MAB missed (Siggen2.261 and MulDrop1.42420 so far)

hopefully this is the cause and I can get some sleep soon. If not I'll look at rolling back the registry

 

[B Trevathan]

boot log is not being created

It should be. You know its in the windows folder and not the root folder don't you?

however Dr Web has found multiple trojans that AVG and MAB missed (Siggen2.261 and MulDrop1.42420 so far)

Get rid of the malware, it may be blocking you from fixing the system.

hopefully this is the cause and I can get some sleep soon.

Its morning here, almost afternoon. Its 10:03 am

 

[swaddo]

yeah, i know it should be in the windows folder. file isn't there though.

1:15 am here and i'm making another cup of coffee

 

[swaddo]

rolled back to 10 day old registry snapshot registry as per the instructions above and its booting again. Thanks for the help.