Question BSOD in Safe Mode Only

[David Taber]

I've got a nice little Thinkpad that has been running fine on WinXP Pro and I imaged the original HDD onto a Kingspec SSD. (KSD-PA25.6-064MS, internal 2.5" IDE drive)

In normal mode, everything has been running fine. Updated with all the latest patches (including the ones you can get through this week).

Just for the record, it does boot quickly but in typical use it ain't all that much faster...the x31 is CPU-bound.

But if I try to go to SAFE mode, it BSODs right after the agp440.sys module loads. Error codes are:
0x0000007E (0x0000005, 0xF76C0211, 0xF78E26F8, 0xF78E23F4)

OF COURSE there is no other information on the BSOD page, nothing gets written to the bootlog file, the event file...and memory dumps don't happen so I have very little to go on.

The original disk goes into SAFE mode just fine, so we know it isn't the motherboard.

Did a bunch of cleanup to the registry, non-plug-n-play devices, etc. No change.

Reinstalled every driver and device in the system. No change.

Did the "safeboot key repair" script. No change.

Moved DRAM SIMMs around, no change.

Looked in Current Control Set's Safeboot keys, comparing it to other XP boxes and they looked fine.

Note that the BSOD happens a couple of seconds after the last driver is loaded, so I don't think it's a driver problem. I think it's just as the SAFE window system tries to start up that the death occurs.

Ideas?

 

[PC Tailor]

Do you have a dump file of the BSOD?

 

[David Taber]

Hi PC Tailor...as I mentioned, no dump file is created and nothing goes into the event viewer logs either.
BUT I have news: now that I got bootlogging working, I can seee that SAFE mode is trying to load way way too many drivers, essentially everything from multi-user mode rather than obeying the ControlSet key tree "SAFEBOOT - Minimal". I tried Safe with Networking and Safe with command prompt, and every time the system tries to load stuff it shouldn't (networking, sound, etc.) and so the drivers crash the system with requests that are invalid in SAFE mode.
So...any idea why SAFE would be trying to load so promiscuously? It's probably a corrupted registry entry caused by a bad uninstall of a virus checker....
I really really don't want to have to re-image the SSD, given the number of days work involved with getting it all back the way it is. Fixing this is worth my time...
Thanks for any ideas you can provide.

 

[PC Tailor]

Apologies, just missed the part of dumping turned off.

Does it still occur if you try Safe Mode without networking?
Did this start occuring after any change?
Do you have latest BIOS installed?
Can you run a CHKDSK and SFC if you can get into a Safe Mode at all - if not you can probably do this during a recovery.

 

[David Taber]

Thanks for your response, PC Tailor.

Actually...dumping isn't turned off. It just doesn't do anything on BSOD (I imagine because the disk/fs drivers or services are crunched by the BSOD.
The load-too-many-drivers symptom occurs in all SAFE modes.
This started months ago, I believe it was caused by a a bad uninstall of a malware or virus protection sw.
Possibly this is a reg key permissions problem?????
Latest BIOS is there (9 years old) but since SAFE mode works fine on a drive from another computer (I have a pair of identical ones), I know that the core HW and BIOS are OK.
Can't get into SAFE mode at all due to driver overloading problem.
Have run chkdisk and SFC, nothing interesting found (there were some repairs, but just a couple of missing/weird files...)
Have also uninstalled/reinstalled all drivers that SAFE mode is supposed to be using. The problem is, it's trying to load a bunch of drivers that it shouldn't.

 

[David Taber]

AND NOW I CAN REPORT MY SAFE MODE WORKS~~~!!!!

Turns out that "the latest drivers" for the embedded trackpoint device were not compatible with XP, even though they said they were.
I had to completely uninstall the new drivers (which is harder than it sounds, for reasons I won't go into) and after a half hour of registry cleanout I installed a driver from back in 2006 and....voila, fixed.

How did I do it? By learning about the Safeboot key (read this article and its companions!!!)

So there are several lessons about 7E errors:

• If you can get crash dumps and events in the log, start there
  
  
• if you can't, look in ntboot.log and compare your safe mode loading sequence with a known good machine with the same OS version. safe mode should be loading only a few dozen drivers and services, and the log file should indicate hundreds of other drivers that were not loaded. If you don't see lots of "did not load..." lines in the NTboot log, something is fishy. (Of course...make sure you're looking at the correct log...they are just appended and if safe mode is broken the very last log entries will be for multi-user mode, not safe. Each boot log starts with a line that indicates the OS version and a date/time stamp.
  
  
• check to make sure your Safeboot key is actually in the registry. Which control set should it be in? the one that's defined the default in the Select subkey of the parent's parent control key
  
  
• the graphics driver is the most common cause of 7E stop errors. but I learned the hard way that it could be any driver that SAFE mode uses.
  
  
• go into the Safeboot Minimal key of the default ControlSet, and one by one eliminate devices (there should be about 30 of them), followed by a reboot into safe mode. Eventually, you'll find a way to get safe mode running, even though it's crippled.
  
  
• Once you've identified the culprit driver, download several versions of it (including the original-as-shipped one, if you can find it). Note that for old OSs like XP it can be hard to find drivers that are 10 or more years old. UNFORTUNATELY, newer drivers may not in fact be fully compatible with XP, even though they will claim it.