Help me debug this bluescreen.

November 21, 2009 2:13 PM

Windows XP Home machine goes blue screen on boot. I'd like to fix it without reinstalling. Details inside.

I'm fixing a Windows XP Home machine for some friends. This machine has been fine for a couple of years, but is now going blue screen on boot. I've tried a bunch of things with it, but haven't gotten anywhere. I'd like to be able to fix the machine with all their applications and data intact. I've already made a copy of their hard drive. The computer is a Dell Inspiron 530.

The only recent thing they can tell me they did to the machine was to install then uninstall some facebook toolbar control. This is a family machine, full of games and misc. junk. There's plenty of room on the hard drive.

The only information on the blue screen is the stop message with the numbers 0xC0000005 0x8053A363 0xF7A6D684 0xF7A6D380. No other error message or filename is given. No minidump is produced.

Trying to boot in safe mode shows a list of files being loaded, ending with mup.sys. A second or two after that, the system hangs in a blank blue screen. From what I've read on the net, this does not indicate anything with mup.sys itself, but something that loads after it. Booting Safe Mode with Logging does not produce a boot log.

I've been booting the machine with Ubuntu and UBCD4WIN live disks, and trying the recovery console on the Windows XP install disk. I've run Ubuntu's memory check, and chkdsk from the recovery console, and these seem not to be the problem. I can look at the filesystem and registry with no problem.

I have updated the BIOS, tried removing the video card and using the integrated video. I've run several virus/malware scans. I've tried reverting to older versions of the registry from restore points. I've tried disabling the video card driver and audio driver from the recovery console. None of this has made any difference. I'd like to be able to use the autoruns tool to experiment more with enabling/disabling things, but it doesn't seem to run on an external registry.

So, what am I missing? There must be corrupt or outdated driver or perhaps some malware in there. Dell's site does show several updated drivers, but I can't install them because I can't boot the target OS. How can I trace the drivers being loaded at startup or find out more about where it's blowing up? Any leads would be appreciated.

Also, if you know of a good forum to ask this sort of question in, please let me know.

Thanks for your help.

posted by DarkForest to computers & internet (20 comments total)

Did you try a repair install? Honestly, since you do have a copy of their data, you're probably best off just wiping the hard drive and reinstalling from scratch. Windows usually runs better after a fresh install anyways, and it sounds like there's a couple years of accumulated junk on there.
posted by reptile at 2:29 PM on November 21, 2009

You could try this, since it seems the last resort after trying everything you've tried so far. However, I can't vouch for it, and think it's probably just better to go with a clean slate, which, I can tell, is not your preferred outcome.
posted by General Malaise at 2:38 PM on November 21, 2009

In my experience the Blue Screen is almost always a result of hardware failure. The Windows OS gets blamed because, well people enjoy blaming Windows for things.

Usually it's the result of bad memory. Seeing as it's a Dell, I would also be somewhat less than shocked to hear it was the motherboard.
posted by drjimmy11 at 2:39 PM on November 21, 2009

It boots and runs various live disks and passes chkdsk and Ubuntu's memtest86, so I've been assuming that memory and disk are OK. Generally I do like blaming windows for things, but I don't think I did so here. :)

But I should probably try swapping out the memory cards one at a time. I should probably run some low level disk r/w check as well. Thanks.
posted by DarkForest at 2:49 PM on November 21, 2009

At least try re-seating all the memory modules and hard drive. Sometimes that can be enough. But, it sounds like you have an OS reinstall ahead of you...
posted by Burhanistan at 3:52 PM on November 21, 2009

Not sure if you can get the PC to boot long enough to use this, or maybe run it from your UBCD4Win CD, but you might want to try BlueScreenView to figure out what the problem is. I've never used it, but it was recommended here.
posted by Simon Barclay at 3:56 PM on November 21, 2009

You could spend countless hours trying to figure out what is causing the problem, or you can actually verify if it is hardware or software related by wiping and reinstalling.

Honestly, unless you have a REALLY good reason not to format/reinstall, or if you just HAVE to know what this apparently very rare error message means (good luck!), wipe it and reinstall. It's not worth the amount of time you'll spend tracking down nonsense.
posted by dinx2582 at 4:43 PM on November 21, 2009

When a customer's Dell did this to me, it did in fact turn out to be bad RAM. Before finding this out, I had wasted a lot of time trying all kinds of other things; I thought the RAM was OK because both the inbuilt Dell diagnostic and memtest86+ had passed it. However, it showed up bad after leaving memtest86+ running overnight. Since that's an easy test to do, try that first.
posted by flabdablet at 4:55 PM on November 21, 2009

Your first stop code suggests a memory issue, so I would start with that. Your second stop code suggests a problem with the outpost firewall driver. Did the user have that?

Is it set to produce minidumps? If not you might be able to enable it via the recovery console. Did you try disabling all onboard devices via the BIOS like the sound card, network card, etc? Just use the integrated video or try a known good video card. What you should be doing is trying to boot with the minimum of hardware. Disable the USB hardware if it allows you. Id also try a known good mouse and keyboard.

FWIW, I think memtest86 is garbage. It has failed to find bad modules so many times I dont even use it anymore. I have better luck with MS's ram tool but thats a crapshoot too, Id consider just removing a module if it has two and trying both of them alone.

chkdsk is also pretty simple, have you tried viewing the SMART values? Any bad sectors in there? Id also run Disktune from the UBCD disc and verify every sector that way.

Id also put the image on a different drive and trying to boot that.

If that fails short of acquiring an external debugger I think the best policy would be to attempt a repair install.
posted by damn dirty ape at 4:58 PM on November 21, 2009

Try nothing else until you've tried the Last Known Good configuration. Might save you heaps of time.
posted by dave*p at 7:38 PM on November 21, 2009

Also, I don't believe you've listed the actual stop code. Usually this is the first number listed, and I don't think that 0xC0000005 is a valid one (I believe the first one you gave is one of the memory address that was involved in the fault, as are the other three that you gave). Are you sure there's no number before the number you listed? And no text like IRQL_NOT_LESS_OR_EQUAL? That part would be pretty important.
posted by dave*p at 7:46 PM on November 21, 2009

We've tried the Last Good Configuration boot selection. No such luck.

Dave*p, you're right. I left out the first number in the stop message. It was 0x0000007E. But there was no text indicating the type of error.
posted by DarkForest at 8:20 PM on November 21, 2009

A stop 7E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED) is a driver fault. There should also be a driver name displayed on the blue screen. I would unplug every USB device on the computer except for the keyboard (yes, even the mouse) and see if it boots.

Assuming it doesn't, if you can get into the recovery console, or otherwise get access to the file system, go into C:\Windows\System32\Drivers and move the file listed on the blue screen out to another location, then try to boot the machine. As long as the driver doesn't correspond to one needed to read the hard drive, the system should boot. (See: KB 330182)

If that all fails, boot the Windows XP media and press "R" at the first screen to do a repair installation. It will roll your computer back to whatever service pack level is on the install media, so make sure it is disconnected from the Internet and that Windows Firewall is on (with "No exceptions") in order to do updates.
posted by fireoyster at 11:22 PM on November 21, 2009

There should also be a driver name displayed on the blue screen.

There really wasn't. Here's a screenshot.

Unfortunately, this machine only has USB connections for the keyboard, so I couldn't turn off USB. But I've tried turning everything else off in the bios. A surface scan of the HD also turned up nothing.
posted by DarkForest at 4:42 AM on November 22, 2009

Oops, screenshot here.

Swapping memory cards around also made no difference...
posted by DarkForest at 4:59 AM on November 22, 2009

Hmm... OK, if there's no driver listed, it's because the system couldn't save out the information needed to display that on the blue screen. I'd go into the Drivers directory and move out all of the drivers that match the "date test" given in the KB article earlier. Doing a file system scan or similar probably won't help, because a 7E is a driver issue.
posted by fireoyster at 8:21 AM on November 22, 2009

Boot from your Windows XP CD or DVD and start the recovery console

Type CHDIR $NtUninstallKB971486$\spuninst

Type BATCH spuninst.txt

Type Exit
--
I've had a crop of similar issues recently in my line of work, and this sounds just like it. Pretty common thread with Dell systems.

If it works, hide KB971486 from Windows update.
posted by Never Better at 10:18 AM on November 22, 2009

Also hide KB953297. IIRC there was a patch for the issue, but this update caused some issues.
posted by Never Better at 10:21 AM on November 22, 2009

Never Better, it didn't work, but thanks anyway.
posted by DarkForest at 1:54 PM on November 22, 2009

Thanks for your advice. I eventually went with the repair install. It was less painful that I thought it would be.
posted by DarkForest at 8:12 AM on November 24, 2009