BSOD in Safe Mode Only

I've got a nice little Thinkpad that has been running fine on WinXP Pro and I imaged the original HDD onto a Kingspec SSD. (KSD-PA25.6-064MS, internal 2.5" IDE drive)

In normal mode, everything has been running fine. Updated with all the latest patches (including the ones you can get through this week).

Just for the record, it does boot quickly but in typical use it ain't all that much faster...the x31 is CPU-bound.

But if I try to go to SAFE mode, it BSODs right after the agp440.sys module loads. Error codes are:
0x0000007E (0x0000005, 0xF76C0211, 0xF78E26F8, 0xF78E23F4)

OF COURSE there is no other information on the BSOD page, nothing gets written to the bootlog file, the event file...and memory dumps don't happen so I have very little to go on.

The original disk goes into SAFE mode just fine, so we know it isn't the motherboard.

Did a bunch of cleanup to the registry, non-plug-n-play devices, etc. No change.

Reinstalled every driver and device in the system. No change.

Did the "safeboot key repair" script. No change.

Moved DRAM SIMMs around, no change.

Looked in Current Control Set's Safeboot keys, comparing it to other XP boxes and they looked fine.

Note that the BSOD happens a couple of seconds after the last driver is loaded, so I don't think it's a driver problem. I think it's just as the SAFE window system tries to start up that the death occurs.

Ideas?

 

https://forums.anandtech.com/threads/do-ssds-have-trouble-getting-into-safe-mode-via-f8.2294525/

above says:

The entry key strokes for Safe Mode depends on your mobo's BIOS, not the OS or the SSD. The problem can be that the SSD speed does not give you enough time to exercise the command. Should come before the OS starts loading. Once that process starts, it is too late for the BIOS safe mode command. Then you have to do it from within Windows.

you can use msconfig to get into safe mode, but remember to reset misconfig before leaving safe mode or it will boot back into safe mode until you do.

 

Actually, the problem isn't getting into Safe mode -- it's that once in Safe mode, it BSODs (nice and quickly )

Now that I got boot logging to work, I understand why: way too many drivers are loading....including multi-threaded ones that can only run in standard windows mode. Even though I'm asking it to NOT load network drivers, lots of them are loading, and sound, and services that can't work properly in SAFE mode.

So the BSOD blows up when if finally trips on to a driver that grabs an unavailable resource (like, Kmixer.sys).

OK, so does anybody know why SAFE mode would do this? It's almost certainly a corrupted registry entry (thanks to a bad uninstall of AVG, I think)...does anyone have any pointers? I really really don't want to go through the process of downloading all the MSFT updates since SP3, there are probably 500 of them....plus, I'd have to reinstall / reconfigure lots of apps.

 

you will have to do a registry search to clear all the last vestiges of AVG . OR, you can reinstall AVG and then use their removal tool which should clean it out .

now as far as I know safe mode only loads generic drivers as this is a troubleshooting mode.

what do you have listed in startup? look in msconfig/startup tab, the only things I have in startup is my antivirus (which does not load in safe mode) and ERUNT which I use instead of system restore.

 

Hi Elizabeth 23,
Already went thru the registry and removed all the AVG keys. That took quite a while, as their uninstall is quite sloppy indeed on XP. Their incompleteness-of-uninstall is legendary.
Yeah, SAFE mode is supposed to only load about 20 drivers, and if you look at your ntboot log file after a SAFE boot you'll see hundreds of lines that say "did not load..." -- but on my system, it tries to load all that junk and that's what causes the BSOD.
For those reading here, a closely related set of issues comes with the CurrentControlSet Safeboot keys -- look here for excellent articles and even fixes. They didn't work for me, but they may for you (particularly if you're getting a 7B error...I'm getting 7E).

 

it appears to come down to what was said earlier about using an ssd and the problems with safe mode. I have not used an ssd so cannot speak from experience.

did you use msconfig to enter safe mode and did the same issue occur?

https://www.lifewire.com/how-to-start-windows-in-safe-mode-using-system-configuration-2626115

above has instructions for using msconfig to enter safe mode.

 

The MSCONFIG route to SAFE would put me in an endless loop from which I couldn't escape except by a lot of hassle. So no, I haven't gone that route.

Due to the "loading too many drivers as part of SAFE" root cause, I don't think the SSD is relevant. I'm not going to take the time to prove it (would mean cloning it onto an SSD, etc), but if SSD's were the problem you'd see lots of posts on the web about it...and I haven't seen any.

 

endless loop? you have to put misconfig back to normal before leaving safe mode to stop a safe mode boot.

do you have a copy of hiren's or any other boot disk to work your drive offline?

check if there is something strange in windows\system32\drivers, e.g. a file .sys 0Kb long with an unusual name, then find its name in registry (it could have a bit weird registry entry too), you can do this with a boot disk

 

reply 2

https://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/

above might help, I will keep researching to find out why it is loading too many drivers,

7E errors are usually hardware

 

Ummmm, well, since the root problem is that I can't successfully get into safe mode, I would have no way of getting back to multi-user mode (which works fine).

Yeah, I have lots of CDs and disk images I can use for this.

Ooooooooooooooooooh I wasn't aware of this. Let me do a search.

NEWS: I was able to hack at the ControlSet Safeboot key and identify the pathway that this problem takes. I did this by deleting subkeys until SAFE worked...and it turned out to be the Mouse key. Even though I couldn't navigate in SAFE, it happily loaded. So now I'm going to go spelunking into the Thinkpad's pointing device tree to see what's what.

 

THANK YOU for your help on this!!!

Yeah, that series of articles is wonderful. It is focused on 7B stops, but it gave me conceptual hints that lead me to find the errant key & driver. Still not fixed, but at least I'm not blindly poking around.

I believe there's a registry key that tells the system what modes a driver can load into (it's associated with the driver itself--it has I think only four values, but I need to go find that). Perhaps that number is just corrupted, leading SAFE mode down the garden path to BSOD oblivion...

 

getting too technical for me, ,

https://docs.microsoft.com/en-us/wi...s/install/overview-of-registry-trees-and-keys

https://docs.microsoft.com/en-us/windows-hardware/drivers/install/deviceoverrides-registry-key

see if these help

 

AND NOW I CAN REPORT SAFE MODE WORKS~~~!!!!

Turns out that "the latest drivers" for the embedded trackpoint device were not compatible with XP, even though they said they were.
I had to completely uninstall the new drivers (which is harder than it sounds, for reasons I won't go into) and after a half hour of registry cleanout I installed a driver from back in 2006 and....voila, fixed.

So there are several lessons about 7E errors:

• If you can get crash dumps and events in the log, start there
• if you can't, look in ntboot.log and compare your safe mode loading sequence with a known good machine with the same OS version. safe mode should be loading only a few dozen drivers and services, and the log file should indicate hundreds of other drivers that were not loaded. If you don't see lots of "did not load..." lines in the NTboot log, something is fishy. (Of course...make sure you're looking at the correct log...they are just appended and if safe mode is broken the very last log entries will be for multi-user mode, not safe. Each boot log starts with a line that indicates the OS version and a date/time stamp.
  
• check to make sure your Safeboot key is actually in the registry. Which control set should it be in? the one that's defined the default in the Select subkey of the parent's parent control key
• the graphics driver is the most common cause of 7E stop errors. but I learned the hard way that it could be any driver that SAFE mode uses.
  
• go into the Safeboot Minimal key of the default ControlSet, and one by one eliminate devices (there should be about 30 of them), followed by a reboot into safe mode. Eventually, you'll find a way to get safe mode running, even though it's crippled.
• Once you've identified the culprit driver, download several versions of it (including the original-as-shipped one, if you can find it). Note that for old OSs like XP it can be hard to find drivers that are 10 or more years old. UNFORTUNATELY, newer drivers may not in fact be fully compatible with XP, even though they will claim it.

 

how very true, I have seen lots of driver utilities offer drivers for xp that are not compatible, if possible always download from the manufacturer, and before you ever wipe your drive copy the drivers over to a flash drive?

good detective work on your part, give yourself a pat on the back,

 

Thanks for the assist, Elizabeth.
One thing I neglected to mention: before you go hacking the registry, it's a good thing to back up the entire ControlSet you're working on. The backup is about 6 megs, but it is a critical lifeline...
See you in cyberspace...

 

I back up my registry everytime I restart and at random on demand with ERUNT, this is much better than system restore