16 februarie 2012 15:28
Recently, we have had issues with our Dell 2120 netbooks (360 units total). We would get tickets in on them stating that they wouldn't boot, start windows normally wouldn't work, or last known good config. I would go out to the cart and check the netbook, and sure enough wouldn't boot, black screen with the error C:\windows\system32\confg config.sys is corrupt windows can not start.
I booted from my windows 7 usb install disk, and got into a command shell and attempted to fix the bad hive like we used to do in XP. However, this did not solve the issue. I would then end up imaging them with a new image. This seemed to stop the error for a few weeks. Now it's back agian and yesterday I had the issue, I took the netbook back to my office, and placed it on my desk. This morning, the computer booted up fine. I'm not sure what the problem is, and to compund the issue I have had a few desktops with this issue also.
Since the netbook is booting now, how and what should I look for in event manager? Also, could this be a recent update, or SP1 that is causing this issue? I'm up for any suggestions...except to run SFC /scannow or chkdsk /f /p that has already been done and yeilded no results.
20 februarie 2012 11:03Moderator
24 februarie 2012 18:53
There's no malaware found. These netbooks are behind an enterprise firewall, and web filter. They also have Eset AV4 on them. So it's not malaware causing the issue.
These computers are joined to a domain, as other computers are. If this is an issue with group policy, why wouldn't I see more of a widespread issue with desktops and other laptops. Why is the majority of the problem on the netbooks only? I'm not buying the "group policy or malaware" theory, unless you can point me to something specific.
- Editat de Jeff Marty 24 februarie 2012 18:54
24 februarie 2012 23:40
Hi,check the configuration of your antivirus and especially the part exiption scan, and try to repair this file by starting Windows by using the Installation Media of windows 7 and move the corrupted file using the "copy" command, refer at this link it can help you:http://support.microsoft.com/kb/307545/en-us
Oussama Oueslati | System Engineer | vNext Consulting
24 februarie 2012 23:55you need to take a look at the image / build that was used on these machines, and try to duplicate the issue on the test bench / lab. was it developed internally or is it a dell image. if dell, contact dell support. if your looking for config.sys that lives right in the root of the system drive. C:\windows\system32\confg config.sys does not exist in a standard windows build. so a 3rd party software is looking for that file which leads us to beleive its malware or somthing else looking for that file. you can try to do a repair installation with a windows 7 disk.
25 februarie 2012 03:00
. . . and attempted to fix the bad hive like we used to do in XP. . . .
What hive were you trying to fix? Windows 7 is not XP.
The image below shows the contents of the \Windows\System32\config folder. You can only access it via an elevated command prompt--unless you have UAC disabled. You don't have UAC disabled, do you?
These netbooks are behind an enterprise firewall, and web filter. They also have Eset AV4 on them. So it's not malaware causing the issue.
Are you sure? All because you have a firewall, web filter, and AV don't mean that you are immune. Misplaced blind faith causes complacency and subsequently issues like what you are experiencing.
Like a couple of others here have suggested, you may want to take a deeper look and use other tools.
- Editat de DarienHawk67 25 februarie 2012 03:03 Inserted image showing "dir /a"
26 februarie 2012 10:30
Something as simple as having a USB stick inserted can cause these boot problems.....I'd also recommend using the generic drivers that Windows update will fetch for you if they're not already on the install disk and leave out Dell's, just to see what happens. Do try a different anti virus software, as these can play nasty. I'd recommend giving Panda Cloud or MS Security essentials a shot. Registry cleaners can also cause this problem (it's important to untick shared dlls) but that doesn't sound like your issue. I would also make sure that any software older than Windows 7 is run in Win7s superb compatibility mode by right clicking the .exe file and choosing 'troubleshoot compatibility'.
The real time saver may be setting up a bunch of virtual machines that yo can shunt around from disk to disk.
- Propus ca răspuns de Roger Andre 26 februarie 2012 10:30
27 februarie 2012 14:37
We can't change AV, we used to use MSE and still had this issue. I too think it may be a driver issue.
27 februarie 2012 14:52
My statment about windows XP, was basically to explain I used the same process- Boot from Win7 install disk, and try to repair the hive via command line (I should have explained it better. The problem is, when I get this error I can't get the machiene to boot, therefore I can't figure out what might be causing the problem. I end up re-imaging and putting the netbook back into service. The netbook might run for a week, two weeks, or several months. Then blam, one will get the error. These dells have the 512e hard drives in them. Doing some research, I found that using symantec ghost and windows 7 sysprep would work with these drives so I don't think that's my isuse.
During the imaging process, and during the installing devices phase the ST Micro Accelerometer driver attempts to reboot the computer. I hit cancle, and setup continues. After I get to the login screen and login for the first time, it prompts me agian to reboot the computer. I complete this step then, because if it's done during the install devices phase sysprep and the install will fail. I'm wondering if this might be causing my issue. But yet agian, how to I get into the non bootable machiene to track this down.
Which brings me to this question, what "other tools" I tried the DaRT recovery tools and didn't have any success (maybe I didn't use them correctly)?
27 februarie 2012 14:56
Malaware scan came back clean. Scanned with MBAM, latest updates and also scanned with Esset Antivirus 4. No infestions found.
27 februarie 2012 15:22
I was jsut able to get the machiene to boot into windows. When I log in, I get a windows activation error. We use a KMS server.
"An Error Has Occured, You can also contact Microsoft by phone to help resolve this problem"
Error Code 0x80070005
Description Access denied
Weird thing is, it will activate if I put in the key via command line, and then force it to reactivate. Any ideas?
27 februarie 2012 16:16Is the machine able to hit the MS Activation servers? Sometimes there's an extra layer of 'genuine advantage' type stuff to contend with. Otherwise just do the phone thing and it'll go through and stop bothering you.
27 februarie 2012 16:24
We use a KMS activaction server on our domain. Each client has a default dummy key that tells it to look for the KMS server in our domain. Once it does it will activate and grab a key from that server. So yes the machiene can contact the activation server.
The problem I'm having now, is I attempted to run slmgr /rearm as the adminstrator, and I was told I needed to elevate privilages. I then used my domain admin account to tun the command, I got the same error.
27 februarie 2012 16:35So you did right click CMD and choose 'run as administrator' the elevate your self up a notch from regular admin?
27 februarie 2012 16:41
I sure did, when that didn't work, I attempted to use my domain admin account.
29 februarie 2012 05:59Does anyone have rights to muck around with the permissions?