Tracing failure during XP boot up

OK, I'm attempting to trace my boot failure

Running on a bootable CD* (or just booting), I can enter the F8 option screen: that purportedly means that the MBR is working.

(Can't complete a boot on any option on F8)

When I try booting on SAFE mode on bootable CD, the monitor shows various files etc loaded, with the last one shown being:

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS\SYSTEM32\DRIVERS\Mup.sys

What operation follows that?


*http://tinyempire.com/notes/ntldrismissing.htm

 

The boot process varies, depending on the Windows version; it's difficult to get a definitive sequence of it, especially during the latter stages.

Vista (W7 will be very similar) and XP.

Wade your way through the list carefully, make double-sure you've found the correct part that you're stuck on - and good luck .

 

One tip said that NDIS.SYS follows Mup.sys in the booting sequence (loading? compiling??)....

Some reports are that ndis is a virus/worm-attacked driver, but both of those drivers in the non-booting pc are the same size / date as the supposed good ones in the pc I'm posting from...
.

 

Many Windows drivers are used by malware writers but if the file has the same size and date, it's probably good. Here's some more sites that might help you understand the XP boot process:
Troubleshooting the Startup Process
Windows NT startup process

If you get to the point where you think the problem lies with a Registry setting, you can access the Registry via BARTPE CD or by connecting the drive to a working PC.

 

Apparently, there may be a boot log (at least in functioning systems) that will show the boot sequence for the particular PC in question (apparently all can be different).

What is the name / were would I find that log?

Thanx

 

Boot logging has to be enabled for each boot up you want to log (as far as I can recall), you can do this from MSconfig, I think. The file should be stored in the root of the system drive.

Alternatively, you can get a much more detailed view of the boot process from Procmon. Tools > Enable bootlogging.

 

OK, I'm sloooowly learnin' stuff!

I found the ntbtlog for the dead PC at c:\windows\ntbtlog.txt

....it lists the loading order of drivers and programs and status of each.

The boot log from the dead PC IS different from the boot log of the very similar XP Pro SP3 PC that I'm posting from (altho processr.sys does follow Mup.sys there too).

dead PC boot log says: (29 and 30 indicate numerical order from beginning of boot)

29 loaded driver Mup.sys
30 did not load driver ACPI Uniprocessor PC

Now to look around for info on this driver....

(hopefully this may prove helpful to someone else who's beating their head on the wall)

BTW in XP, boot logging is activated by rebooting and getting to the F8 screen, where one of the options for booting up is something similar to "enable boot logging".

.

 

This search may help you track down what's been happening?

 

OK - I'm posting because I HATE it when I'm researching something, and a thread just DIES with no resolution.

In this case, I never did get the hanging-after-Mup.sys / ACPI issue straightened out - hopefully, someday I'll know how to fix that kink.

But I did get SUCCESS in rebooting, in a somewhat unusual manner.

Because my dead PC contained the i386 folder and files, and because I could access those via a bootable CD, I copied that to a USB drive.

Using another PC (this one) I then created my own bootable Windows XP Pro CD, complete with EULA. I had to "slipstream in" the SP2 update to get a complete repair (aka "in-place upgrade") and then REBOOT - to my old settings and data....

And, this is not hacking or piracy - I used my own software to recovery the same PC
.

 

Good result and well worked out