Why does my system file become corrupt?

[theslug]

Everyone once in a while, upon a reboot I get a BSOD saying: BAD SYSTEM CONFIG INFO. I have to go through the procedure at http://support.microsoft.com/default.aspx?scid=kb;en-us;307545 and restore the file c:\windows\system32\config\system from a restore point, which fixes the problem. My question is, why does this file keep getting corrupt? Since installing XP almost a month ago, I've had this happen 3 times.

I've been monitoring the file size of this system file and right now it's at 115,605,504 bytes. Over time, it increases by itself. The last time I got the BSOD, the file size had jumped to 175MB. I've run a virus scan which turned up nothing.

I've searched for this problem, but I mostly just found ways to work to temporarily fix or work around it. I haven't seen anything that says how to fix it permanently. Does anyone know what might cause the file to keep corrupting itself?
thanks in advance!

 

[Markbnj]

Mine is around 5 megs right now, so yours sounds pretty damn big . I would be thinking about a reinstall at that point.

 

[John]

Are you using registry cleaners, defraggers, or any tweak utilities?

 

[theslug]

No, not using any of those, other than the built-in windows defragger.

 

[Basie]

Are you Overclocking? I use to get that alot due to Power Supply and Motherboard incompatibility.
I had a Enermax 350W and Epox-8K7A+. I swapped out the Enermax for a Antec and it worked fine after that.

 

[theslug]

Nope, no overclocking either. Are you saying you had problems with this file but a new PSU fixed it? It seems like a software issue.

 

[Basie]

Yes, for that particular combination. If the 5v rail dropped too low which on the Enermax 350 was frequent it contributed to c:\windows\system32\config\system corruption

 

[OdiN]

Hardware problem. Bad RAM, bad PSU/mobo/something.

 

[theslug]

Maybe you're right but would that not cause other sorts of data corruption? It's only this one file. Just had the PSU replaced though, so we'll see if that does anything.

 

[Markbnj]

Interesting thread here. This problem has been around for awhile. Here is a Microsoft KB article that was recommended...

http://support.microsoft.com/?kbid=307545

Ahhh, I just glanced through it. The file you're having trouble with is one of the registry hives. Warning, the procedure referenced is very long and probably has some risk of failure associated with it, although one poster in the linked thread said it worked for him every time.

 

[theslug]

That is the procedure I've been using to fix it. I'll look through that thread though to see if there's anything I can try. Thanks

 

[Smilin]

this problem can also be caused when the system hive is not actually corrupt.

The hive is being loaded by ntldr which has a limited amount of memory this early in the boot process. If the hive is too large you'll get the same failure to load as a corrupt version. In NT/2000 this was a real problem since ntldr only had about 16mb of space for the hive+boot drivers (leaving approx 10.5 meg for the hive). In XP it's bumpted up to 64mb but the problem can still happen.

Often this excessive size is due to whitespace in the registry hive resulting from numerous writes to the file. Although unrelated it's kinda like what happens to a drive when it gets fragmented.

If the hive is getting to an unbootable state rapidly there may be a third party app or driver misbehaving. I've also seen this caused by poorly written mass storage drivers that gum up the mounteddevices or other key.

Make a copy of the system hive (initiate a system state backup with NT backup, wait for a few files to copy then cancel the backup). The backed up copy of the hive will be in your Windows\repair folder. Zip up the system hive (it should compress very well) and email it to me. I can clean up the whitespace and send it back to you. I'll also see if I notice any obviously bloated keys...no promises though, it can be a needle in a haystack.

Putting the newly compressed hive back into production will require a quick trip to recovery console since it's always "in use".

PM me for email addy.

 

[backinsac]

Hey OP, any update on if the replacement power supply solved your problem. A friend of mine is having this problem with Windows 2000 and I am wondering if changing out the power supply willl solve the problem.

 

[country2]

I just went thru that and it was my sata contoller.I diabled the onboard one and bought a pci card with a newer chipset no problem since.

 

[Smilin]

Originally posted by: backinsac
Hey OP, any update on if the replacement power supply solved your problem. A friend of mine is having this problem with Windows 2000 and I am wondering if changing out the power supply willl solve the problem.

I took a look at his hive. It was not oversized and did indeed have a corrupted spot in it. You can never be sure but the usual ways this happens are: bad spot on an otherwise good disk, an unlucky hard-shutdown and other "corrupt file" sorts of things.

Usually one of the biggest signs of a bad power supply are a general "crankiness" about booting and possible random shutdowns/reboots under load.

 

[backinsac]

I changed out the power supply on my buddy's computer. It turns out that he was indeed having problems with his power supply but didn't tell me until now. Hopefully this solves the problem.

One thing I did notice when I reinstalled Windows 2000 and everything else on his computer was that under device manager his hard drive is listed as Quantum scsi and also his cdrom is listed as cdrom scsi. However, none of his drives are scsi, all are IDE. I didn't want to screw anything else up, so I left them that way. Everything seemed to work fine. Any idea what is going on here?

 

[Smilin]

Sounds like we used a ton of generic drivers for your chipset and/or controller.

A big round of driver updates should clear things up.

Any time you fool with a mass storage driver you run the risk of a Stop 7B at boot. Look at driver details to find out what .sys files are being used. Make a backup copy of them right there in the system32\drivers folder.

After you've done this go update chipset and mass storage drivers. Problem should go away. If you get a Stop 7B, just go to recovery console, copy the backups to their originals if they are missing then boot using a last known good to roll back the control set in the registry. good to go.