Workaround for STOP 0x0000C1F5 / 0xC1F5 / C1F5 / BSOD / CLFS.SYS / KB946084 - comments

no comment title

Piotr — Wed, 12 Nov 2008 19:36:36 +0100

Hi Tom, Thanks to your post I have just managed to delete the $TxfLog but it did not solve the problem with the BSOD ;-( Is there any other work around to safe the system? Can you advice? Regards Piotr

no comment title

Piotr — Thu, 13 Nov 2008 02:41:13 +0100

It Works!!! ;-) Thank you Actually, this bloody laptop had two partitions and I had deleted the wrong $TxfLog from wrong partion ;-( Beside that your advice worked on my when I realized that I need to get to sda2 ;-) Still have some problems but now can get the Vist DVD working thanks a lot and all the best Tom

no comment title

Piotr — Thu, 13 Nov 2008 02:44:23 +0100

scuse me the spelling mistakes. I am so excited that I do not control it anymore;-) Thanks again ;-) Pete

no comment title

Stu — Thu, 13 Nov 2008 06:50:52 +0100

Thanks, it works! ;D

no comment title

Doug — Sat, 15 Nov 2008 03:56:39 +0100

Very nicely done worked like a charm Hp wanted me to send them my notebook thinking it was a motherboard issue I showed them your fix and Im sure they will be going this route vs rma and a new drive thanks very much Doug Sacramento, ca

no comment title

Tom Karpowitz — Sat, 15 Nov 2008 05:49:06 +0100

Thanks Doug... you owe me a pair of Kings tickets. (Only kidding of course, but I [u][/u]am[u][/u] a big-time Kings fan!)

no comment title

Joker Joe — Tue, 18 Nov 2008 02:58:16 +0100

I'm sure I'm over looking something here but I can't find the $Extended hidden folder that you are talking about. I am using SystemRescue-CD 1.1.2

no comment title

Joker Joe — Tue, 18 Nov 2008 03:54:39 +0100

Sorry I went too fast and thought it was $Extened...I see now that it is $Extend and I'm in it now. Thanks

no comment title

DJ — Tue, 18 Nov 2008 10:31:45 +0100

I have the same problem. Im trying your method but I can't seem to boot the cd correctly it keeps saying it cant find the cd and it says Media Not found. Does anyone know a solution for this problem? thnx in advance

no comment title

Tom Karpowitz — Tue, 18 Nov 2008 11:03:25 +0100

@DJ: If you're getting "Media not found" or your system "can't find the CD", the most likely cause is a bogus CD. Try burning the disc again, or downloading the SystemRescueCD image again and then burning a new copy. If you have a guaranteed-good CD and the system STILL won't boot it, make sure your BIOS is configured so as to let you boot CDs before the hard drive.

no comment title

DJ — Tue, 18 Nov 2008 23:16:28 +0100

Thanks for your quick response. The problem is I can let it boot be4 my harddrive and I do get the first screen of the system rescuecd but when I press enter to boot it it loads all stuff and at the end it gives a message that it is trying to load /dev/sda1 /dev/sda2 /dev/sdb and then it says cant find device. Media not found. Sorry for my terrible english :P.

no comment title

Tom Karpowitz — Wed, 19 Nov 2008 08:24:12 +0100

@DJ: First of all, please do [u][/u]not[u][/u] apologize for your English... it is excellent. And I'm sure it's a thousand times better that the butcher job I would do on whatever is your native language... So it sounds as if you can successfully boot from CD... but the errors you are seeing could still be attributed to a bad CD burn (or a good burn of a bad/incomplete download). Did you try burning another copy of the SystemRescueCD, or try booting a friend's computer with your current CD?

no comment title

Shell — Wed, 19 Nov 2008 14:03:00 +0100

Thanks for the tip. This got around the BSOD and Vista 32-bit Premium is back in the land of the living WITHOUT a full format and reinstall. :) S.

no comment title

iminit26 — Fri, 21 Nov 2008 01:28:26 +0100

Fuck Yea! Dude your shit worked for me. i found these same steps on another site but step 4 was wrong on that site. --> here's the site: http://bsods.com/content/windows-vista-and-stop-0x0000c1f5-linux-anyone i had to do this on my hp pavillion 6700 win64 home ultimate notebook. once i made it to this page and saw step 4 i knew it was going to work.. i feel kinda bad now for not making a youtube vid to help others on going through the process of fixing this problem. thanks a ton man.

no comment title

Vaibhav — Fri, 21 Nov 2008 03:06:32 +0100

Hi, If we do not have linux, can we use the HDD of affected system as a second hard disk in a running vista computer, and delete this $TxfLog file? Will this solve the problem? Please advise.

no comment title

Tom Karpowitz — Fri, 21 Nov 2008 05:18:41 +0100

@Vaibhav: You *might* be able to mount the bad disk on a Vista system *which has already had Microsoft's KB fix for this BSOD installed* and then manipulate it that way. If the Vista system has NOT had the fix installed, it will simply bluescreen just like your system. :) However, I can't imagine how not "having Linux" is a problem... the SystemRescueCD image is a LiveCD (no installation required, just boot the disc and use it), it's free, and it's readily available at the link I provide above. All you have to do is download the ISO image, burn it to CD, boot it, and follow my instructions.

no comment title

ToniT — Fri, 21 Nov 2008 14:01:07 +0100

Hi Tom. I'm just about to launch my laptop out the window, so I'm really hoping you can help. I followed all the steps to burn the cd you suggested, & I triple checked to make sure it's booting from cd, but it still goes to the repairing windows screen & then the bsod. this is the first time I've ever had to mess with this end & it's confusing. It was the ISO I was supposed to burn correct? I'm running Vista on a Compact Presario F700. I never had a bit of trouble with it until the update. I HAVE to fix this somehow as I refuse to send them my laptop. Any suggestions would be very much appreciated. Thanks, Toni

no comment title

Tom Karpowitz — Fri, 21 Nov 2008 14:36:55 +0100

@Toni: don't launch that laptop just yet. :) Yes, the correct thing to do was burn the ISO to a CD. Assuming you got a complete, uncorrupted download from their web site and had a successful burn to a good piece of media, you should be all set. Of course, if the download, burn, and/or media were bad, your CD won't boot. So my first suggestion is to try to boot the disk in a friend's computer. If it boots successfully, you can safely eliminate the disc as a problem. If it fails, re-download and/or re-burn and try again. If the disc is good, it WILL boot, so if you are still getting the "repairing Windows" screen you are NOT booting from the CD, despite what you may think. :) Double-check the manufacturer's procedure: make sure the CD comes before the hard drive in the boot order settings in the BIOS, sometimes there is a function key you can hit at the BIOS screen to pick/override the boot order, sometimes even if the CD is chosen first you have to hit a key within three seconds to get the system to boot off the CD, etc etc etc.

no comment title

Andy — Mon, 24 Nov 2008 04:16:17 +0100

I found this on the M$ site, http://support.microsoft.com/kb/946084/en-us I've asked for a fix & will report back. Good info Tom but I couldn't get past putting in a backslash to access the $Extend... :'(

no comment title

Andy — Mon, 24 Nov 2008 10:02:29 +0100

I'd been a muppet earlier as I'd left the disk to load & it loaded US keyboard when I needed UK (so be warned to watch the boot sequence). I can't seem to get past the "cd /", "umount /mnt/windows" after successfully removing the $TxfLog file? is there a space after the comma and/or before? Their hotfix is downloadable & I can run it but not on the corrupt HDD as I can't access it, LOL There's also issues with opening their MSU files too so this seems our best option for now until they fix their handy work >:(

no comment title

Andy — Mon, 24 Nov 2008 10:15:26 +0100

Markus you need to put the backslash in like this /mnt/windows/\$Extend dir sorry if you knew that but you typed with it missing in your post so maybe thats your problem? good luck!

no comment title

Andy — Mon, 24 Nov 2008 10:16:51 +0100

oops it seems the forum takes the backslash out (php) ;D

no comment title

Tom Karpowitz — Mon, 24 Nov 2008 10:31:56 +0100

@Andy: Thanks for jumping in and sharing with others! I recently migrated this blog to a new system, so I'll have to look into the (potential) issue of backslashes being removed from comment posts... In the meantime, to answer YOUR question: In step 9, the "cd" and "umount" commands are TWO SEPARATE COMMANDS. So enter them on two different lines. (That wasn't so clever on my part, so I will update the original post/instructions to clarify.)

no comment title

Tom Karpowitz — Mon, 24 Nov 2008 10:48:49 +0100

@Andy: BTW, the problem with KB946084 (which I link to in my article above) is that the hotfix only PREVENTS this problem from occurring in the first place; it can only be applied to a currently-running system. If your system is already experiencing the BSOD (and I doubt you would've found this article if it weren't) the hotfix is worthless to you. :(

no comment title

Andy — Mon, 24 Nov 2008 11:08:47 +0100

yeah I did take a step back & realize Tom, LOL I would make them steps 9, 10 & 11 maybe: 9. cd / 10. unmount /mnt/windows 11. init 6 12. remove cd upon reboot & quickly boot to VISTA DVD (which I missed). I don't think you realize just how important this blog post is right now as it's the [b]ONLY[/b] fix I could find on the net including M$ :o Here's a list that I noted for future reference for myself, I hope it helps others :) STOP ERROR: 0X0000C1F5 QUICK LIST 1. Press ENTER to load the program 2. Choose your keyboard layout within 20 seconds or it defaults to 'US' to load. 3a. ntfs-3g /dev/sda1 mnt/windows 3b. use: ls /dev/hd* or ls dev/sd* to list hard drives if the above doesn't work 4.use: mount -t ntfs-3g /dev/sda1 /mnt/windows -o force (use letter o, not zero) this is required if it says the NTFS system is in use. 5. ls /mnt/windows 6. cd /mnt/windows/\$Extend 7. cd \$RmMetadata 8. ls (should now show the $TxfLog file (note capital L) 9. rm -rf \$TxfLog 10. cd / 11. unmount/mnt/windows 12. init 6 13. replace CD with Vista DVD & boot to repair tools Tom maybe you could edit & add to that? I'm tired now. [u]As for me...[/u] I removed the offending file but rebooted b4 the Vista disk could kick in so I think the file loaded in again :( I'll get back to it tomorrow.

no comment title

Andy — Mon, 24 Nov 2008 11:11:08 +0100

note: step 11 should say "umount" not "unmount" :-*

no comment title

Andy — Thu, 27 Nov 2008 04:06:05 +0100

this fix isn't working for me sadly :( does anyone know where to locate the file to replace it via HHD reader? ps:thanks for the heads up tom

no comment title

CraigE — Sat, 29 Nov 2008 22:00:40 +0100

I can get tostep 6 but it will not let me remove the |$TxfLog file. Any thoughts?

no comment title

CraigE — Sat, 29 Nov 2008 22:19:42 +0100

Also the microsoft Hotfix is useless, how are you supposed to be able to apply it if your computer is getting the blue screen. It will not initiate on boot up USB. Cheers CraigE

no comment title

Tom Karpowitz — Sun, 30 Nov 2008 05:37:06 +0100

@CraigE: Yes, as I wrote above, the hotfix is useless for this situation. It is preventative only and will not fix a system once it has this problem. I realize that right now this comment system is not allowing us to enter backslashes in our comments, but are you really trying to remove [backslash]$TxfLog and not |$TxfLog? When you "ls" in step 6, do you see $TxfLog listed there? If not, you have the wrong partition/disk... If yes, check your typing carefully to be sure you have spaces, $, backslashes, etc all correct and try again.

no comment title

CraigE — Sun, 30 Nov 2008 12:19:59 +0100

Tom, You are a genius Got it sorted, with 4 computers in the house did not realise mine was a 64bit, stupid me.restored it beautifully. You and the Linus utility are A1. Microsoft have had some nasty emails from me, not that it wil make them fix this problem, but hey they need to know. Once again thanks mat Craig from Australia

no comment title

AzureD — Tue, 02 Dec 2008 07:56:56 +0100

I have the same problem. Only it is on the company computer. People are accusing me with putting a virus on it as I was the last person to use it. We got the files from a service that gets lost data for you but when they tried to connect the HD to their Vista PC they got the same error or so I am told so they say it is a virus. If I say nothing then they will format the PC and evidence will be destroyed and I may very well be stuck with the service fee. I can't see how I did anything wrong as I am not stupid and never installed or downloaded anything on that PC. In fact I rarely use it.

no comment title

Tom Karpowitz — Tue, 02 Dec 2008 08:12:52 +0100

@AzureD: This BSOD has nothing to do with any virus/malware, nor is it likely due to any action (or inaction) on your part. This BSOD is caused by a KNOWN BUG IN WINDOWS VISTA (that's why Microsoft has issued the hotfix described in KB946084) and MICROSOFT DOES NOT HAVE A FIX FOR THE PROBLEM (the hotfix is preventative only, it will NOT repair a system that is already experiencing the BSOD). Hooking up such a drive to another Windows system will BSOD that system too, for the same reasons. This is NOT the result of a virus/malware. To the degree that I (and others) have been able to diagnose, the root cause of this problem is the Vista SP1 upgrade process which fails to complete successfully under certain conditions. One result of such a failed upgrade is this BSOD problem. Since the SP1 installation is a Microsoft-recommended maintenance procedure (and, indeed, in some cases it will be installed automatically on your behalf), I'd be hard pressed to imagine how YOU could be proven to be at fault for any problems resulting from SP1 installation. Without casting judgement, it sounds as though the "service company" is taking the same approach to this problem as, say, Dell, HP, and Microsoft support: I don't have a fix for this problem on my "fix list", so "obviously" the "right" thing to do is format/reinstall. If you've bothered to read this post, however, you know that there ARE ways to fix this problem that DO work in MOST cases and DO NOT require as Draconian a "fix" as a format/reinstall. Feel free to share this blog post, and this comment in particular, with your IT staff. They can contact me directly through this site if they have further questions on this issue.

no comment title

AzureD — Wed, 03 Dec 2008 04:16:15 +0100

@Tom: Alright thanks you have been very helpful.

no comment title

RyanP — Wed, 03 Dec 2008 11:38:54 +0100

Just wanted to add a note from my own experience using this method: If you delete $TxfLog and are still getting the BSoD, make sure you're mounting the actual Windows partition. I fixed my friend's Dell notebook from this BSoD, but wasn't paying attention to the partitions. I mounted sda2 and deleted the file, but as it turns out, sda2 is the "RECOVERY" partition! It still contained a $TxfLog file and appeared as a Windows partition, so I didn't realize it wasn't the active Windows partition, which turned out to be sda3 ("OS"). Once I figured out my error, the fix worked like a charm. Thank you.

no comment title

Capt. Kla — Wed, 03 Dec 2008 13:51:12 +0100

This works!! You're awesome. Thank you very much. I also found multiple copies of the $TxfLog file on different partitions. Deleting the one on sda3 did the trick. If you were here I'd be buying you a beer or ten.

no comment title

keith — Sun, 07 Dec 2008 04:33:03 +0100

Have done everything and checked that the file as been deleted. But I still get the BSoD. Have checked to see if there are other partitions but it appears that I only have the one. Is there anything else I can try

no comment title

Tom Karpowitz — Sun, 07 Dec 2008 05:35:50 +0100

@keith: Please post the output from "fdisk -1". Also: is your system disk a RAID array built from multiple physical drives, or just a single drive? Which drive/partition did you actually try to repair?

no comment title

keith — Sun, 07 Dec 2008 06:09:46 +0100

What is "fdisk-1". It is a single drive. sda1

no comment title

Tom Karpowitz — Sun, 07 Dec 2008 06:21:41 +0100

@keith: at the shell prompt, type "fdisk -l" ("eff disk space dash ell"). fdisk is a partition management utility in Linux; "fdisk -l" will list all of the partition(s) on all of the disk(s) on your system. Run the command and type/paste the results in a reply here.

no comment title

keith — Sun, 07 Dec 2008 06:34:22 +0100

device boot start end blocks id system /dev/sda1 1 1256 10088788+ 7 HPFS/NTFS /dev/sda2 * 1257 30402 234108740 7 HPFS/NTFS

no comment title

Tom Karpowitz — Sun, 07 Dec 2008 06:44:01 +0100

@keith: Based on the "fdisk -l" output, your Windows partition is sda2, not sda1. In all likelihood sda1 is a "repair partition" (I'll bet a dollar that this is a Dell machine...?). Perform the repair procedure using sda2 and you should be good to go. BTW, this has happened enough times that I think I will update the instructions to make "fdisk -l" a standard part of the process.

no comment title

keith — Sun, 07 Dec 2008 07:05:35 +0100

I have got to step 14 and am now being asked if I want to use system restore. Should I restore or click cancel

no comment title

Tom Karpowitz — Sun, 07 Dec 2008 07:08:35 +0100

@keith: First try *without* System Restore; let it do "normal" system repair (which, as noted in the instructions, may take 2-3 tries). If that fails, try the System Restore route.

no comment title

keith — Sun, 07 Dec 2008 07:20:10 +0100

"Startup repair cannot repair this computer automatically". So I clicked restart and got !! 0xc0000034 !! 248/89317 (_0000000000000000.cdf-ms). Do I try and reboot from disc again.

no comment title

Tom Karpowitz — Sun, 07 Dec 2008 07:42:02 +0100

NOTE: This "fix" for your problem is just a THEORY. I have NOT tested it on a live system, as I do not have a system which is experiencing the 0xC00000034 problem. If you are desperate to get your machine running again with the existing Vista installation, you can try this... but I cannot guarantee that it will work. It *probably* won't make the situation any worse, but it *might*... There is some speculation that the 0xC00000034 errors are due to botched multi-stage Windows Updates. Unfortunately, once corrupted, the system is impossible to fix. So the theory is that if we can get past the partially-completed Windows Update(s), the system will heal itself, and you can then reapply any missing Windows Updates manually. With all of that in mind, if you are willing to be a lab rat, try this... :) For the purposes of these instructions I will assume Vista is installed on your C: drive at /dev/sda1... if not, adjust appropriately. Please pay attention to upper/lower case etc. 1) Boot your system using the latest SystemRescueCD (v1.04) 2) "ntfs-3g /dev/sda1 /mnt/windows" or "ntfs-3g /dev/sda1 /mnt/windows -o force" as required 3) "cd /mnt/windows/Windows/System32/config" 4) "ls" -- this is where your Registry hives are stored... you should see "COMPONENTS" among the files listed there 5) "chntpw -e COMPONENTS" -- this puts you in a command-line interactive Registry editor with a ">" prompt 6) "ls" -- you will see a list of keys like < CanonicalData >, < Configuration >, etc 7) *IF* that list of keys includes < PendingXmidentifier >, < NextQueueEntryIndex >, and/or < AdvancedInstallersNeedResolving >, we're going to delete those keys... if not, this fix is not applicable and you should try to find a better solution :) and you should go to step 9. 8) Assuming you DO have one or more of the offending keys, type "rdel PendingXmidentifier", "rdel NextQueueEntryIndex", and/or "rdel AdvancedInstallersNeedResolving" as appropriate to recursively remove the offending key(s) 9) "q" to quit chntpw... say yes when asked if the changed hives should be saved 10) "cd /" and "umount /mnt/windows" to unmount the C: filesystem 11) "init 6" to reboot -- remove the CD when appropriate Hopefully this results in a bootable, useable system. After it finishes booting, I'd restart it cleanly, then use Windows Update or Microsoft Update to look for and apply any missing updates. If you try this, PLEASE let me know detailed results. If it is successful, I will post it in my blog. If any of my instructions are unclear, I missed steps, misspelled anything, etc PLEASE correct me, 'cuz if I DO post this I want it to be error-free. Good luck, and let me know how you make out.

no comment title

keith — Sun, 07 Dec 2008 07:49:48 +0100

What does use "rdel PendingX midentifier" etc mean. Or can I just system restore to before I installed SP1

no comment title

Tom Karpowitz — Sun, 07 Dec 2008 07:56:12 +0100

Sorry about the above post -- still working out glitches in JomComment. After steps 5 and 6, if you see the Xmidentifier, NextQueueEntryIndex, and/or AdvancedInstallersNeedResolving keys listed, you need to delete them. For each key, you type "rdel KEYNAME" at the prompt, e.g. "rdel Xmidentifier", "rdel NextQueueEntryIndex", and/or "rdel AdvancedInstallersNeedResolving", to remove the offending keys. Then do steps 9-11. If this procedure fails, you can try System Restore and going to an earlier point in time... but I'd recommend you try this procedure first and let me/us know how you make out.

no comment title

keith — Sun, 07 Dec 2008 08:15:29 +0100

Have found AdvancedInstallersNeedResolving typed in rdel AdvancedInstallersNeedResolving but it says not found. Have I done this right?

no comment title

Tom Karpowitz — Sun, 07 Dec 2008 08:23:50 +0100

I assume you did this after steps 1-7? If so, and if it shows up using "ls" from within chntpw, I can't imagine why you can't rdel if, assuming you are spelling correctly and have upper/lower case exactly right...

no comment title

keith — Sun, 07 Dec 2008 08:35:19 +0100

The line of text reads 4 REG_SZ . Do I need to put Also there is4 REG_SZ first. I presume I leave this alone?

no comment title

keith — Sun, 07 Dec 2008 08:39:00 +0100

For some reason AdvancedInstallersNeedResolving vanished from my post. This is after 4 REG_SZ

no comment title

Tom Karpowitz — Sun, 07 Dec 2008 08:44:54 +0100

Yes, the "4 REG_SZ" is extra data about the key, kinda like the size and time-last-modified if you do a detailed listing of files in a folder. The only part of the display that is relevant here is the key name, which is AdvancedInstallersNeedResolving. So if you "rdel AdvancedInstallersNeedResolving" (with correct spacing, spelling, and capitalization) it SHOULD work...

no comment title

keith — Sun, 07 Dec 2008 08:52:50 +0100

Have tried several times now but it still says "not found". Thanks for your help it looks like I'll have do a restore as it looks like I cannot delete file.

no comment title

Tom Karpowitz — Sun, 07 Dec 2008 08:58:54 +0100

One last try if you don't mind: try "dv AdvancedInstallersNeedResolving" instead of "rdel AdvancedInstallersNeedResolving"...

no comment title

keith — Sun, 07 Dec 2008 09:10:38 +0100

have done this and rebooted. But still get !! 0xcooooo34 !!

no comment title

keith — Sun, 07 Dec 2008 09:22:32 +0100

Thanks for all your help. I am doing a system restore at the moment

no comment title

keith — Mon, 08 Dec 2008 04:40:53 +0100

system restore is still running 12 hours later. Do I leave it to carry on, or start again

no comment title

Tom Karpowitz — Mon, 08 Dec 2008 05:10:22 +0100

System Restore should almost certainly not be taking that long. Suggest that you forcibly restart (power-cycle if necessary), then let the system try to auto-repair... if it doesn't, try the System Restore again.

no comment title

keith — Tue, 09 Dec 2008 03:39:01 +0100

I have tried system restore again, but it gets stuck at "Finalizing file restore...". I tried the repair option before this, but that just gets stuck as well.

no comment title

keith — Tue, 09 Dec 2008 04:29:54 +0100

Is there anything else I can try please. Sorry if i'm being a nuisance :)

no comment title

lady1951 — Tue, 09 Dec 2008 05:31:54 +0100

i have the c1f5 on my laptop what can i do to fix it please help

no comment title

Tom Karpowitz — Tue, 09 Dec 2008 05:41:42 +0100

@Keith: Afraid I can only be of limited additional help here... if I had your system, I would try automatic repair two or three more times... I've seen it take multiple cycles (even incomplete ones) before it was ultimately successful. Besides, if you CAN'T get the system restored, your next step is to reinstall Vista, so you've got nothing to lose by trying... Also, if you haven't already, try using System Restore and go to an "earlier point in time". If all else fails, be grateful that at least now you can boot the Vista DVD without the BSOD! So if nothing works and you have to reinstall, at least you can proceed that by booting SystemRescueCD and use it and its tools, along with a network-mounted share or external USB drive/stick, to back up your valuable data before you reinstall. Good luck!

no comment title

keith — Tue, 09 Dec 2008 05:46:30 +0100

How can I back up my data using SystemRescueCD, as I don't know what tools there are on the disc or how to use them. Many thanks for all your help.

no comment title

Tom Karpowitz — Tue, 09 Dec 2008 05:46:52 +0100

@lady1951: um, what you can do to try to fix your laptop is follow the steps I wrote in this blog post. :) If it happens to be a Dell laptop, at step 2 in the process start by typing "fdisk -l" and look carefully at the sizes of the partitions... Dells include a Restore partition which has Windows files on it but is typically much smaller than your actual C: drive partition. The partition you want is almost always the largest one, and it typically has a "*" next to it in the "fdisk -l" output indicating that it is bootable.

no comment title

Tom Karpowitz — Tue, 09 Dec 2008 06:03:39 +0100

@Keith: The easiest thing to do is get yourself an external hard drive (USB/Firewire/eSATA, whatever you have and whatever ports your computer has). Plug it into a working computer and verify that the disk is formatted in some PC-friendly format (e.g. FAT or NTFS). Then plug it into your damaged PC and boot SystemRescueCD. Make yourself a new mount point: "mkdir /mnt/external". The external drive should be recognized by and useable by the system automatically at boot, so you can mount it (using mount or ntfs-3g depending on if the drive's format is FAT or NTFS) on /mnt/external. Next, mount your Vista partition on /mnt/windows as you have done previously. Now you can either start the GUI (by typing "startx") to use the graphical file explorer or you can use the "cp" (copy) command at the command line to copy files from /mnt/windows/whateverthepathis to /mnt/external... in effect, copying files from your Vista partition to the external drive. When you're done, "umount /mnt/external" and plug the drive into a working computer... you should be able to browse/access your valuable files on it. If you don't use an external drive, you can boot SystemRescueCD, mount your Vista partition, and then mount a network share and copy files to it, use FTP to copy files to the network, use BackUpPC... there are lots of options... and I honestly have neither the time nor the space to describe all of them here. Fortunately, Google is your friend. :) The SystemRescueCD web site has a list of all tools included on the CD.

no comment title

keith — Tue, 09 Dec 2008 06:29:44 +0100

Thankyou for all your time and patience:). I will try this.

no comment title

Elyse — Tue, 09 Dec 2008 12:24:05 +0100

Hi! Ok, I've been working on this for a while.. and I had the same problem Keith had with the !! 0xc0000034 !! 251/89317 (_0000000000000000.cdf-ms). It occurred to me that maybe I rebooted wrong, so I ran the SystemRescueCD again only to find that the $TxfLog file was still there, even after it had been deleted... Any suggestions? After I delete the file, umounnt, init 6, should I let the CD finish, the computer reboot and then take the CD out or what? Thank you very much for your help. This site has been extremely helpful! ;D

no comment title

Elyse — Tue, 09 Dec 2008 12:49:56 +0100

Okay, so a follow up to my last post. I've tried a number of different things and every time that I go back to the SystemRescueCD, the $TxfLog file is there. It's as if it deletes it, but the second my computer turns back on, it loads it again... hmmmm...

no comment title

Theo — Wed, 10 Dec 2008 02:01:32 +0100

I have the same probleme, if deleted it ($TxfLog)on sda1 & sda2 comes allways back on sda1 ... no blue screen instead of that i have a black screen now, DVD is loading but also a black screen :( and if i try to start normal i have an other fault, like Elyse, 0xc0000034 251/67498 ... f*** any suggestions ?!?

no comment title

Tom Karpowitz — Wed, 10 Dec 2008 05:01:42 +0100

Trying to keep $TxfLog off your system once it's past the 0x0000C1F5 BSOD is like trying to keep the sun from coming up in the morning... won't happen. $TxfLog is a standard file used by the NTFS transactional file system and you should expect to find it on every properly-working Vista system. The reason you had to delete it to solve the BSOD that initially lead you to this blog (I assume) is that it was corrupted. Once you get past the 0x0000C1F5 BSOD you should not try to delete $TxfLog any more. :) If you are experiencing the !!0xc00000034 !! "black screen of death", that is a completely separate issue and is unrelated to $TxfLog. If you go back about 12 comment postings or so you will see a discussion thread I had with Keith wherein I described this problem and a *POSSIBLE* solution. If any of you are willing to try that procedure and share your results here that'd be keen.

no comment title

Theo — Wed, 10 Dec 2008 06:32:56 +0100

I tried it, didn't work because the only key i found was "PendingXmidentifer" rdel it / didn't work to delete it :( , sry ... I saved the files like you explained to @Keith but with the "Midnight Commander" and F6 (move to) external,it took a while till i found out ... but it worked !! Thx a lot I had to reinstall but i could rescue the files ;) Its working now ;)

no comment title

Adam — Wed, 10 Dec 2008 21:58:49 +0100

Thank you so much, you are the man!

no comment title

SDream — Sat, 13 Dec 2008 20:48:20 +0100

First I would like to say that you did a wonderful job figuring this all out. It took me a couple of tries but I finally got through all the code and put in my Vista disk. I just have one simple question. At least I hole its simple. I am working with the Startup Repair. I know you said it could take 5 - 23 or more tries to get this to work. When I run it, I get "Startup Repair could not detect a problem". I click on finish and I got back to the System Recovery Options. Its not asking me to reboot. So do I have to reboot between each try of the Startup Repair? I just need to know that I am doing this right. I have read about 80% of the posts here. So if I just havent gotten to a post where someone asks this, I am sorry. I just have been working on this laptop for almost a month now. I am so close to fixing it, and I hit another wall. I would like to finally get it working again. Thank you again for all your help. SDream

no comment title

Tom Karpowitz — Sun, 14 Dec 2008 05:58:48 +0100

@SDream: Well, first an obvious question: if Startup Repair couldn't find any problem, did you try booting the system normally (from the hard drive) to see if the system is already fixed? I'm presuming that you HAVE successfully eliminated the 0x0000C1F5 BSOD at this point, so if your system won't boot from the hard drive it must be failing for another reason... so try booting from the hard drive and describe the results here.

no comment title

Tom — Fri, 19 Dec 2008 20:47:34 +0100

You are amazing! It just fixed my Dell laptop. I called Dell support and they suggested replacing mobo, HDD and RAM which I knew was wrong. No wonder they could not make money off that much revenue.

no comment title

Greg — Sun, 21 Dec 2008 05:56:15 +0100

Thanks very much for this info, Tom. This is easily the nastiest Vista-related issue I've had yet. Actually, I didn't have any Vista issues to speak of prior to installing SP1 and it's been a nightmare ever since. The steps and info you provided above helped me get back into my system! I'm currently on the 4th attempt to get Vista to restore through the Vista DVD. It keeps hanging at the "Attempting repairs..." screen. I let it run overnight, but it's still just hanging there. I'll attempt it a few more times to see if I can finally convince it to do what I want it to do, but I still appreciate the assistance with being able to even get back to this point in the first place.

no comment title

Greg — Mon, 22 Dec 2008 05:03:57 +0100

Issue resolved! Huzzah! When I tried to restore the system from the repair screen (the Vista DVD reported that a problem had been found, was unable to repair it, and asked if I wanted to restore from a previous time) I simply got looped into a repair cycle that kept hanging on “finalizing restore” (or something to that effect). The next time I hit cancel when asked if I wanted to restore and I was brought to the main system repair/restore screen. I selected the “Complete PC backup restore” option and the first time through I also got stuck on the “finalizing restore” dialogue box. The second time through I had to check the box that said something to the effect of “format disk and copy backup partition” – I forget exactly how it was worded, but it sounds like that in the process of restoring from the backup, the restore process also reformatted the HDD. Worked like a charm. Got through that with no issues and my machine was back up and running in no time. Thanks again for this great post, Tom. I couldn’t have done it without your assistance! (And, yes, I put a copy of the SystemRescue CD in a safe place!)

no comment title

EB — Wed, 24 Dec 2008 15:33:07 +0100

Hi, I booted my rescue cd but I got this error INIT: cannot execute "/sbin/agetty" INIT: Id "c1" respawning too fast disabled for 5 minutes INIT: Id "c2" respawning too fast disabled for 5 minutes INIT: Id "c3" respawning too fast disabled for 5 minutes INIT: Id "c4" respawning too fast disabled for 5 minutes INIT: Id "c5" respawning too fast disabled for 5 minutes INIT: Id "c6" respawning too fast disabled for 5 minutes Help please! And Merry Christmas!

no comment title

Tom Karpowitz — Wed, 24 Dec 2008 17:37:01 +0100

@EB: the only possible explanation I'd have for those kinds of errors is an issue with the CD itself, i.e. either a good burn of a bad download or a bad burn of a good download. Try re-downloading the SystemRescueCD image, burning on another piece of media, testing your burned disc in another computer, etc.

no comment title

EB — Wed, 24 Dec 2008 17:59:46 +0100

I tried the disc in another computer, it boots with no errors. So what is the problem?

no comment title

Tom Karpowitz — Wed, 24 Dec 2008 18:14:20 +0100

@EB: Sorry, but then I have no other brilliant ideas for you, other than you may have faulty hardware. I have never seen that type of error returned when booting SystemRescueCD. Best of luck getting this fixed, and Happy Holidays regardless. (I'm off to midnight mass.)

no comment title

EB — Wed, 24 Dec 2008 18:28:32 +0100

Thanks anyway. Happy holiday!:'(:'(

no comment title

Lody — Sat, 27 Dec 2008 03:48:13 +0100

Thank you thank you thank you!!!!! It works for me....whoohoo!!! Happy New Year Greetz from Holland

no comment title

Amer — Sun, 28 Dec 2008 07:18:32 +0100

Don't know if you're still watching this thread Tom ,but anyway. I do what u say and what Andy says up to step 5 (in his list). However, in the list I can't seem to find the $Extend folder? It's definitly the right partition because its the only one thats ntfs and hat i can mount.Please reply soon! This is my Aunt's PC and she'll kill me if I don't get it fixed!

no comment title

Tom Karpowitz — Sun, 28 Dec 2008 07:49:47 +0100

@Amer: There is a flaw in Andy's post... the $Extend folder is a hidden folder, and will not show up when you use "ls" to list the contents! But if you have the correct partition mounted, it WILL be there -- trust me. :) Follow my directions from step 4. Notice that the $Extend folder has a backslash in front of it in the file path -- MAKE SURE YOU TYPE THIS. The $ is part of the file name, and if you don't escape it from the shell using the backslash, it will get dropped, "$Extend" will be interpreted as just "Extend", and it will NOT be found.

no comment title

Amer — Sun, 28 Dec 2008 08:41:22 +0100

Ahh it as the backslashes i was forgetting. But I ended up getting that 0xc000034 thing. I'm trying to copy all my files to my memory stick before I format, but I can't mount it properly, and I don't know how to use the GUI to copy files, and I can't remember the file paths of my stuff.

no comment title

Amer — Sun, 28 Dec 2008 09:19:39 +0100

OK forget that. Do you know what I have to put in to transfer everything in documents and settings to my memory stick?

no comment title

Tom Karpowitz — Sun, 28 Dec 2008 11:23:12 +0100

@Amer: Insert your USB stick into a port and then boot SystemRescueCD. During the boot process, you should see the USB stick detected as a hard disk (like /dev/sda1 or /dev/sdb1 or whatever)... if you miss that, once you get a shell prompt you can type "dmesg | less" and page through the boot messages (hit spacebar to see the next screenfull) until you see the detection of the USB stick and its assignment to a name. Make note of the name. Next, mount your NTFS Windows partition on /mnt/windows as you did previously. Next, make a new mount point on which to mount your USB stick: "mkdir /mnt/usb". Then mount the USB stick at that mount point. If, for example, the boot dialog showed the stick at /dev/sdb1, you would type "mount /dev/sdb1 /mnt/usb". Now cd "/mnt/windows/Documents and Settings" (quotes are required because Documents and Settings has spaces in it) Now, for user Fred, you can "cp -r Fred /mnt/usb". This will recursively copy the Fred folder and all of its contents to /mnt/usb (i.e. your USB stick). Use cp (for single files) and "cp -r" (for folder hierarchies) to copy whatever you want to save to /mnt/usb. When finished, "cd /mnt/usb" and "ls" to verify that the stuff you want to save has been copied to the USB stick. Next, "cd /", then "umount /mnt/windows", then "umount /mnt/usb" to cleanly unmount the Windows partition and USB stick. Next, "init 0" to shut down the computer. Finally, take the USB stick to another computer and verify that it has all of the files you wanted to save on it. If not, repeat this procedure and add additional files as necessary.

no comment title

Robert — Sun, 28 Dec 2008 18:09:09 +0100

Thank you very much Tom!! Following your instructions with no real Linux experience or understanding, I was able to get my in-laws' HP Pavilion Slimline back up and running from the C1F5 error. However, I too kept getting the !! 0xc0000034 !! 248/89317 (_0000000000000000.cdf-ms)error that Keith and others had. Seeing that Keith and another poster were not able to get past that BSOD with your theoretical try, I decided not to even try that myself, especially since very little would be lost with a full reformat. I copied the User documents to a USB device and then went through the system recovery steps. At that point, I was given the option to go to a restore point just prior to the failed SP1 update and low and behold, that worked!! The question I have is do I need to install the hotfix from Microsoft now, prior to Vista wanting to install SP1 again? Thanks again for all your help.

no comment title

Tom Karpowitz — Sun, 28 Dec 2008 18:28:40 +0100

Now that you have a working system (and a backup of the crucial files on USB stick), apply the hotfix, then apply SP1, and you SHOULD be good to go.

no comment title

Jeremy — Mon, 29 Dec 2008 10:08:40 +0100

I tried this workaround only to have run into a dead end. When I went to remove the \$TxfLog folder, it tells me that "cannot remove.. Read only file system. Any ideas?

no comment title

Tom Karpowitz — Mon, 29 Dec 2008 10:22:28 +0100

@Jeremy: First, I assume that you mounted the partition using "ntfs-3g" and not the standard Linux "mount" command... "mount"ing an NTFS filesystem will result in a read-only mount, you MUST use ntfs-3g to do read-write. If you were using ntfs-3g, make sure you have "-o force" at the end of the mount command in step 2. If you still end up with a read-only mount, post the output from "fdisk -l" here and we'll check a few more things.

no comment title

Jeremy — Mon, 29 Dec 2008 12:47:15 +0100

Thanks, your tip worked very well. The only problem I have now is that Vista is stuck in the endless loop of trying to installed part 3 of 3 of service pack 1. Blah, I hate Vista!

no comment title

Andy — Mon, 29 Dec 2008 20:15:34 +0100

Thanks a lot. Your solution worked just fine. Deleted \$TxfLog from both partitions then Vista fixed automatically this boot problem by choosing this choice at startup and bypassing system restore when asked. After that Vista tried to finish installation of SP but it couldn't because of an error but it reverted all files and system setting to previous state. Problem solved without formatting. :D

no comment title

Miguel Q — Tue, 30 Dec 2008 13:00:57 +0100

I have a laptop Dell Inspiron 1526, with a D: partition for recovery. I tried to mount sda1 and hda1 but none of them worked, then I tried sda2 and apparently it mounted it as I was able to change directories and delete $TxfLog file per your instructions. However I'm still getting the BSOD with same error 0x0000C1F5. :( Any ideas?

no comment title

Tom Karpowitz — Tue, 30 Dec 2008 15:20:20 +0100

@Miguel: Most Dells I have seen recently have a recovery partition on partition 2 (e.g. sda2) and the actual Windows partition on partition 3 (e.g. sda3). Once you boot to the command prompt, type "fdisk -l" and look at the list of partitions. One of the NTFS partitions should be significantly larger than the others and should be marked with a "*" indicating that it is the boot partition. THAT is the partition you want to fix using this procedure.

no comment title

Wonderful!!! — Wed, 31 Dec 2008 04:30:59 +0100

Thanks a lot for this very very helpful article. I was pointed out to the original version which had some typos but nevertheless it solved this problem straight away! Where would I be w/o the Internet... BTW, as you already may have discovered some systems (including mine) do not need step 2 (repair).:)

no comment title

thomas — Wed, 31 Dec 2008 06:31:56 +0100

Well I got as far as running sysreccd and getting into the 2nd hidden file, but when i try and delete the txflog file, it gives me an error saying that i am unable to do that because its read only. Can you tell me the commands in linux so i can mount the partition as r/w? is that even posssible? I am a complete noob to linux so any advice would be awesome thanks.

no comment title

thomas — Wed, 31 Dec 2008 06:34:44 +0100

nevermind just read your laast reply sorry