Workaround for STOP 0x0000C1F5 / 0xC1F5 / C1F5 / BSOD / CLFS.SYS / KB946084
Posted by: Tom Karpowitz in WHS, Vista on Mar 31, 2008
Last night, I did something stupid on my primary desktop computer (a Vista box) and needed to restore the system to a recent backup. I use Windows Home Server on my home network, so I was confident in my ability to roll back the system to a previous night's backup. I booted my machine using the WHS Client Restore CD, chose the appropriate backup, waited (im)patiently for about two hours while the bits were restored, the system rebooted...
...and that's when I saw the Blue Screen of Death... specifically, a STOP 0x0000C1F5. Crap.
Now, my first instinct was that I had a sketchy backup image in WHS, and perhaps I should try a slightly older one. I repeated the restore process with three older backups and got the same result. On the verge of going off on a major "WHS sucks" tirade, I instead opted for some Googling on a still-working system to see if I could find any clues. It seems as though the frequency of reports of STOP 0x0000C1F5 problems is increasing, with most people attributing the issue to a bad Vista SP1 (or prepare-for-SP1) update or patch. Microsoft acknowledges the problem in KB946084, but there is no public hotfix or workaround save for "clear the MBR and reinstall", which IMHO is unacceptable.
Looking at the problem a little more closely, it seems that if the $TxfLog file is corrupted, the Common Log File System Driver wigs out at boot time, causing the BSOD. The particularly nasty thing about this problem is that you cannot even boot the Vista distribution DVD to use its repair tools; the BSOD occurs when you boot from DVD too! Basically, it crashes whenever a Windows box tries to mount the file system.
Soooo... a fix might be possible by accessing the disk using an operating system that doesn't depend upon Windows file systems (e.g. Linux).
At this point, I broke out one of my favorite sysadmin tools, SystemRescueCD. This is a Linux-based live distro that has all sorts of diagnostic and repair goodies on it. I figured that if I booted the SystemRescueCD disk, I might be able to diagnose, and maybe even repair, the problem.
(Unsolicited plug alert: take a minute to download SystemRescueCD, burn a copy, and add it to your sysadmin bag of tricks. The folks who make and maintain this disc do a helluva good job... it has saved my bacon more than once. Check it out.)
So, here's an overview of how I fixed my system. For part 1, you need a SystemRescueCD disc. Don't forget that Linux commands are case-sensitive, so pay careful attention to upper and lower case letters and spaces between items on the command line. Also note that several of these file names contain dollar signs ($), and the $ must be escaped from interpretation by the shell by preceding it immediately with a backslash (\), e.g. "\$foo" when referring to a file named $foo.
- Boot the SystemRescueCD disc, answering any localization questions as required, until you get to a shell prompt.
- Mount your hard drive at /mnt/windows using ntfs-3g, e.g. "ntfs-3g /dev/sda1 /mnt/windows". You may have to "ls /dev/hd*" or "ls /dev/sd*" or "fdisk -l" to figure out the correct device to mount. If you are using a RAID device for your root file system, run "dmraid -ay" to attempt to mount all available RAID file systems, then "ls /dev/mapper" and look for your device. Also, if the NTFS file system is corrupted (which it probably is if you are reading this post) you may have to add the "-o force" flag to the mount, e.g. "ntfs-3g /dev/sda1 /mnt/windows -o force".
- Verify that you have the correct file system mounted by "ls /mnt/windows". You should see the content of "C:" or whatever is your boot drive in Windows... if you don't, repeat Step 2 until you mount the correct device.
- Navigate to the first hidden folder: "cd /mnt/windows/\$Extend". Note the backslash before the $; that is important as it keeps the command shell from interpreting the $ (it is really part of the file name).
- Navigate to the second hidden folder: type "cd \$RmMetadata". Once again, note that the $ is escaped with a backslash.
- Type "ls". Among the files/folders listed you should see "$TxfLog".
- Take a deep breath and recursively remove the $TxfLog file: "rm -rf \$TxfLog". Once again, note that the $ is escaped with a backslash.
- Use "ls" to verify that it has been deleted. (You should see the same listing as in Step 6 except the $TxfLog folder is now missing.)
- Type "cd /"
- Type "umount /mnt/windows" to cleanly unmount your NTFS filesystem.
- Type "init 6" to reboot, removing the CD when appropriate.
At this point, your system will no longer bluescreen, but it may not boot, either. To fix that, here's part 2, for which you'll need a Vista DVD.
- Boot the Vista DVD and choose "Repair my computer".
- When the system looks for Vista installations to repair, it probably won't find any. Don't panic; just click Next.
- In the System Recovery Options list, choose Startup Repair. The system will process for a minute or two, then state that it needs to reboot to finish its repair. Allow it to reboot.
- Remove the DVD at the appropriate time and allow the system to boot from the hard drive.
- If the system complains that it was not shut down properly, choose "boot normally".
- You may have to repeat steps 12-16 up to five times to "convince" the system to rebuild itself. If the system gets "stuck" during the rebuild process for more than an hour or so, force it to reboot (hit the reset switch or power-cycle the system) and try again.
That's it. With any luck at all you should have a bootable system again.
The STOP 0x0000C1F5 bug is a nasty one, and I am confident that Microsoft will release a hotfix and/or Windows Update for it soon. In the meantime, if you are experiencing the problem, I hope this article helps to get you running again.
Actually, this bloody laptop had two partitions and I had deleted the wrong $TxfLog from wrong partion ;-(
Beside that your advice worked on my when I realized that I need to get to sda2 ;-)
Still have some problems but now can get the Vist DVD working
thanks a lot
and all the best Tom
Thanks again ;-)
Pete
.
S.
--> here's the site: http://bsods.com/content/windo...nux-anyone
i had to do this on my hp pavillion 6700 win64 home ultimate notebook.
once i made it to this page and saw step 4 i knew it was going to work.. i feel kinda bad now for not making a youtube vid to help others on going through the process of fixing this problem.
thanks a ton man.
Thanks,
Toni
I've asked for a fix & will report back. Good info Tom but I couldn't get past putting in a backslash to access the $Extend...
I can't seem to get past the "cd /", "umount /mnt/windows" after successfully removing the $TxfLog file? is there a space after the comma and/or before?
Their hotfix is downloadable & I can run it but not on the corrupt HDD as I can't access it, LOL There's also issues with opening their MSU files too so this seems our best option for now until they fix their handy work
9. cd /
10. unmount /mnt/windows
11. init 6
12. remove cd upon reboot & quickly boot to VISTA DVD (which I missed).
I don't think you realize just how important this blog post is right now as it's the ONLY fix I could find on the net including M$
Here's a list that I noted for future reference for myself, I hope it helps others
STOP ERROR: 0X0000C1F5 QUICK LIST
1. Press ENTER to load the program
2. Choose your keyboard layout within 20 seconds or it defaults to 'US' to load.
3a. ntfs-3g /dev/sda1 mnt/windows
3b. use: ls /dev/hd* or ls dev/sd* to list hard drives if the above doesn't work
4.use: mount -t ntfs-3g /dev/sda1 /mnt/windows -o force (use letter o, not zero) this is required if it says the NTFS system is in use.
5. ls /mnt/windows
6. cd /mnt/windows/$Extend
7. cd $RmMetadata
8. ls (should now show the $TxfLog file (note capital L)
9. rm -rf $TxfLog
10. cd /
11. unmount/mnt/windows
12. init 6
13. replace CD with Vista DVD & boot to repair tools
Tom maybe you could edit & add to that? I'm tired now.
As for me...
I removed the offending file but rebooted b4 the Vista disk could kick in so I think the file loaded in again
I'll get back to it tomorrow.
does anyone know where to locate the file to replace it via HHD reader? ps:thanks for the heads up tom
Cheers
CraigE
You are a genius Got it sorted, with 4 computers in the house did not realise mine was a 64bit, stupid me.restored it beautifully. You and the Linus utility are A1. Microsoft have had some nasty emails from me, not that it wil make them fix this problem, but hey they need to know.
Once again thanks mat
Craig from Australia
If I say nothing then they will format the PC and evidence will be destroyed and I may very well be stuck with the service fee. I can't see how I did anything wrong as I am not stupid and never installed or downloaded anything on that PC. In fact I rarely use it.
If you delete $TxfLog and are still getting the BSoD, make sure you're mounting the actual Windows partition.
I fixed my friend's Dell notebook from this BSoD, but wasn't paying attention to the partitions. I mounted sda2 and deleted the file, but as it turns out, sda2 is the "RECOVERY" partition! It still contained a $TxfLog file and appeared as a Windows partition, so I didn't realize it wasn't the active Windows partition, which turned out to be sda3 ("OS").
Once I figured out my error, the fix worked like a charm. Thank you.
I also found multiple copies of the $TxfLog file on different partitions. Deleting the one on sda3 did the trick.
If you were here I'd be buying you a beer or ten.
/dev/sda1 1 1256 10088788+ 7 HPFS/NTFS
/dev/sda2 * 1257 30402 234108740 7 HPFS/NTFS
!! 0xc0000034 !! 248/89317 (_0000000000000000.cdf-ms).
Do I try and reboot from disc again.
rdel AdvancedInstallersNeedResolving but it says not found. Have I done this right?
I presume I leave this alone?
and if i try to start normal i have an other fault, like Elyse, 0xc0000034 251/67498 ... f*** any suggestions ?!?
rdel it / didn't work to delete it
, sry ... I saved the files like you explained to @Keith
but with the "Midnight Commander" and F6 (move to) external,it took a while till i found out ... but it worked !! Thx a lot
I had to reinstall but i could rescue the files
Its working now
SDream
I'm currently on the 4th attempt to get Vista to restore through the Vista DVD. It keeps hanging at the "Attempting repairs..." screen. I let it run overnight, but it's still just hanging there. I'll attempt it a few more times to see if I can finally convince it to do what I want it to do, but I still appreciate the assistance with being able to even get back to this point in the first place.
INIT: cannot execute "/sbin/agetty"
INIT: Id "c1" respawning too fast disabled for 5 minutes
INIT: Id "c2" respawning too fast disabled for 5 minutes
INIT: Id "c3" respawning too fast disabled for 5 minutes
INIT: Id "c4" respawning too fast disabled for 5 minutes
INIT: Id "c5" respawning too fast disabled for 5 minutes
INIT: Id "c6" respawning too fast disabled for 5 minutes
Help please! And Merry Christmas!
It works for me....whoohoo!!!
Happy New Year
Greetz from Holland
I do what u say and what Andy says up to step 5 (in his list). However, in the list I can't seem to find the $Extend folder? It's definitly the right partition because its the only one thats ntfs and hat i can mount.Please reply soon! This is my Aunt's PC and she'll kill me if I don't get it fixed!
I tried to mount sda1 and hda1 but none of them worked, then I tried sda2 and apparently it mounted it as I was able to change directories and delete $TxfLog file per your instructions. However I'm still getting the BSOD with same error 0x0000C1F5.
Any ideas? BTW, as you already may have discovered some systems (including mine) do not need step 2 (repair).
How good it is- backups are running again...
Btw my main prio is to save my photos.
When I try to mount my windows partition I get an error msg saying:
$MFTMirr does not match $MFT (record 0).
Failed to mount '/dev/sda1': Input/output error
NTFS is either inconsistent, or you have hardware faults, or you have a SoftRAID/FakeRaid hardware. In the first case run chkdsk /f on Windows
then reboot into Windows TWICE. The usage of the /f parameter is very important! If you have SoftRaid/FakeRAID then first you must activate
it and mount a different device under the /dev/mapper/ directory, (e.g.
/dev/mapper/nvidia_eahaabcc1). Please see the 'dmraid' documantation
for the details.
First off I know I'm not using RAID, it's a single HDD, heck I even tried using dmraid for fun, it wouldn't work. I also can't run chkdsk /f because with this BSoD error, I can't get to a command prompt. Any suggestions to what caused this and how can I resolve this so I can continue onto the next step.
I have used the "fdisk -l" cmd and I know it's 'sda1' because that's the boot partition and it has the most blocks. Their is a /dev/sda3 but I believe that's the HP Recovery partition. I also did try the ntfs-3g cmd with the "-o force" option. Neither one worked. I did some research with Google and found the "ntfsfix" command and typed in "ntfsfix /dev/sda1" and it seems to work.
Just an update for you. The ntfsfix command worked out, I was able to continue with your fix. No more BSoD, however, Vista would always start up in "Startup Repair" I would continue this startup repair process to only have it fail. Once I checked out why the repair failed, due to "The operating system version is incompatible with startup repair" I forgot to mention I do not have a Vista DVD, and the Recovery Console started up off the boot hdd. I was able to try some advanced options like System Restore. I ran into more problems when trying the restore, it said I had disk errors (could they be due to ntfsfixer?) I would run the Disk checking utility, only to have it stop half way and go back to the previous menu like nothing happened. After some reboots, and performing the System Restore with the error msg of my disk had errors, I tried several times before the disk checking would follow through and finish it's task. I have been able to now restore to BEFORE this OS decided to install SP1.
Thank you very much Tom for being able to solve this problem withOUT a full system reformat. Cheers!

Assuming you DO have one or more of the offending keys, type "rdel PendingXmidentifier", "rdel NextQueueEntryIndex", and/or "rdel AdvancedInstallersNeedResolving" as appropriate to recursively remove the offending key(s)
Thanks to your post I have just managed to delete the $TxfLog but it did not solve the problem with the BSOD ;-(
Is there any other work around to safe the system?
Can you advice?
Regards
Piotr