Windows Vista and STOP: 0x0000C1F5

You know your in for a rough ride when the only advice you can find for a BSDO is to back up all data and format your drive. B.S.!

Working on a HP pc with windows Vista home, the customer was receiving a BSOD
0x0000c1f5

Hmm maybe an easy fix.. Yeah right.

What MSKB had to say..

SYMPTOMS
When you start a Windows Vista-based computer, you receive the following Stop error message on a blue screen:
0xC1F5

CAUSE
This issue occurs because the Common Log File System (Clfs.sys) driver does not fix the $TxfLog file when the file is corrupted. In addition to the Stop error message, Windows Vista may not start during startup until the offending disk is removed from the computer.

(TRANSLATION) Vista is buggy as hell.

WORKAROUND
To work around this issue, use one of the following methods.

Method 1

If you have multiple disks installed, and the disk on which the $TxfLog file is corrupted does not contain Windows Vista, remove the offending disk from the computer.

Method 2

If you have only one disk installed, and if you have access to Windows XP or Windows 2000 installation media, restart the computer by using the Windows XP or Windows 2000 installation media. Next, format the offending disk, and then reinstall Windows Vista.

(TRANSLATION) We screwed up please reinstall Vista.

(Method 3) See below

Note Microsoft is working on a fix to prevent this problem.

STATUS
Microsoft is researching this problem and will post more information in this article when the information becomes available.

(TRANSLATION) WTF Vista is suppose to be better?

——————————————————————
Looks like this is a screw up on part of MS and Vistas SP1
Thank God for Linux

Workaround for STOP 0x0000C1F5 / 0xC1F5 / C1F5 / BSOD / CLFS.SYS / KB946084

Last night, I did something stupid on my primary desktop computer (a Vista box) and needed to restore the system to a recent backup. I use Windows Home Server on my home network, so I was confident in my ability to roll back the system to a previous night’s backup. I booted my machine using the WHS Client Restore CD, chose the appropriate backup, waited (im)patiently for about two hours while the bits were restored, the system rebooted…

…and that’s when I saw the Blue Screen of Death… specifically, a STOP 0x0000C1F5. Shit.

Now, my first instinct was that I had a sketchy backup image in WHS, and perhaps I should try a slightlly older one. I repeated the restore process with three older backups and got the same result. On the verge of going off on a major “WHS sucks” tirade, I instead opted for some Googling on a still-working system to see if I could find any clues. It seems as though the frequency of reports of STOP 0x0000C1F5 problems is increasing, with most people attributing the issue to a bad Vista SP1 (or prepare-for-SP1) update or patch. Microsoft acknowledges the problem in KB946084, but there is no public hotfix or workaround save for “clear the MBR and reinstall”, which IMHO is unacceptable.

Looking at the problem a little more closely, it seems that if the $TxfLog file is corrupted, the Common Log File System Driver shits the bed at boot time, causing the BSOD. The particularly nasty thing about this problem is that you cannot even boot the Vista distribution DVD to use its repair tools; the BSOD occurs when you boot from DVD too! Basically, it crashes whenever a Windows box tries to mount the file system.

Soooo… a fix might be possible by accessing the disk using an operating system that doesn’t give a rat’s ass about Windows file systems (e.g. Linux).

At this point, I broke out one of my favorite sysadmin tools, SystemRescueCD. This is a Linux-based live distro that has all sorts of diagnostic and repair goodies on it. I figured that if I booted the SystemRescueCD disk, I might be able to diagnose, and maybe even repair, the problem.

(Unsolicited plug alert: take a minute to download SystemRescueCD, burn a copy, and add it to your sysadmin bag of tricks. The folks who make and maintain this disc do a helluva good job… it has saved my bacon more than once. Check it out.)

So, here’s an overview of how I fixed my system. For part 1, you need a SystemRescueCD disc (and don’t forget that Linux commands are case-sensitive):

1. Boot the SystemRescueCD disc, answering any localization questions as required, until you get to a command prompt.
2. Mount your hard drive at /mnt/windows using ntfs-3g, e.g. “ntfs-3g /dev/sda1 /mnt/windows”. You may have to look at /dev/hd* and /dev/sd* to figure out the correct device to mount. Also, if the NTFS file system is corrupted (which it probably is if you are reading this post) you may have to add the “-o force” flag to the mount, e.g. “ntfs-3g /dev/sda1 /mnt/windows -o force”.
3. Verify that you have the correct file system mounted by “ls /mnt/windows”. You should see the content of “C:”… if you don’t, repeat (2) until you mount the correct device.
4. Navigate to the hidden folder: “cd /mnt/windows/$Extend/RmMetadata”. Note the backslash before the $; that is important as it keeps the command shell from interpreting the $ (it is really part of the file name).
5. Take a deep breath and recursively remove the $TxfLog file: “rm -rf $TxfLog”. Use “ls” to verify that it has been deleted.
6. “cd /”, “umount /mnt/windows”, and “init 6” to reboot, removing the CD when appropriate.

At this point, your system will no longer bluescreen, but it won’t boot, either. To fix that, here’s part 2, for which you’ll need a Vista DVD:

7. Boot the Vista DVD and choose “Repair my computer”.
8. When the system looks for Vista installations to repair, it probably won’t find any. Don’t panic; just click Next.
9. In the System Recovery Options list, choose Startup Repair. The system will process for a minute or two, then state that it needs to reboot to finish its repair. Allow it to reboot.
10. Remove the DVD at the appropriate time and allow the system to boot from the hard drive.
11. If the system complains that it was not shut down properly, choose “boot normally”.

That’s it. With any luck at all you should have a bootable system again.

The STOP 0x0000C1F5 bug is a nasty one, and I am confident that Microsoft will release a hotfix and/or Windows Update for it soon. In the meantime, if you are experiencing the problem, I hope this article helps to get you running again.