Endpoint Protection

 View Only
  • 1.  BSOD - Registry read failure - Cannot load hive (file): \SystemRoot\System32\Configure\Software

    Posted Jan 22, 2013 05:33 AM

    One of our customer is experiencing below bugcheck with SEP 11.0.7200.11.47 is installed.

    +++++++++++++++++++++++++++++++++++++++++++..

    STOP: c0000218 {REGISTRY FILE FAILURE}
    Cannot load hive (file): \SystemRoot\System32\Configure\Software

    +++++++++++++++++++++++++++++++++++++++++++

    I am posting this as many guys have complained about similar issue on windows XP as mentioned below link :

    https://www-secure.symantec.com/connect/forums/sep-11-mr4-bsod?page=0#comment-3606721

    Singificant one is case number  312-156-857.  I just want to know status of this case. I have crash dump as well and call stack shows

    bbb9f864 80498f04 c0000218 00000001 00000001 nt!ExpSystemErrorHandler+0x530 (FPO: [Non-Fpo])
    bbb9fa38 80499501 c0000218 00000001 00000001 nt!ExpRaiseHardError+0xbe (FPO: [Non-Fpo])
    bbb9faa8 80519fc0 c0000218 00000001 00000001 nt!ExRaiseHardError+0x14d (FPO: [Non-Fpo])
    bbb9fc28 8051ddda bbb9fc9c bbb9fd18 00000000 nt!CmpInitializeHiveList+0x1ac (FPO: [Non-Fpo])
    bbb9fc44 805176f6 bbb9fc54 80517664 00000001 nt!CmpWorker+0x68 (FPO: [Non-Fpo])
    bbb9fc90 80468389 00000000 00000000 88fd4301 nt!NtInitializeRegistry+0x92 (FPO: [Non-Fpo])
    bbb9fc90 8043199b 00000000 00000000 88fd4301 nt!KiSystemService+0xc9 (FPO: [0,0] TrapFrame @ bbb9fc9c)
    bbb9fd0c 80517684 00000000 80517664 00000000 nt!ZwInitializeRegistry+0xb (FPO: [1,0,0])
    bbb9fd58 80468389 00000000 00000000 00000000 nt!NtInitializeRegistry+0x20 (FPO: [Non-Fpo])
    bbb9fd58 77f8858b 00000000 00000000 00000000 nt!KiSystemService+0xc9 (FPO: [0,0] TrapFrame @ bbb9fd64)
    0015fe7c 48584a4c 00000000 77fa946c 00000000 ntdll!ZwInitializeRegistry+0xb (FPO: [1,0,0])
    0015fec8 48584748 0015ff40 00162434 00000000 smss!SmpLoadDataFromRegistry+0x2d3 (FPO: [Non-Fpo])
    0015ff14 48588d3a 0015ff40 0015ff94 00162434 smss!SmpInit+0x1b7 (FPO: [Non-Fpo])
    0015ffb4 485899cb 00000001 00162420 00162428 smss!main+0x6c (FPO: [Non-Fpo])
    0015fff4 00000000 7ffdf000 000000c8 00000100 smss!NtProcessStartup+0x18d (FPO: [Non-Fpo])

    Please suggest a way and i can share the dump..

     

    Regards,

    Suresh 



  • 2.  RE: BSOD - Registry read failure - Cannot load hive (file): \SystemRoot\System32\Configure\Software

    Posted Jan 22, 2013 05:49 AM

    One more data point  : This crash happens on reboot and booting from safe mode works. I see that safe mode does not load SEP drivers which indicates machine would come with minimal functionality.



  • 3.  RE: BSOD - Registry read failure - Cannot load hive (file): \SystemRoot\System32\Configure\Software

    Posted Jan 22, 2013 05:55 AM

    If you have a case number already you're much better off calling Tech Support and citing the reference over the phone, you'll get put straight through to the engineer assigned to the case



  • 4.  RE: BSOD - Registry read failure - Cannot load hive (file): \SystemRoot\System32\Configure\Software

    Posted Jan 22, 2013 05:57 AM

    I would recommed opening a case with symantec support for the data dump analysis. The old case as you mentioned was applying to the 11 MR which is really old. As you are having same issu or RU7 this is definitely something that should be investigated.



  • 5.  RE: BSOD - Registry read failure - Cannot load hive (file): \SystemRoot\System32\Configure\Software

    Trusted Advisor
    Posted Jan 22, 2013 09:09 AM

    Hello,

    I agree with Sebastian's comments, please create a fresh new case. The Case # 312-156-857 is a old case number.

    I would suggest you to create a Case with Symantec Technical Support Team and once the case is created please upload the SST Logs and Full Memory Dump File on the case.

    Check these Articles:

    How to create a new case in MySymantec (formerly MySupport)

    http://www.symantec.com/docs/TECH58873

    How to update a support case and upload diagnostic files with MySupport

    http://www.symantec.com/docs/TECH71023

    Regional Support Telephone Numbers:

    United States: https://support.broadcom.com (407-357-7600 from outside the United States)

    Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)

    United Kingdom: +44 (0) 870 606 6000

    Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp

    Hope that helps!!