removed Acronis driver from Device Mgr, BSOD on reboot

Discussion in 'Acronis True Image Product Line' started by emazur, Oct 4, 2006.

Thread Status:
Not open for further replies.
  1. TheWeaz

    TheWeaz Registered Member

    Joined:
    Jul 9, 2005
    Posts:
    1,562
    I wish you luck in your quest. But I think you’re searching for the non-existent.
     
  2. Xpilot

    Xpilot Registered Member

    Joined:
    May 14, 2005
    Posts:
    2,318
    Well I have not seen anything in this thread other than an unsubstantiated assertion that an MBR is altered when part of TI is disabled. There has been a case put forward that the removal of some burning software has caused this effect.This may or may not be true but as far as I can see it is not relevant to the example in hand. No evidence or documentation or anyhing else has been produced to persuade me that it can and does occur.

    Given suitable evidence that it happens and can be reproduced and I will then accept it as fact. In the meantime I remain a firm dis-believer.

    Xpilot
     
  3. BMW333

    BMW333 Registered Member

    Joined:
    Oct 7, 2006
    Posts:
    4
    I'm usually one to chalk things up to coincidence and wait for some replicated proof in a controlled test environment. However, the fact that I have had this happen on two different occasions (so far) and then found this thread makes me at least wonder what is going on. I was just hoping to find some sort of fix or any thread of hope that I had found the root of the issue and could somehow remedy any situation that may be forthcoming.

    I would ask if anyone knows if TI does any of the following:

    1) Alter the HAL
    2) Alter the acpitabl.dat
    3) Alter the acpitabl.sys
    4) Cause any issues with VSS


    Thanks everyone, it's a good discussion.
     
  4. Xpilot

    Xpilot Registered Member

    Joined:
    May 14, 2005
    Posts:
    2,318
    I have just been reviewing these posts and have been trying to imagine what may have happened and have come up with a couple of ideas.

    In the device manager tabs the one immediatley after Acronis is the computer ACPI wherein lies the following system 32 items, Hal.dll, Ntkmlpa.exe and Ntoskml.exe

    I am wondering if it is possible that you had that tab open underneath when you were disabling the Acronis entry/ies. Because changing any of the above could well stop your computer from booting.

    There should be two items in the Acronis folder, tisfilt.sys and timntr.sys. The oem9.inf should not be there. I have little knowledge of .infs but I understand that oem9.inf is indicative of a fault condition, now if this was actually on or should have been on the ACPI tab that could be a good pointer to you boot problem.

    If any of the THREE system32 files are missing we have struck oil !

    Well its worth a try.


    Xpilot
     
  5. Christopher_NC

    Christopher_NC Registered Member

    Joined:
    Jun 24, 2006
    Posts:
    293
    Location:
    North Carolina USA
    Well, since you asked for anything, I'll take a stab. My technical understanding is not at your level, but, I have used ATI 9 and DD 10 for 4 months - long enough to watch them workover my MBR many times, on a WinXP Pro system, with SATA HDs.

    Initially, Acronis OS Selector took control of my boot process (and not well at that), so I removed OS Selector and repaired the MBR and boot.ini. But, even on its own, with no Secure Zone or Recovery Manager installed, ATI would often render my system unbootable. Moving a HD from the Motherboard SATA to a PCI SATA controller, or even moving the SATA controller to a different PCI slot, would cause ATI to become confused all over. Fixing the BIOS Boot order often helped. But, during an ATI restore, fixing the boot order is not an option.

    As far as I understand this, ATI will address the HD it deems as the bootable HD and, if it finds no suitable MBR, will generate its own MBR, or overwrite the existing boot code. If it tries to boot from a data drive, or a drive with a hidden inactive OS partition present, of course, the system won't boot. Perhaps this same ATI behavior is at least a contributing factor here?

    Here's a post where Acronis Support briefly describes how mbrautowrite is designed to work - perhaps the same rules were programmed into ATI?:

    Re: can Acronis Disk Director Suite 10 erase the mbr?

    Regards
     
    Last edited: Oct 9, 2006
  6. emazur

    emazur Registered Member

    Joined:
    Oct 4, 2006
    Posts:
    16
    In my last post I indicated that replacing the registry with the one in c:\winnt\repair
    allowed me to boot into safe made. Does that not indicate that the problem lies in the registry and has nothing to do with the MBR? Right now I'm waiting for Acronis Japan to contact me regarding fixing my current registry

    I'm quite sure I disabled the driver under the acronis tab, not the ACPI tab. Nonetheless, I will take a look and see if any of those 3 system files are missing. If so, I will report back here
     
  7. SiriuS Support

    SiriuS Support Registered Member

    Joined:
    Oct 8, 2006
    Posts:
    3
    XPilot, I like your post (and I like your screen name as I am also an ex-Pilot). I never looked at where those oh so important drivers/dll's existed in the Device manager. I was going to theorize that the failed boot had to have something to do with the HAL or NTLDR or any of those core OS -> hardware driver files.

    I explained my theory in my first post to this forum: https://www.wilderssecurity.com/showpost.php?p=854299&postcount=117

    The scenario seems to indicate that the MBR and boot.ini files are intact. The reason being that the MBR is what points the BIOS to the correct bootbale partition that contains the boot.ini file and/or the OS. Since you do get Windows loading screen that indicates that those steps have passed. The boot process (or OS load at this point) fails when it can't find the necessary driver files such as the HAL.dll (Hardware Access Layer) file to communicate with all the hardware. In WinXP you actually get an message that tells you which file it couldn't load due to corruption or not being found. In Win2k, I believe the system just gives you BSOD or reboots/crashes. I could only be sure if I wanted to try and delete my HAL file from my Windows 2000 Server since that is the only version of Win2k I still run. That is just an expirament I'm not willing to take.

    The only solution from this point is to try and use the Recovery console in Win2k and copy the HAL and NTLDR files from your original CD-ROM onto the system root partition. There are many places to read about using the Recovery console so explaining it here would be redundant. I will tell you that once you've successfuly gotten into the recovery console, you'll simply put your OS Disc in your CD-ROM drive and execute the following command:

    COPY D:\i386\NTLDR C: (or something like that)

    If that doesn't work, your only option is to do a repair reinstall of the whole operating system which in Win2k isn't a great option, but will get you back up and running but you'll need to reload any special drivers for printers, scanners, cams, etc. and maybe some programs that have special drivers like photo imaging or video editing programs along with any DVD playing programs.

    Hope that helps. Now I got to go find the answers to my issues.

    WHY WON'T DD 10.0 trial detect ANY of my hard drives (yes, they are SATA on a ICH8R controller)?
     
  8. emazur

    emazur Registered Member

    Joined:
    Oct 4, 2006
    Posts:
    16

    Do you mean NTKRNLPA.EXE and NTOSKRNL.EXE ? I have those.
    I have hal.dll, I don't have Ntkmlpa.exe and Ntoskml.exe under c:\winnt\system32\
    Remember this is Win2k not XP, but I think you just mistook "rn" for "m"
     
  9. Xpilot

    Xpilot Registered Member

    Joined:
    May 14, 2005
    Posts:
    2,318
    Yes that is correct. My vision was slightly impaired as I had been looking through a wine glass or two [​IMG].

    So that still leaves the oem9.inf to be explained. I don't know why it is present in either the Acronis tab or the Computer tab.
    I believe it is an installation information file which you can find in the Windows INF folder. Mine is blank on my XP system as I think it should be on your system also.
    If it is there it will open in notepad and it may give someone a clue as to what is what.

    In your searches you have found the two TI drivers and the three Computer items. Perhaps someone can tell where to look to see which if any of these have been disabled though still present.

    Xpilot
     
  10. emazur

    emazur Registered Member

    Joined:
    Oct 4, 2006
    Posts:
    16
    The only reason I know about oem9.inf is b/c last week I used a freeware called double driver that backups all (or selected) drivers on your system. I looked at these backups under the Acronis folder, that's how I found the existence of those 3 acronis files (and then checked to confirm they were in the system32 folder, except for the inf).

    Anyway, I'm pretty sure it's not an issue of missing files, but a registry issue (since I was able to boot using the win2k repair default registry). I would be good if I knew how to manually uninstall Acronis 6.0, unfortunately Acronis has removed all knowledge base articles for their older products as far as I can tell. Hell it's not even that old, it was released in 2003 I believe
     
  11. emazur

    emazur Registered Member

    Joined:
    Oct 4, 2006
    Posts:
    16
    After some more experimenting I found that of the four system registry files (SAM, SYSTEM, SECURITY, SOFTWARE) in c:\winnt\system32\config\ the culprit is SYSTEM. I can leave my current SAM, SECURITY, and SOFTWARE files in place, but I must replace SYSTEM with the one from c:\winnt\repair
    or else it's BSOD land for me. My system file is about 3 meg, the default one is around 900k.
     
  12. Xpilot

    Xpilot Registered Member

    Joined:
    May 14, 2005
    Posts:
    2,318

    Well at last it seems that you have shot the TI/MBR Wild Goose that we have been chasing !

    I know nothing of the Double Driver freeware that you have installed. It is not something that I have any use for. I just use True image to backup everything and the way I use it means that I am only a reboot away from a total recovery.
    That is why when I got interested I was quite happy to delete the Acronis virtual drive just to see what happened. I was backup and running again in less than two minutes. Acronis TI is the "dog's dangly bits." [​IMG]


    Xpilot
     
  13. Christopher_NC

    Christopher_NC Registered Member

    Joined:
    Jun 24, 2006
    Posts:
    293
    Location:
    North Carolina USA
    emazur,

    Here's a post that mentions several similar Acronis devices, which become orphaned in the Registry while removing Version 8. Which seems to say that Acronis knows not to remove them, since doing so may cause certain systems, like yours, to become unbootable. I would also suspect, from having removed devices manually in Win9x in earlier, bolder, less cautious years, that the results of improperly removing even one or two devices which are deeply embedded into your registry could very well cause the problems you describe. It is not uncommon for a driver installed by one program to become a driver shared among several programs, etc. I'm not versed in the Registry, but, the same may apply. Once changed, unless returned to the initial state, the system will not self-heal, after surgery.

    ...getting rid of the extra entry requires Registry changes and/or complete TI uninstall and re-install

    I would also think that someone could point you in the right direction for removing Version 6 cleanly. You could start a new thread, asking for that, specifically. Or, PM Acronis Support, it should be in their own data base.

    Regards
     
  14. emazur

    emazur Registered Member

    Joined:
    Oct 4, 2006
    Posts:
    16
    Never heard from Acronis, and I'm tired of dealing with this crap so I replaced the SYSTEM file with one from Feb 2006 (taken from an Acronis image made at that time, I temporarily installed Acronis on a friend's system to explore the image and get the file). Seems to be running fine so far, though I had to reinstall my wireless drivers, my printer drivers will need to be reinstalled, and the soft-firewall detected something was wrong but repaired itself. What other repurcussions can I expect from using an old SYSTEM file, and is there anything I can do to make it "better"? What is generally contained in the SYSTEM file anyway?

    :thumbd: to Acronis for never responding. <snip>


    edited to remove unecessary remarks - Detox
     
    Last edited by a moderator: Oct 11, 2006
  15. NewScience

    NewScience Registered Member

    Joined:
    Apr 19, 2006
    Posts:
    20
    Location:
    Hamburg, NY
    Well, I've been struggling with this for two days now and this is what I found.

    I tried disabling the drivers under:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tifsfilter
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\timounter

    and then disabling the Device Manager Acronis Devices entry in System | Device Manager.

    BSOD ... thank god for Last Known Good Configuration.

    During a search on HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
    I discovered other entries:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{1860459D-4692-4825-B761-44A725991050}
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{1860459D-4692-4825-B761-44A725991050}\0000

    which contains the INF file oem4.inf. If you open that file (under C:\Windows\Inf\oem4.inf), you see the Installation file for Acronis Device Drivers. Also you see no DelReg option, so there doesn't seem to be an automated way to delete these entries.

    Additionally:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\ACRONISDEVICES
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\ACRONISDEVICES\0000

    reflects call-back references to this Class.

    I remember trying to remove Iomega layout like this on my cousins system a while back, and nearly destroyed the system. But I'm a little better at understanding the layout now, so I'm going to try exporting some of these and deleting them and see what happens.

    One thing I have discovered:

    NEVER use defragment on ths filesystems and expect Disk Director and True Image to work without some tweeking. AND NEVER resize partitions and expect True Image to find your hard drives.

    That's how all this started.

    Als, if you have DIsk Director installed, you have to consider another player in the device drivers ... snapman.sys. However, uninstalling Disk Director seems to clean up and remove snapman.

    Why can't TrueImage?

    Last Note: NEVER uninstall TrueImage in Normal Mode. Acronis TrueImage Run processes are still running and prevents TrueImage from completing it's uninstall.

    My first step is to re-install True Image 9.0 and then uninstall after rebooting with Run processes in memory. Then I will check if the drivers are gone.

    If not, then I will test my next option for manual deletions.
     
  16. bVolk

    bVolk Registered Member

    Joined:
    Dec 22, 2005
    Posts:
    954
    I've done it twice, with TI9.

    I started out with the sigle C partition on my system drive. Later, I added partition D for disposable files that do not need to be backed up with TI. Recently, I added partition S that I use for testing.

    Both times the new partition was created by restoring one of the then current partitions, resizing it down and then creating the new partition in the resulting unallocated space with Disk Management. I've never had problems after that, neither with TI or anything else.
     
    Last edited: Nov 16, 2006
  17. NewScience

    NewScience Registered Member

    Joined:
    Apr 19, 2006
    Posts:
    20
    Location:
    Hamburg, NY
    I sounds like we do not have the same Acronis configuration on our system.

    My system has Disk Director installed as well, and I chose to create the Secure Zone and set Install Secure Zone Manager in True Image.

    All this started because I wanted to extend my Windows 2000 partition and my Windows XP partition with the available free space left on the drive.

    I was able to move half the free space before Windows XP and then resized Windows 2000 to include the free space, and then did the same for Windows XP.

    Prior to this I defragmented both partitions.

    After this scenario, I was not able to see any hard drives in True Image.

    Uninstalling True Image only complicated matters because the Uninstaller built-in to Acronis fails to uninstall True Image.

    It leaves most of the registry settings, removes the C:\Program Files\Common Files\Acronis\Common folder, and then tries to use TrueImage (either Monitor or Mounter, I can't remember). The problem is that the program uses rpc_clinet.dll under the Common folder, which was just removed. So the program sits in an ever running 'Run' state trying to load the DLL.

    Killing the application allows the Add/Remove process to complete. However, it leaves all the drivers and services still intact in the system, so that the system constantly loads the tifsfilter.sys and timntr.sys drivers, which are still attach to the applications sitting in the C:\Program Files\Acronis\TrueImage folder, since the uninstall did not remove the folder and contents.

    Also, when installing TrueImage, you have the option to install for Current User or All Users. It doesn't matter which you chose, since TrueImage startup applications are all installed as All Users in the Run registry key under HKLM.

    When you uninstall, these entried are not removed from the Run key in the registry.

    The only way to fix this is to remove/modify two entries, C:\Windows\Inf\oem4.inf (remove or rename) and modify HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\UpperFilters registry value, which has a reference to timounter support for Acronis TrueImage (just remove the additional filter in support of TrueImage). All this is documented in the oem4.inf file as far as what's added when installing TrueImage.

    If you try to disable the Device Manager Acronis device or anything else, the next time you reboot the system, the system BSODs. The only way to reboot is then to use the Last Known Good Configuration.

    You must remove these entries first, and then cleanup the registry manually and remove the different entries under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet in support of Acronis.

    I will be detailing everything I did to fix Acronis in a later post.

    Once I removed all these entries, my system has no problem. I have since reinstalled True Image and it re-validating my partitions and everything is good to go.

    Previously I uninstalled, re-installed and received the same error ... no hard drives. It wasn't until I removed Disk Director AND removed True Image and cleaned up was I able to use it correctly.
     
  18. pdx~crash

    pdx~crash Registered Member

    Joined:
    Dec 11, 2006
    Posts:
    1
    Location:
    pdx-oregon
    forgive please if i missed it somewhere --- but wouldnt an update (upgrade) to Acronis Disk Director have found information you were searching for and either updated or replaced or repaired where needed ? --- u mentioned using acronis 6.0 -- im running 9.0 and never have a problem ! --- just curious --? ! -- *puppy*

     
  19. curlysir

    curlysir Registered Member

    Joined:
    Jan 2, 2007
    Posts:
    46
    I will add my recent experience to this discussion. I disabled the Acronis drive in the device manager and my system would not reboot. I did this to troubleshoot a problem with the Western Digitital diganostic program that started shortly after installing TI. The system would get to the safe mode boot screen and would reboot to this screen regardless of what option I choose.

    I restored using the program disk to a backup I had just created and the system is back. I did nothing but disable this device and yes I am sure it was the Acronis driver. So there is a problem with some systems when this device is disabled. I am running windows XP.
     
  20. Clearline

    Clearline Registered Member

    Joined:
    Aug 27, 2006
    Posts:
    33
    Location:
    Miami FL
    I have noticed that packet writers (especially INCD) can cause the exact same problem. I have had some machines that would'nt even boot with INCD in them (fortunately recovery console, earlier good version, fixed the problem).
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.