hello folks, Gracie here

I have been given a poorly laptop to sort out. Owner went out for a short while leaving machine on, when he came back it had shut down and he cannot get it to boot up again but keeps getting a 21A stop message, which tells him it is a fatal and that the logon process has been terminated and the system shut down.

I have looked on various sites, including MS to try and determine what the problem might be, but there is no one certain cause it seems, so I have to work it out for myself. I know I could just install another copy of the OS or upgrade, whatever, but if we do not know what caused the problem, we won't know how to stop it happening again, so here I am, in Recovery Console, about to fight the dragon.

I have all the directories listed.
I figure something must have automaticallyupdated while the owner was elsewhere, and that I ought to be able to find it by date, so here I am.

I have picked out all the entries dated 1.11.06, of which there are eleven, but I do not know quite what I am looking at.

The date is on the left of the screen
Then there is a column which I take to be the time, so 5:19p means 5:19 pm - zat right?
Then there are what I think are attributes; a -d -s - hs -c - r.
Is that right?
I don't know what they all mean however, so would appreciate your wisdom
Then there is a figure which I take to be size - but most of the ones on my list have a zero is that because they are folders rather than files?
Then there is the name of each entry.

the 1/11/06 ones are

.
..
NTServicePackUninstall
drivercache
fonts
help
inf
media
msagent
system32
winsxs.

NT Uninstall ServicePack is timed at 5:02
., .., drivercache and WinSxS are timed at 5:18
all the rest are timed at 5:19.

I also have two dates for today: ntbootlog.txt and bootstat.dat.

I think my next move will be to try and read the bootlog through the edit command, but if you can see a possible direction for tracking down the culprit, I would be pleased to know what you think

its a driver issue or bad hardware . I once installed a dodgy capture card (some old 16 bit ISA job) and it halted my pc like this

Remove all nonesentiall hardware (including pc cards etc...) - will it boot in safe mode?

no it wouldn't boot in safe mode. He had not put any new hardware in ( it is a laptop). We were then of the opinion that it might be an automatic update problem. However, I took the easy route in the end and installed the OS over the top. There was A LOT of spyware on there, so maybe that is where the problem came from. Whatever, it is back with its owner now, but with that amount of bad stuff on there, I would have preferred to do a clean install, and if it comes back again, that is what I will aim for.

Thank you for your help though