When your day starts off with a client coming in with a BSOD (Blue Screen Of Death) on their PC you can pretty much be assured at what type of day both you and the client are going to have…



After powering on the machine, it would past the POST (Power On Self Test) and then the starting Windows splash screen would show and then it would crash with the BSOD. Tried Safe Mode and Last Known Good without success…. things were not looking good.

Did a search and found on the Microsoft website the exact error – .

It seems the issue occurs because the Bootcat.cache file is corrupted or because the size of the Bootcat.cache file is changed since the last successful start. The Bootcat.cache file is located in the %SystemRoot%\system32\codeintegrity   folder.  Microsoft suggests to work around this issue, start the computer from the disc drive or from the USB drive by using the Windows installation media. Delete the Bootcat.cache file, and then restart the computer.

I managed to boot into the System Repair console and delete the file however rebooting did not resolve the issue. 🙁

Now this machine was a Lenovo T440 machine, so I popped out the hard drive, inserted it into a USB HDD bay and then copied the Bootcat.cache file over from a newly imaged machine… Issue still not resolved…

As this was a first year clerk, and we setup the machines in batches 3 months prior, I found another clerk whose machine was setup at the same time as his and copied their Bootcat.cache file across to his machine (using the USB HDD bay route); and for the first time it actually booted into Windows!  There was cheering and happiness as the next 3 reboots worked without any issues. The clerk then disappeared off into the morning sun to the client, and I felt good that another client had been helped.

Fast Forward 2 Days…

When I arrived at my office the same clerk was waiting for me at the door…same issue…BSOD error every startup

After asking all the usual questions about what software have you recently loaded, what external media have you plugged in, etc. he said the expected “nothing” but then he stated that the USB ports were not working at all after the last “fix”.  Hmmmm…. definately a more serious issue than just replacing 1 file.

I removed his HDD from the machine and placed it into my USB HDD bay once again and took a peak at the Bootcat.cache file – it had changed the previous day (round about when the Antivirus scan was scheduled to start) and had shrunk from 6879kb to 21kb in size… I then decided to search for “bootcat.cache corrupting” and then stumbled across the following URL:

In it there was a post by Derek McNelly that said the following:


I looked in his C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} folder and found that it only had 81 files (of about 5Mb) in it and the other folder in C:\Windows\System32\catroot\ was actually empty!  I then compared it to another clerks machine and the whole C:\Windows\System32\catroot\ folder was 112Mb on that machine!  I promptly copied the files across as well as the Bootcat.cache file to my clients drive, and then put the drive back into his PC.

Windows started successfully and the USB ports WORKED!

So it MUST have been McAfee that removed these files – seems it is a “known” issue – URL

I force updated the McAfee Agent on the machine to version 4.8  and now I wait for a week to see if the machine behaves or not…  but I am sure it will this time! Damn McAfee!

(Edit: 1 week later and client has confirmed all is still well!)

MadMike posted at 2014-3-30 Category: Windows / WHS

Leave a Reply

(Ctrl + Enter)