BSOD upon login

XaiXo · 11 Feb 2011

Hey everyone.

I'm having some issues with my PC (as you'd imagine, since I'm posting in this section). Until yesterday (10th of February), my PC was working fine and dandy. During the morning and afternoon, it was working as per usual. However, when I went on it during the night, after about 30 seconds of being logged on, up popped a BSOD, and restarted the PC.

After various restarts, it was clear that this wasn't a one-off issue.

There is no recently installed hardware apart from a pair of new HDDs in RAID 0 which are used as storage, and they are working fine. They've been in for about a month, and I can hear them start up as per usual, and can access them as normal when in Safe Mode.

I'm almost certain the cause is not hardware, as I can run in Safe Mode without so much as a hiccup. However, something is causing a crash in regular mode.

Here's my system specs:

Windows 7 Home Premium x64
Intel Core i7 930
6GB Patriot RAM @ 2000MHz, 7-7-7-21
ASUS P6X58D-E
XFX HD 5870
Cosair 650W PSU
1x 60GB OCZ Vertex 2E (Boot)
2x 1TB Samsung Spinpoint F3 (RAID 0 storage)
1x 1TB Western Digital Caviar Green (Storage)

Everything works as per usual in Safe Mode, aside from the stuff that Safe Mode prevents. I've tested my RAM via Memtest and the onboard MemOK! stuff, no errors.

All 4 HDDs are accessible and working as normal as far as I can tell.

My graphics card hasn't had any issues, as it is currently displaying my screen normally. However, I cannot open the Catalyst Control Centre in Safe Mode, is that normal?

According to the crash dumps (looked at via BlueScreenView), ntoskrnl is to blame. However, from what I've read on similar forum threads is that ntoskrnl is essential for basic running, so I'd be having far worse problems than BSOD upon logging in.

Anyway, in my (amateur) opinion, I don't believe it's hardware related, as I'd be having problems in Safe Mode as well, right?

Any and all help would be appreciated, thanks in advance!

I've attached my memory dumps, hope that helps.

~Josh

Maguscreed · 11 Feb 2011

You are suffering a serious case of registry corruption it would appear.

The easiest fix is probably a repair install.
Repair Install
While that should get you able to boot again, you may lose functionality with a few apps and have to reinstall them as well.

The other option is to attempt booting safe mode and try restoring to a point before the problem occurred since the registry is one of the items backed up for restore.
System Restore

The death at login is definitely being caused by a registry problem though. Whether this is just a symptom of something worse (like hard drive failing) can also be checked by running a disk check.
Disk Check

I'll leave it at that for the moment. You have a few out of date drivers on your system as well, but there's no point in addressing that if you can't even boot properly.

Just a footnote, you may want to try those options in reverse order Repair install being the last option.

XaiXo · 11 Feb 2011

Thanks, I'll give those a try (well, not a repair, yet).

If the registry corruption is the case, what could have caused it? Primarily so I don't run into this problem again.

Maguscreed · 11 Feb 2011

Well the hard drive could have encountered a problem. Some sort of interruption during shutdown could also have resulted in registry corruption. The reason I'm suggesting disk check is because if it comes up with many bad sectors or errors, it may be time to replace the hard drive.

XaiXo · 11 Feb 2011

Chkdsk came up with nothing.

As for a Repair install, I'm entirely unable to do one - They cannot be done from within Safe Mode, and I'm unable to keep regular mode open for more than a few seconds. Plus, my SSD boot drive only has 6 or so gigabytes left free, which is less than a Repair install requires.

Help!

Maguscreed · 11 Feb 2011

Okay let me do this. I'm going to point you to another thread that offers several possible fixes for this (read the whole thing they don't all require you to be able to boot) Instead of just reprinting them here.
Corrupted registry

XaiXo · 11 Feb 2011

Right, something odd has occurred. It seems to be working in regular mode now. Could somebody look into the crash dumps and see if they can find the cause, so I can make sure this doesn't occur again?

Thanks!

Shadowjk · 11 Feb 2011

I am currently Debugging your Crash Dumps this can take a while...

Shadowjk · 11 Feb 2011

There is some Refernece to Registry Problems but it may also be a Hardware issue

Please Test your Memory and Run a Sfc /scannow

SFC /SCANNOW Command - System File Checker

After that Run a full scan with your Anti-Virus

Also please check for any Errors in Device Manger and Reinstall any Drivers if necessary

See the Attachment for more information

YOU WILL NEED TO BE AN ADMINISTRATOR AND IT WILL WORK FOR WINDOWS 7 AS WELL AS VISTA

For Reference:

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86

Code:

Loading Dump File [C:\Users\Josh\Desktop\021011-14929-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a15000 PsLoadedModuleList = 0xfffff800`02c52e50
Debug session time: Thu Feb 10 22:00:28.511 2011 (UTC + 0:00)
System Uptime: 0 days 0:00:46.493
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffffffffffff3, 0, fffff80002d5f43d, 0}

Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CmpKcbCacheLookup+1dd )

Followup: MachineOwner
---------

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffffffffff3, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002d5f43d, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffffffffffff3 

FAULTING_IP: 
nt!CmpKcbCacheLookup+1dd
fffff800`02d5f43d 418b45f4        mov     eax,dword ptr [r13-0Ch]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  AAWWSC.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88006ba97b0 -- (.trap 0xfffff88006ba97b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000003ff rbx=0000000000000000 rcx=0000000000000aaa
rdx=000000000ef62637 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d5f43d rsp=fffff88006ba9940 rbp=fffff8a000b16010
 r8=0000000000000004  r9=0000000000000000 r10=0000000000000000
r11=fffff88006ba9af0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!CmpKcbCacheLookup+0x1dd:
fffff800`02d5f43d 418b45f4        mov     eax,dword ptr [r13-0Ch] ds:99c0:ffffffff`fffffff4=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b05f14 to fffff80002a85740

STACK_TEXT:  


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!CmpKcbCacheLookup+1dd
fffff800`02d5f43d 418b45f4        mov     eax,dword ptr [r13-0Ch]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!CmpKcbCacheLookup+1dd

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

FAILURE_BUCKET_ID:  X64_0x50_nt!CmpKcbCacheLookup+1dd

BUCKET_ID:  X64_0x50_nt!CmpKcbCacheLookup+1dd

Followup: MachineOwner
---------

Hope This Helps,
Josh

XaiXo · 11 Feb 2011

Shadowjk said:

There is some Refernece to Registry Problems but it may also be a Hardware issue

Please Test your Memory and Run a Sfc /scannow

SFC /SCANNOW Command - System File Checker

After that Run a full scan with your Anti-Virus

Also please check for any Errors in Device Manger and Reinstall any Drivers if necessary

See the Attachment for more information

YOU WILL NEED TO BE AN ADMINISTRATOR AND IT WILL WORK FOR WINDOWS 7 AS WELL AS VISTA

Hope This Helps,
Josh

I've tested my memory via the onboard MemOK! button and Memtest86, no errors/faults.

I ran Sfc /scannow with Admin capabilities, no faults detected, though after a restart, it works in regular mode. Whether this fixed it or not, I don't know.

The only error in Device Manager is a USB controller, which has been disabled.

I'm running a full scan with Kasperksy AV, Ad-Aware and MalwareBytes (separately, of course).

Thanks!