windows 7 crash just after login

josgiesbers · 16 Feb 2011

Dear all,
My windows 7 crashes with a blue screen just after login. This happens for every user.
Exact details: I wanted to watch a movie, windows media player asked for a driver
I let it search for this driver and it found one and asked me to install. I pressed ok ok and my virus scanner gave an alarm, at the sametime a windows screen poped up mentioning someting of an error and than the laptop just stoped and rebooted. Reboot goes ok untill I try to login. Than each time I get the crash. It does not matter if I log in in save mode, normal mode or the other two it just keeps on crashing. Please advise what to do I am getting hopeless.

If all went ok I attached a similar looking blue screen as the one I get.

zigzag3143 · 16 Feb 2011

josgiesbers said:

Dear all,
My windows 7 crashes with a blue screen just after login. This happens for every user.
Exact details: I wanted to watch a movie, windows media player asked for a driver
I let it search for this driver and it found one and asked me to install. I pressed ok ok and my virus scanner gave an alarm, at the sametime a windows screen poped up mentioning someting of an error and than the laptop just stoped and rebooted. Reboot goes ok untill I try to login. Than each time I get the crash. It does not matter if I log in in save mode, normal mode or the other two it just keeps on crashing. Please advise what to do I am getting hopeless.

If all went ok I attached a similar looking blue screen as the one I get.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.

To ensure minidumps are enabled:

Go to Start, in the Search Box type: sysdm.cpl, press Enter.
Under the Advanced tab, click on the Startup and Recovery Settings... button.
Ensure that Automatically restart is unchecked.
Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
OK your way out.
Reboot if changes have been made.

josgiesbers · 16 Feb 2011

ok i just for the first time managed to log in in savemode with prompt, from this I got the minidump files as you requested zigzag3143. Please informe how to proceed.
kind regards

Maguscreed · 16 Feb 2011

Code:

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
MODULE_NAME: nt

FAULTING_MODULE: fffff8000205f000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+6435393239353637
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0

BUGCHECK_STR:  0x1E_0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800020c746e to fffff800020cf710

STACK_TEXT:  
fffff880`020faaf8 fffff800`020c746e : 00000000`00000000 00000000`00000000 fffff880`020fb270 fffff800`020fc668 : nt+0x70710
fffff880`020fab00 00000000`00000000 : 00000000`00000000 fffff880`020fb270 fffff800`020fc668 00000000`00000000 : nt+0x6846e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt+70710
fffff800`020cf710 4883ec28        sub     rsp,28h

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+70710

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

It would appear to be a driver / security software conflict.
I'll edit this post in a few with some more specific information.

In the meantime you can run a secure file check on the system and see if that gets you bootable again.
SFC /SCANNOW Command - System File Checker <--- instructions

Edit: I notice you are running some form of cd emulation software, this is known to cause problems on some win 7 systems. The driver database suggests you

Go to C:\Windows\System32\drivers and rename PxHelp20.sys to PXHelp20.BAK
This will break your CD/DVD program, but can easily be renamed after we've finished.

This link http://www.carrona.org/pxhelp20.html contains a list of programs known to use this file.

That's the only immediately out of place driver I see,
dump follows for reference :

Code:

fffff800`00b9e000 fffff800`00ba1000   kdcom    kdcom.dll    Fri Jan 21 07:17:13 2011 (4D398759)
fffff800`02016000 fffff800`0205f000   hal      hal.dll      Mon Jul 13 20:27:36 2009 (4A5BDF08)
fffff800`0205f000 fffff800`0263c000   nt       ntoskrnl.exe Tue Oct 26 21:43:09 2010 (4CC791BD)
fffff880`00c3d000 fffff880`00c81000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 20:29:10 2009 (4A5BDF66)
fffff880`00c81000 fffff880`00c95000   PSHED    PSHED.dll    Mon Jul 13 20:32:23 2009 (4A5BE027)
fffff880`00c95000 fffff880`00cf3000   CLFS     CLFS.SYS     Mon Jul 13 18:19:57 2009 (4A5BC11D)
fffff880`00cf3000 fffff880`00db3000   CI       CI.dll       Mon Jul 13 20:32:13 2009 (4A5BE01D)
fffff880`00db3000 fffff880`00dff000   volsnap  volsnap.sys  Mon Jul 13 18:20:08 2009 (4A5BC128)
fffff880`00e00000 fffff880`00e5c000   volmgrx  volmgrx.sys  Mon Jul 13 18:20:33 2009 (4A5BC141)
fffff880`00e5c000 fffff880`00e76000   mountmgr mountmgr.sys Mon Jul 13 18:19:54 2009 (4A5BC11A)
fffff880`00e76000 fffff880`00ea6000   CLASSPNP CLASSPNP.SYS Mon Jul 13 18:19:58 2009 (4A5BC11E)
fffff880`00ebf000 fffff880`00f63000   Wdf01000 Wdf01000.sys Mon Jul 13 18:22:07 2009 (4A5BC19F)
fffff880`00f63000 fffff880`00f72000   WDFLDR   WDFLDR.SYS   Mon Jul 13 18:19:54 2009 (4A5BC11A)
fffff880`00f72000 fffff880`00fa5000   pci      pci.sys      Mon Jul 13 18:19:51 2009 (4A5BC117)
fffff880`00fa5000 fffff880`00fba000   volmgr   volmgr.sys   Mon Jul 13 18:19:57 2009 (4A5BC11D)
fffff880`00fba000 fffff880`00fdb000   WudfPf   WudfPf.sys   Fri Jan 15 01:32:54 2010 (4B501A26)
fffff880`01000000 fffff880`0100c000   BATTC    BATTC.SYS    Mon Jul 13 18:31:01 2009 (4A5BC3B5)
fffff880`0100c000 fffff880`01029000   usbccgp  usbccgp.sys  Mon Jul 13 19:06:45 2009 (4A5BCC15)
fffff880`01033000 fffff880`01044000   blbdrive blbdrive.sys Mon Jul 13 18:35:59 2009 (4A5BC4DF)
fffff880`01044000 fffff880`01058000   termdd   termdd.sys   Mon Jul 13 19:16:36 2009 (4A5BCE64)
fffff880`01058000 fffff880`0109b000   ks       ks.sys       Wed Mar 03 22:32:25 2010 (4B8F37D9)
fffff880`0109b000 fffff880`010ad000   umbus    umbus.sys    Mon Jul 13 19:06:56 2009 (4A5BCC20)
fffff880`010ad000 fffff880`01107000   usbhub   usbhub.sys   Fri Dec 04 01:26:39 2009 (4B18B9AF)
fffff880`01107000 fffff880`0111a000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 18:21:51 2009 (4A5BC18F)
fffff880`0111a000 fffff880`01135000   USBSTOR  USBSTOR.SYS  Mon Jul 13 19:06:34 2009 (4A5BCC0A)
fffff880`01137000 fffff880`01140000   WMILIB   WMILIB.SYS   Mon Jul 13 18:19:51 2009 (4A5BC117)
fffff880`01140000 fffff880`0116f000   SCSIPORT SCSIPORT.SYS Mon Jul 13 19:01:04 2009 (4A5BCAC0)
fffff880`0116f000 fffff880`011c6000   ACPI     ACPI.sys     Mon Jul 13 18:19:34 2009 (4A5BC106)
fffff880`011c6000 fffff880`011d0000   msisadrv msisadrv.sys Mon Jul 13 18:19:26 2009 (4A5BC0FE)
fffff880`011d0000 fffff880`011dd000   vdrvroot vdrvroot.sys Mon Jul 13 19:01:31 2009 (4A5BCADB)
fffff880`011dd000 fffff880`011f2000   partmgr  partmgr.sys  Mon Jul 13 18:19:58 2009 (4A5BC11E)
fffff880`011f2000 fffff880`011fb000   compbatt compbatt.sys Mon Jul 13 18:31:02 2009 (4A5BC3B6)
fffff880`01200000 fffff880`0123a000   fvevol   fvevol.sys   Fri Sep 25 21:34:26 2009 (4ABD7DB2)
fffff880`0123a000 fffff880`01246000   Dxapi    Dxapi.sys    Mon Jul 13 18:38:28 2009 (4A5BC574)
fffff880`01246000 fffff880`01450000   iaStor   iaStor.sys   Wed Mar 03 20:51:31 2010 (4B8F2033)
fffff880`01450000 fffff880`0145b000   amdxata  amdxata.sys  Tue May 19 12:56:59 2009 (4A12F2EB)
fffff880`0145b000 fffff880`014a7000   fltmgr   fltmgr.sys   Mon Jul 13 18:19:59 2009 (4A5BC11F)
fffff880`014a7000 fffff880`014bb000   fileinfo fileinfo.sys Mon Jul 13 18:34:25 2009 (4A5BC481)
fffff880`014bb000 fffff880`014c6e00   PxHlpa64 PxHlpa64.sys Tue Jun 23 18:16:35 2009 (4A416253)
fffff880`014c7000 fffff880`01525000   msrpc    msrpc.sys    Mon Jul 13 18:21:32 2009 (4A5BC17C)
fffff880`01525000 fffff880`01598000   cng      cng.sys      Mon Jul 13 18:49:40 2009 (4A5BC814)
fffff880`01598000 fffff880`015e2000   fwpkclnt fwpkclnt.sys Mon Jul 13 18:21:08 2009 (4A5BC164)
fffff880`015f0000 fffff880`01600000   CompositeBus CompositeBus.sys Mon Jul 13 19:00:33 2009 (4A5BCAA1)
fffff880`01606000 fffff880`017a9000   Ntfs     Ntfs.sys     Mon Jul 13 18:20:47 2009 (4A5BC14F)
fffff880`017a9000 fffff880`017c3000   ksecdd   ksecdd.sys   Mon Jul 13 18:20:54 2009 (4A5BC156)
fffff880`017c3000 fffff880`017d4000   pcw      pcw.sys      Mon Jul 13 18:19:27 2009 (4A5BC0FF)
fffff880`017d4000 fffff880`017de000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 18:19:45 2009 (4A5BC111)
fffff880`017de000 fffff880`017f4000   disk     disk.sys     Mon Jul 13 18:19:57 2009 (4A5BC11D)
fffff880`017f4000 fffff880`017ff000   rdpbus   rdpbus.sys   Mon Jul 13 19:17:46 2009 (4A5BCEAA)
fffff880`01800000 fffff880`01860000   NETIO    NETIO.SYS    Mon Jul 13 18:21:46 2009 (4A5BC18A)
fffff880`01860000 fffff880`0188b000   ksecpkg  ksecpkg.sys  Fri Dec 11 00:03:32 2009 (4B21E0B4)
fffff880`0188b000 fffff880`0189b000   vmstorfl vmstorfl.sys Mon Jul 13 18:42:54 2009 (4A5BC67E)
fffff880`0189b000 fffff880`018a3000   stdflt   stdflt.sys   Mon Nov 23 15:55:17 2009 (4B0B04C5)
fffff880`018ab000 fffff880`018bd000   mup      mup.sys      Mon Jul 13 18:23:45 2009 (4A5BC201)
fffff880`018bd000 fffff880`018c6000   hwpolicy hwpolicy.sys Mon Jul 13 18:19:22 2009 (4A5BC0FA)
fffff880`018c6000 fffff880`018d1000   mssmbios mssmbios.sys Mon Jul 13 18:31:10 2009 (4A5BC3BE)
fffff880`018d1000 fffff880`019c3000   ndis     ndis.sys     Mon Jul 13 18:21:40 2009 (4A5BC184)
fffff880`019c3000 fffff880`019fd000   rdyboost rdyboost.sys Mon Jul 13 18:34:34 2009 (4A5BC48A)
fffff880`01a01000 fffff880`01bfe000   tcpip    tcpip.sys    Sun Jun 13 22:39:04 2010 (4C15A458)
fffff880`02c00000 fffff880`02c4f000   SynTP    SynTP.sys    Thu Jan 07 22:00:28 2010 (4B46ADDC)
fffff880`02c4f000 fffff880`02c50f00   USBD     USBD.SYS     Mon Jul 13 19:06:23 2009 (4A5BCBFF)
fffff880`02c51000 fffff880`02c60000   mouclass mouclass.sys Mon Jul 13 18:19:50 2009 (4A5BC116)
fffff880`02c60000 fffff880`02c6f000   kbdclass kbdclass.sys Mon Jul 13 18:19:50 2009 (4A5BC116)
fffff880`02c6f000 fffff880`02c99000   cdrom    cdrom.sys    Mon Jul 13 18:19:54 2009 (4A5BC11A)
fffff880`02c99000 fffff880`02ca8000   Acceler  Acceler.sys  Mon Nov 23 15:55:13 2009 (4B0B04C1)
fffff880`02ca8000 fffff880`02cb6000   crashdmp crashdmp.sys Mon Jul 13 19:01:01 2009 (4A5BCABD)
fffff880`02cb6000 fffff880`02ec0000   dump_iaStor dump_iaStor.sys Wed Mar 03 20:51:31 2010 (4B8F2033)
fffff880`02eca000 fffff880`02ed3000   Null     Null.SYS     Mon Jul 13 18:19:37 2009 (4A5BC109)
fffff880`02ed3000 fffff880`02eda000   Beep     Beep.SYS     Mon Jul 13 19:00:13 2009 (4A5BCA8D)
fffff880`02eda000 fffff880`02ee8000   vga      vga.sys      Mon Jul 13 18:38:47 2009 (4A5BC587)
fffff880`02ee8000 fffff880`02f0d000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 18:38:51 2009 (4A5BC58B)
fffff880`02f0d000 fffff880`02f1d000   watchdog watchdog.sys Mon Jul 13 18:37:35 2009 (4A5BC53F)
fffff880`02f1d000 fffff880`02f28000   Msfs     Msfs.SYS     Mon Jul 13 18:19:47 2009 (4A5BC113)
fffff880`02f28000 fffff880`02f39000   Npfs     Npfs.SYS     Mon Jul 13 18:19:48 2009 (4A5BC114)
fffff880`02f39000 fffff880`02f4a000   HECIx64  HECIx64.sys  Thu Sep 17 14:54:16 2009 (4AB293E8)
fffff880`02f4a000 fffff880`02f5b000   usbehci  usbehci.sys  Fri Dec 04 01:26:02 2009 (4B18B98A)
fffff880`02f5b000 fffff880`02fb1000   USBPORT  USBPORT.SYS  Mon Jul 13 19:06:31 2009 (4A5BCC07)
fffff880`02fb1000 fffff880`02fd5000   HDAudBus HDAudBus.sys Mon Jul 13 19:06:13 2009 (4A5BCBF5)
fffff880`02fd5000 fffff880`02ff3000   i8042prt i8042prt.sys Mon Jul 13 18:19:57 2009 (4A5BC11D)
fffff880`02ff3000 fffff880`02ffc000   wmiacpi  wmiacpi.sys  Mon Jul 13 18:31:02 2009 (4A5BC3B6)
fffff880`02ffc000 fffff880`02ffd480   swenum   swenum.sys   Mon Jul 13 19:00:18 2009 (4A5BCA92)
fffff960`00000000 fffff960`00310000   win32k   win32k.sys   Tue Jan 04 21:59:44 2011 (4D23ECB0)
fffff960`00530000 fffff960`0054e000   dxg      dxg.sys      Mon Jul 13 18:38:28 2009 (4A5BC574)
fffff960`007a0000 fffff960`007aa000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff960`008d0000 fffff960`008d9000   framebuf framebuf.dll Mon Jul 13 18:38:47 2009 (4A5BC587)

Unloaded modules:
fffff880`015e2000 fffff880`015f0000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`02cad000 fffff880`02eb7000   dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0020A000
fffff880`02eb7000 fffff880`02eca000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
fffff880`0100c000 fffff880`01033000   Impcd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00027000
fffff880`018a3000 fffff880`018ab000   spldr.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff880`01011000 fffff880`01137000   sptd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00126000

josgiesbers · 16 Feb 2011

I tried some stuf in the safe mode with prompt, maybe this information helps to the experts to figure out a solution, one thing was to start internet explorer from the prompt this works fine but since there is no networkoption in the save mode (i think) it does not display a web page. If I let it do netwerk problem detection than it crashes again in the same blue screen. Hopefully this bit of information helps to find a suitable solution. I am patiently waiting.
kind regards and tanks in advance for the help

josgiesbers · 16 Feb 2011

I did the secure file check and it gave no violations of integrity, doing a second scan to be sure.
In the next step you suggest to change the following: C:\Windows\System32\drivers and rename PxHelp20.sys to PXHelp20.BAK . What do you mean by "This will break your CD/DVD program"? which program? or do you mean the actual cd/dvd hardware? Sorry if this is a stupid question but I am no expert. How to proceed after the name change? just reboot?

Maguscreed · 16 Feb 2011

Thefile is there because of a cd burning application most likely.
If it's renamed that application will fail to work properly.
It will however let us know if it is the source of the problem.
We can then suggest replacement apps, or workarounds.
If it is not the source of the issue, you can simply rename it back.

...renaming a file will not damage physical hardware, though I understand your concern.

josgiesbers · 16 Feb 2011

I checked for the pxhelp20.sys file in the driver folder and there does not seem to be a file by that name. The only resembling file is PxHlpa64.sys. Please advise how to proceed as the problem is still there.
kind regards

Maguscreed · 16 Feb 2011

it's the same file. The driver database has identical information for both of them. The creation date also matches in the dump log, so we're still okay here.

josgiesbers · 16 Feb 2011

wow, it starts! no crash this time. ok so changing the file name helped....aah and now it chashes again when I started internet explorer. So it helped a bit, but still the same crash, now at a not directly after startup.
please inform how to proceed. Should i change the file name back? I am in the save mode again.