BSOD on cold power up

errfoil · 06 Jan 2012

Greetings,

My system is home-built, apx 1.5 years old. I was doing a system update (drivers, BIOS, etc) a couple of weeks ago, shortly thereafter the PC started acting unstable every now and then, sometimes BSOD, sometimes it would go into a boot loop.

The PC had a mild overclock so I restored Optimized Settings in the BIOS, and then reinstalled Win7 from disk as the PC became more and more unstable. I installed the latest drivers from the manufacturer's websites. I removed and cleaned the memory modules and swapped the modules into different slots (ie number 1 into slot 3, etc). I also removed, cleaned and reseated the Video Card.

The PC now crashes every morning when it is cold booted, eventually after it warms up it runs fine. I had it set to run Win Mem Test on startup this morning, immediately it told me I had hardware errors, but when it restarted there was no error report. If I run Win Mem Test again it reports no errors. Also, if I set the memory to manufacturer's spec (no overclock) it will go into a POST, start Windows, black screen, POST cycle...even if the PC is warmed up.

I have also changed AV from the original MS Security Ess. to Avast just to troubleshoot.

During this mornings crashes I got two different error message so I have included both dmp files. System specs are in the profile that I set up when I registered.

I am out of ideas.

TIA

Lemur · 06 Jan 2012

Run memtest86+ and let it make at least 7 passes

errfoil · 07 Jan 2012

OK, I had 5 runs when I went to bed last night so I just left Memtest running. I ended up with 15 passes, no errors.

Should I bring the memory up to manufacturers specs and run again, or should I shut down and run Memtest after the PC is cold to try and replicate the cold start failure?

Was there any clues or info in the .dmp files?

TIA

writhziden · 07 Jan 2012

In case Memtest86+ missed anything, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. Sometimes Windows memory diagnostics find errors with the memory that Memtest86+ does not, especially if those errors cause conflicts in Windows.

Just noticed you already did so... I would run memtest86+ from a cold boot as you did with Windows Diagnostics and see what happens.

writhziden · 07 Jan 2012

As to your .dmp files...

Code:


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\errfoil\BSOD 6Jan DMP files\010612-11996-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c66000 PsLoadedModuleList = 0xfffff800`02eab670
Debug session time: Fri Jan  6 12:19:23.732 2012 (UTC - 7:00)
System Uptime: 0 days 0:03:11.653
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8001e2bf80, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001e2bf80
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  TrustedInstall

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002d52150 to fffff80002ce2c40

STACK_TEXT:  
fffff880`09c563f8 fffff800`02d52150 : 00000000`0000001a 00000000`00041790 fffffa80`01e2bf80 00000000`0000ffff : nt!KeBugCheckEx
fffff880`09c56400 fffff800`02d16569 : fffffa80`00000000 00000000`0162ffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x36024
fffff880`09c565c0 fffff800`02ffa221 : fffffa80`070ffc40 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`09c566e0 fffff800`02f3195f : 00000000`00000000 fffffa80`050d8790 fffff880`00000001 fffffa80`00000001 : nt!MiUnmapViewOfSection+0x1b1
fffff880`09c567a0 fffff800`02f82fe0 : fffff8a0`00000004 fffffa80`050e1060 fffff880`09c56950 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x2aaef
fffff880`09c56890 fffff800`02f846d5 : 00000000`01510000 00000000`00120000 fffff880`09c569e8 00000000`00000000 : nt!AlpcpCreateView+0x1d0
fffff880`09c56950 fffff800`02feeb49 : fffff8a0`028b1c20 00000000`00000000 fffff880`09c56a68 00000000`0000008c : nt!AlpcpReceiveView+0xf5
fffff880`09c569e0 fffff800`02fef120 : 00000000`00000000 fffffa80`0513ca01 00000000`00000000 00000000`00000000 : nt!AlpcpExposeAttributes+0x189
fffff880`09c56a60 fffff800`02ff03a6 : fffffa80`0523f090 00000000`00000000 00000000`00000000 fffffa80`0523f090 : nt!AlpcpReceiveMessage+0x3ed
fffff880`09c56b00 fffff800`02ce1ed3 : fffffa80`050d8790 fffff880`09c56ca0 00000000`009df238 fffffa80`0733a170 : nt!NtAlpcSendWaitReceivePort+0x1e6
fffff880`09c56bb0 00000000`7fff019f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`009df218 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fff019f


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+36024
fffff800`02d52150 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+36024

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\errfoil\BSOD 6Jan DMP files\010612-11996-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c66000 PsLoadedModuleList = 0xfffff800`02eab670
Debug session time: Fri Jan  6 12:19:23.732 2012 (UTC - 7:00)
System Uptime: 0 days 0:03:11.653
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8001e2bf80, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001e2bf80
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  TrustedInstall

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002d52150 to fffff80002ce2c40

STACK_TEXT:  
fffff880`09c563f8 fffff800`02d52150 : 00000000`0000001a 00000000`00041790 fffffa80`01e2bf80 00000000`0000ffff : nt!KeBugCheckEx
fffff880`09c56400 fffff800`02d16569 : fffffa80`00000000 00000000`0162ffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x36024
fffff880`09c565c0 fffff800`02ffa221 : fffffa80`070ffc40 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`09c566e0 fffff800`02f3195f : 00000000`00000000 fffffa80`050d8790 fffff880`00000001 fffffa80`00000001 : nt!MiUnmapViewOfSection+0x1b1
fffff880`09c567a0 fffff800`02f82fe0 : fffff8a0`00000004 fffffa80`050e1060 fffff880`09c56950 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x2aaef
fffff880`09c56890 fffff800`02f846d5 : 00000000`01510000 00000000`00120000 fffff880`09c569e8 00000000`00000000 : nt!AlpcpCreateView+0x1d0
fffff880`09c56950 fffff800`02feeb49 : fffff8a0`028b1c20 00000000`00000000 fffff880`09c56a68 00000000`0000008c : nt!AlpcpReceiveView+0xf5
fffff880`09c569e0 fffff800`02fef120 : 00000000`00000000 fffffa80`0513ca01 00000000`00000000 00000000`00000000 : nt!AlpcpExposeAttributes+0x189
fffff880`09c56a60 fffff800`02ff03a6 : fffffa80`0523f090 00000000`00000000 00000000`00000000 fffffa80`0523f090 : nt!AlpcpReceiveMessage+0x3ed
fffff880`09c56b00 fffff800`02ce1ed3 : fffffa80`050d8790 fffff880`09c56ca0 00000000`009df238 fffffa80`0733a170 : nt!NtAlpcSendWaitReceivePort+0x1e6
fffff880`09c56bb0 00000000`7fff019f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`009df218 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fff019f


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+36024
fffff800`02d52150 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+36024

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

Followup: MachineOwner
---------

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 )
PROCESS_NAME: TrustedInstall

Both crashes were identical.

Also, since your blue screens are system related, the following possibilities exist.

System file corruption (unlikely since you just re-installed, but still worth a check as it can happen). Run SFC /SCANNOW Command - System File Checker to check for system file corruption.You may have to run it up to three times to fix all errors.
Faulty hardware (you already ran these, but keep running them from cold start and report back since that is when you say your errors occur). Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete.
Hard disk errors. Run Disk Check with both boxes checked for all drives.
An underlying driver that is incompatible with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:

a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the above steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 non-Microsoft drivers until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

errfoil · 07 Jan 2012

Since it would take a while for the system to cold soak I took a different tack. I set the memory to mfr's specs: 1.6v, 1333Mhz, CAS 7-7-7-20 and started Memtest86+. All other BIOS settings are at Optimized defaults.

Within 10 minutes I had about 15 errors, all different. At the 13 min mark the system tipped over, I had 15,000+ errors, basically every test failed, and kept on failing.

Since I have triple channel memory I altered the procedure from the tutorial by first removing module 3 from slot 5. Ran 1 pass on Memtest, no errors. Next I put module 3 into slot 1, ran 1 pass on Memtest, no errors. Now I am running module 3 in slot 1 and module 2 in slot 3, so far no errors. I can only install a single module in slot 1 or 3, not 5. There is no way for me to test slot 5, except by elimination.

If I do a cold boot with all 3 modules in place, and it fails, have I learned anything new? In the past cold boots always fail, I was running Win Mem Diag and it would tell me I had "Hardware Faults, check with your manufacturer" (unfortunately that's me!).

Can I safely assume that slot 5 is faulty in the MB? Since the MB is out of warranty I am looking at buying a new MB and all the a**pain of a new install, so if there is something that I am missing here I would greatly appreciate a heads up.

TIA

Lemur · 07 Jan 2012

If you have deduced the problem is with slot 5, could you leave slot 5 vacant to avoid future problems?

errfoil · 07 Jan 2012

Yes, I can run this MB in dual channel mode. Right now I've got 2.5 passes of Memtest with module 2 and 3 in slots 1 & 5. I think I will give them 7 runs, shut down and try them with a cold boot.

If this works I can run in dual channel mode while I figure out a replacement plan. At the moment I'm thinking I'll replace the MB so I can go back to an overclocked triple channel LGA1366 system. There's still a lot of life in this PC, I can't really justify spending the money to upgrade to one of the newer chipsets, there is not enough of a performance boost.

I'll wait for a successful cold boot to call this case closed, but for now Thanks For All The Help, you truly saved me when I had run out of ideas. This forum is fantastic.

Cheers,
Brett