Slow bootup, BSOD after selecting user, CHKDSK errors, loss of video

seligman · 05 Sep 2013

Windows 7 Professional 64-bit
AMD Phenom II X2 550 Black (3.1 GHz dual-core)
ASUS M4A77TD Pro Motherboard
G.Skill DDR3-1600 memory 4 GB
EVGA GeForce 9500 GT 1GB video
Western Digital 1TB WD10EADS Caviar Green

I built this computer for my uncle in 2009. He called me after BSOD problems prevented access to the desktop after entering a password for the user account selected. I left my crash dump notes at his house unfortunately, but it's a IRQL_NOT_LESS_THAN_EQUAL error. The secondary problem is extremely slow boot times, even into safe mode, often taking 7-10 minutes -- but this has been building over several months, long before the recent BSOD issue.

These problems have me scratching my head. No two boot attempts are exactly like. The only thing they have in common is they take forever. My intuition says malware or viruses but Avast, AVG, Malwarebytes, SuperAntiSpyware haven't found anything that classifies as a virus or rootkit. Found a weaker browser hijacker but I researched its symptoms and it doesn't cause these kinds of problems. I ran other diagnostic tools from portable media (USB stick) with the same results. Summary of symptoms:

Boot Up
About 1 in 5 times it tries to boot normally. After the login screen the BSOD error prevents us from getting any further. About 3 in 5 times, Windows 7 detects there is trouble and automatically loads the Advanced Boot Options screen with "Repair Windows" as the first option. The available diagnostic options haven't fixed any problems. The remaining times it loads Advanced Boot Options with much fewer choices, usually just a few different versions of Safe Mode.

The computer almost always boots to Safe Mode just fine, but takes forever.

RAM
I isolated each stick of RAM to check for problems. There was surprisingly no performance or speed difference with 2GB compared to 4GB with either stick isolated. This is true of the long boot times and the way it performed in safe mode. I couldn't tell a difference. In the past I've found that machines heavily infested with viruses or malware eat up so much available RAM that splitting the RAM in half is easily discernible afterwards. Not here. Both sticks passed the Windows Memory Diagnostics Tool but I haven't attempted MemTest86 yet.

System Restore
My uncle booted with the Windows 7 disc last night and attempted a system restore point. The first one he tried failed and Windows indicated the restore point might be corrupted on the hard drive. Afterwards it ran CHKDSK and came up with several "deleting index entry" and "correcting error in index" and "recovering orphaned files" and "verifying security descriptors" and "inserting data attribute" notations.

I repeated the restore process later with the next available system restore point. It went through everything and gave the congratulatory "Finished" message, followed by another message saying "System Restore did not Complete Successfully ... An unspecified error occurred during System Restore 0x800700b7".

Then it repeated the same CHKDSK process, finding and correcting the same type of problems described above. After a reboot back into Safe Mode, a message appeared saying that the System Restore was successful, and I verified that to be true based on the newer-installed programs that were now missing.

I realize System Restore has limited usefulness but what's up with the conflicting messages and CHKDSK problems?

Loss of video
During one of the long boot ups to safe mode, the monitor lost video signal for a couple minutes. I toggled the power on the monitor and eventually a white Windows cursor appeared on an otherwise all black screen. I could move the cursor around, so the PC wasn't frozen, but it wasn't a normal Windows screen either. I forget now if the PC eventually booted into Safe Mode.

~~~~~~~~~~

With the CHKDSK issues, and especially the loss of video, I'm now suspicious of hardware problems and maybe even corrupted drivers?

Tonight I left my uncle's house with Avast and Malwarebytes running the most thorough full scans they are capable of doing.

What should I look for next if nothing is found?

Arc · 05 Sep 2013

Boot into safe mode and post it following the Blue Screen of Death (BSOD) Posting Instructions.

seligman · 05 Sep 2013

Here are the logs. Still working to remove/detect possible malware items.

seligman · 05 Sep 2013

Any luck with the logs?

I hate to be a pest about this. My uncle needs to go to bed in about 90 minutes and I'd love to be able to fix something tonight. Otherwise it's another trip out here tomorrow. TIA

Arc · 06 Sep 2013

Be patience. Other people also have their works too.

Avast is contributing to this issue.

Code:

fffff880`02fee7f8  fffff880`03de38cbUnable to load image \SystemRoot\System32\Drivers\aswrdr2.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswrdr2.sys
*** ERROR: Module load completed but symbols could not be loaded for aswrdr2.sys
 aswrdr2+0x28cb

Uninstall Avast using Avast Uninstall Utility. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.
For some safety need, Scan the system for possible virus infection with the following programs, too.

Dont overlook it, there is some good reason to do these too scans. Even if they dont catch anything.

And, the display driver, too.

Code:

fffff880`02ffd938  fffff880`05836accUnable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 nvlddmkm+0x193acc

This is a known buggy driver version.

Code:

fffff880`056a3000 fffff880`0614a000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Fri Jan 18 18:52:15 2013 (50F94C87)
    CheckSum:         00A92B69
    ImageSize:        00AA7000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Uninstall it as follows and Install the 314.22 WHQL only.

Uninstall All nvidia items in Control Panel > Programs and features
- 3D Vision Control Driver
- 3D Vision Driver
- Graphics Driver
- HD Audio Driver
- PhysX
- nvidia Update
(Are you using nvidia chipset drivers? If so, dont uninstall anything other than those are listed).
Now follow Drivers - Clean Left over Files after Uninstalling
Boot normally now. Go to Drivers - Download NVIDIA Drivers, Download 314.22 WHQL. While installing, Select Custom (Advanced) install. In the next page, follow this settings:

Let us know the results.