Win 7 crashes and then reboots

Hi XCACHEMAN4.

Uninstall any BestCrypt program you are using such as BCWipe.

Let us know the result.
__________________________________

Code:

fffff880`0b46c950  fffff880`0140d101Unable to load image \SystemRoot\System32\Drivers\fsh.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for fsh.sys
*** ERROR: Module load completed but symbols could not be loaded for fsh.sys
 fsh+0xd101

XCACHEMAN4 said:

Guys,
I really appreciate your efforts to solve my problem and I would jump on your recommended solution except for two reasons; first, BCWipe is a download and if I uninstall it, I would have problems reloading it(I probably could just copy the serial number and reuse it to reload the program later), two, I have had BCWipe on my machine since I got the machine(three years ago) and my BSOD problems only started about six months ago with a short hiatus when a site suggested I download MS Debug so I could read the .dmp files. So if you still suggest that fix(uninstall BCWipe), I will go ahead and let you know what happens.

thanks again,

XCACHEMAN4

You had been lucky.

Click on the button below ....



It will download the DM log collector. Right click on the application and run as administrator. It will generate a .zip file on your desktop. Upload the .zip.
Screenshots and Files - Upload and Post in Seven Forums

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.

Either uninstall GUID Partition Table Support Driver or update it to latest.

gpt_loader GUID Partition table support driver c:\windows\system32\drivers\gpt_loader.sys Kernel Driver Yes Boot Running OK Ignore No Yes

Then disable Driver verifier.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the system configuration window, with the "general" tab selected.

• Click the "startup" tab. Click "Disable all" > Apply > OK.
• Click on "services" tab. Check the "Hide all Microsoft Services"; Click "Disable all" > Apply > OK

Then run the computer normally and let us know if there is any further BSOD.
______________________________

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {d5, fffffa800f5fe470, fffff980017a0de0, 0}

*** WARNING: Unable to verify timestamp for gpt_loader.sys
*** ERROR: Module load completed but symbols could not be loaded for gpt_loader.sys
Probably caused by : gpt_loader.sys ( gpt_loader+97a5 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000d5, IoReleaseRemoveLock tag doesn't match previous IoAcquireRemoveLock tag.
Arg2: fffffa800f5fe470, Address of the chk build Remove Lock structure.
Arg3: fffff980017a0de0, Tag that doesn't match previous IoAcquireRemoveLock tag.
    If the driver calling IoReleaseRemoveLock is not built chk,
    Parameter 2 is the chk build Remove Lock used by the Driver Verifier
    on behalf of the driver. In this case, the address of the RemoveLock
    used by the driver is not used at all, because the Driver Verifier is
    replacing the lock address for all the Remove Lock APIs.
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_d5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff8000370c4ec to fffff8000327fbc0

STACK_TEXT:  
fffff880`03099aa8 fffff800`0370c4ec : 00000000`000000c4 00000000`000000d5 fffffa80`0f5fe470 fffff980`017a0de0 : nt!KeBugCheckEx
fffff880`03099ab0 fffff800`0370defd : fffff980`017a0000 fffff980`017a0de0 00000000`00000001 0000000a`00002000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`03099af0 fffff800`03301cdf : fffffa80`0f5fe460 fffff800`0371bf33 fffff980`017a0de0 00000000`00000080 : nt!VfRemLockReportBadReleaseTag+0x1d
fffff880`03099b30 fffff880`014677a5 : 00000000`00000000 fffff980`017a0da0 fffff980`017a0da0 00000000`00000080 : nt! ?? ::FNODOBFM::`string'+0x4db8d
fffff880`03099ba0 00000000`00000000 : fffff980`017a0da0 fffff980`017a0da0 00000000`00000080 fffff880`01467750 : gpt_loader+0x97a5


STACK_COMMAND:  kb

FOLLOWUP_IP: 
gpt_loader+97a5
fffff880`014677a5 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  gpt_loader+97a5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: gpt_loader

IMAGE_NAME:  gpt_loader.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cf8f313

FAILURE_BUCKET_ID:  X64_0xc4_d5_VRF_gpt_loader+97a5

BUCKET_ID:  X64_0xc4_d5_VRF_gpt_loader+97a5

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xc4_d5_vrf_gpt_loader+97a5

FAILURE_ID_HASH:  {d16b33da-5646-7ca9-171b-36735b85d990}

Followup: MachineOwner
---------

2: kd> lmvm gpt_loader
start             end                 module name
fffff880`0145e000 fffff880`01471000   gpt_loader T (no symbols)           
    Loaded symbol image file: gpt_loader.sys
    Image path: \SystemRoot\system32\DRIVERS\gpt_loader.sys
    Image name: gpt_loader.sys
    Timestamp:        Fri Dec 03 19:09:31 2010 (4CF8F313)
    CheckSum:         0001CABD
    ImageSize:        00013000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4