Windows 7: HELP! BSODs right after bootup finishes

fliz · 31 May 2010

I have no idea what's going on... Everything was fine on Friday. I leave, come back, turn it on today (Monday) and it crashes every time. Boots fine in safe mode w/ networking.

My catalist control center stops working on bootup right before the crash, too (if that helps).

thanks!

fliz · 31 May 2010

update: just got another BSOD while in safe mode /w networking (after the comp was on for 10 minutes or so).
Here's the newest minidump

xarden · 31 May 2010

Disable network adapter and try again.

fliz · 31 May 2010

then how do I check w/ you guys on what to do next? or how do I resolve the issue w/ the network adapter?

I'm not sure how to disable the network adapter except to boot in safe mode w/o network support...

Jonathan_King · 31 May 2010

The dmp suggests bad RAM. Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder. Boot from the CD, and leave it running for at least 5 passes.

I wonder if Microsoft Security Essentials is causing the error. Open an elevated command prompt and enter sfc /scannow.

A system restore may also help. If not, try a repair install.

Also try removing MSE and installing a fresh copy.

Please upload any new dmps that might come.

BSOD BUGCHECK SUMMARY

Code:


Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Debug session time: Mon May 31 19:26:09.793 2010 (GMT-4)
System Uptime: 0 days 0:17:04.683
BUGCHECK_STR:  0x19_3
PROCESS_NAME:  chrome.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Debug session time: Mon May 31 19:02:56.712 2010 (GMT-4)
System Uptime: 0 days 0:00:51.304
BUGCHECK_STR:  0x1a_5003
PROCESS_NAME:  WerFault.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Debug session time: Mon May 31 18:56:06.076 2010 (GMT-4)
System Uptime: 0 days 0:01:23.668
BUGCHECK_STR:  0x50
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Debug session time: Mon May 31 18:53:44.308 2010 (GMT-4)
System Uptime: 0 days 0:01:20.900
BUGCHECK_STR:  0x50
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Debug session time: Mon May 31 18:51:42.095 2010 (GMT-4)
System Uptime: 0 days 0:01:09.312
BugCheck A, {1d, 2, 0, 82e545a5}
Probably caused by : memory_corruption ( nt!MiResolveMappedFileFault+9d )
BUGCHECK_STR:  0xA
PROCESS_NAME:  svchost.exe

fliz · 31 May 2010

disabled network adapter and booted in normal mode. Crashed again. Here's the minidump

Jonathan king- Will check ram now... Can I use the built in ram checker? Burning the ISO is going to be tricky. (I have to hope that it won't crash while I'm burning it or installing the ISO recorder)

Jonathan_King · 31 May 2010

No, do not use the built-in checker. I guess it's okay if you want to, but just be sure to run Memtest when you're done. I have seen the built-in checker give a clean report when the RAM was bad.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\_jcgriff2_\dbug\__Kernel__\053110-27783-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82e40000 PsLoadedModuleList = 0x82f88810
Debug session time: Mon May 31 20:04:28.297 2010 (GMT-4)
System Uptime: 0 days 0:04:53.514
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
........
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00001097, (reserved)
Arg3: 194d4d57, Memory contents of the pool block
Arg4: a3ec2480, Address of the block of pool being deallocated

Debugging Details:
------------------

GetPointerFromAddress: unable to read from 82fa8718
Unable to read MiSystemVaType memory at 82f88160
*** WARNING: Unable to verify timestamp for tosrfcom.sys
*** ERROR: Module load completed but symbols could not be loaded for tosrfcom.sys
*** WARNING: Unable to verify timestamp for amdsbs.sys
*** ERROR: Module load completed but symbols could not be loaded for amdsbs.sys
*** WARNING: Unable to verify timestamp for amdxata.sys
*** ERROR: Module load completed but symbols could not be loaded for amdxata.sys
*** WARNING: Unable to verify timestamp for AtiPcie.sys
*** ERROR: Module load completed but symbols could not be loaded for AtiPcie.sys
*** WARNING: Unable to verify timestamp for ahcix86s.sys
*** ERROR: Module load completed but symbols could not be loaded for ahcix86s.sys
*** WARNING: Unable to verify timestamp for spldr.sys
*** ERROR: Module load completed but symbols could not be loaded for spldr.sys
*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
*** WARNING: Unable to verify timestamp for nusb3xhc.sys
*** ERROR: Module load completed but symbols could not be loaded for nusb3xhc.sys
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*** WARNING: Unable to verify timestamp for nusb3hub.sys
*** ERROR: Module load completed but symbols could not be loaded for nusb3hub.sys
*** WARNING: Unable to verify timestamp for MAudioDelta.sys
*** ERROR: Module load completed but symbols could not be loaded for MAudioDelta.sys
*** WARNING: Unable to verify timestamp for RtHDMIV.sys
*** ERROR: Module load completed but symbols could not be loaded for RtHDMIV.sys
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for drmk.sys
*** WARNING: Unable to verify timestamp for RTKVHDA.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHDA.sys
*** WARNING: Unable to verify timestamp for tosporte.sys
*** ERROR: Module load completed but symbols could not be loaded for tosporte.sys
*** WARNING: Unable to verify timestamp for tosrfusb.sys
*** ERROR: Module load completed but symbols could not be loaded for tosrfusb.sys
*** WARNING: Unable to verify timestamp for tosrfbd.sys
*** ERROR: Module load completed but symbols could not be loaded for tosrfbd.sys
*** WARNING: Unable to verify timestamp for Tosrfhid.sys
*** ERROR: Module load completed but symbols could not be loaded for Tosrfhid.sys
*** WARNING: Unable to verify timestamp for dump_ahcix86s.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_ahcix86s.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
*** WARNING: Unable to verify timestamp for TSDDD.dll
*** ERROR: Module load completed but symbols could not be loaded for TSDDD.dll
*** WARNING: Unable to verify timestamp for cdd.dll
*** ERROR: Module load completed but symbols could not be loaded for cdd.dll
*** WARNING: Unable to verify timestamp for peauth.sys
*** ERROR: Module load completed but symbols could not be loaded for peauth.sys
*** WARNING: Unable to verify timestamp for secdrv.SYS
*** ERROR: Module load completed but symbols could not be loaded for secdrv.SYS
*** WARNING: Unable to verify timestamp for MpNWMon.sys
*** ERROR: Module load completed but symbols could not be loaded for MpNWMon.sys
*** WARNING: Unable to verify timestamp for gdrv.sys
*** ERROR: Module load completed but symbols could not be loaded for gdrv.sys
*** WARNING: Unable to verify timestamp for ALSysIO.sys
*** ERROR: Module load completed but symbols could not be loaded for ALSysIO.sys
*** WARNING: Unable to verify timestamp for spsys.sys
*** ERROR: Module load completed but symbols could not be loaded for spsys.sys
GetPointerFromAddress: unable to read from 82fa8718
Unable to read MiSystemVaType memory at 82f88160

POOL_ADDRESS: GetPointerFromAddress: unable to read from 82fa8718
Unable to read MiSystemVaType memory at 82f88160
 a3ec2480 

BUGCHECK_STR:  0xc2_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 830588a7 to 82f5f1b6

STACK_TEXT:  
8df8fc6c 830588a7 a3ec2480 00000000 8f84d0a8 nt!ExFreePoolWithTag+0x1b1
8df8fc80 83058a1f 00000000 8f84d0a8 00000000 nt!CmpCleanUpKcbValueCache+0x3e
8df8fc94 830763ed 00000000 8f84d0a8 8f84d0c8 nt!CmpCleanUpKcbCacheWithLock+0x25
8df8fcb4 83087bd1 8f84d0a8 00000000 82fa7080 nt!CmpDereferenceKeyControlBlockWithLock+0x8d
8df8fce4 8305842d 82f7a5bc 82fa7070 8577c798 nt!CmpDereferenceKeyControlBlock+0x11b
8df8fd00 82eadf2b 00000000 00000000 8577c798 nt!CmpDelayDerefKCBWorker+0xea
8df8fd50 8304e66d 00000001 a513f2c5 00000000 nt!ExpWorkerThread+0x10d
8df8fd90 82f000d9 82eade1e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExFreePoolWithTag+1b1
82f5f1b6 cc              int     3

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExFreePoolWithTag+1b1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc007

FAILURE_BUCKET_ID:  0xc2_7_nt!ExFreePoolWithTag+1b1

BUCKET_ID:  0xc2_7_nt!ExFreePoolWithTag+1b1

Followup: MachineOwner
---------

fliz · 31 May 2010

Hey Jonathan,

I used the built in checker because I couldn't load windows to burn the iso. The built in checker found errors, so I took one of the 2gb chips out (leaving one behind) and ran the checker again, this time no errors. I booted normally and everything's working fine. I ran sfc /scannow and it fixed some files. I checked the log and it looks like the only files it fixed were the ones I changed intentionally (explorer.exe for user frames and shell32.dll for replacement control panel frames, and a few theme ones that were patched by vistaglazz). here's the log. Can you confirm this?

Also, since everything's working fine now (I think)... Thanks! Now I need to hassle G.skill to get the RAM replaced.

How did you know it was the ram?

thanks again

-f

Jonathan_King · 01 Jun 2010

Quote: Originally Posted by fliz

How did you know it was the ram?

Many bugchecks suggest bad hardware, and one of the dmps pointed to memory_corruption.

Plus the last dmp was so corrupted, I have to blame RAM.

fliz · 01 Jun 2010

Hey Jonathan,

I just wanted to give you an update.

I went to the newegg product page for my ram (g.skill ddr3-1600 2x2gb), and there were a number of bad reviews all complaining of the same thing (cold boot BSODs)

One person even had the exact same motherboard and cpu (gigabyte ga-785GMT -usb3 and AMD II X4 630)

G.skill responded to his review with the suggestion to set the timings manually at 9-9-9-24 at DDR3-1600.

I noticed that the auto settings were 9-9-9-24 at DDR-1333, so I changed them, and ran memtest86+ for 6 hours (6 passes) and it found 0 errors.

now I booted normally and everything is working fine.

Does this make sense? should changing the ram speed from 1333 to 1600 really make it suddenly completely reliable?

Is there anything I can do to see if I can get the BSOD to happen again? do I want to, or should I just be happy that everything seems to be working fine.

the ram's warranty is lifetime, so I don't have and deadline to get it replaced by...

thanks again

-f

Windows 7: HELP! BSODs right after bootup finishes

HELP! BSODs right after bootup finishes problems?