Windows 7 - Windows 7 machine - BSOD at startup - ntoskrnl.exe and ntkrnlmp.exe

melloj · 02-01-2012

Hello all,

Last night I shut down my system without any incident - as I was turning it off, it said it had to do a windows update and would shut off afterwards (as many times before).

However today when I went to turn on my computer, it goes through post, starts loading windows and then BSOD's. I can get into safe mode with networking fine and have run whocrashed which shows as follows:

On Tue 31/01/2012 10:31:03 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\013112-28267-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7CC40)
Bugcheck code: 0xF4 (0x3, 0xFFFFFA800BA8B960, 0xFFFFFA800BA8BC40, 0xFFFFF80003B9C8B0)
Error: CRITICAL_OBJECT_TERMINATION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

On Tue 31/01/2012 10:31:03 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xF4 (0x3, 0xFFFFFA800BA8B960, 0xFFFFFA800BA8BC40, 0xFFFFF80003B9C8B0)
Error: CRITICAL_OBJECT_TERMINATION
Bug check description: This indicates that a process or thread crucial to system operation has unexpectedly exited or been terminated.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

This is a pretty new build that is overclocked but has been rock solid stable until last night. I do not believe that it is the OC that is causing the issue as there is very good cooling on here.

I have an ASRock P67 motherboard
Intel i7 2600K
8GB Ram
2 EVGA GTX 460 via SLI
2 TB Western Digital hard drive.
Windows 7 65 bit OEM Service Pack 1, 6.1, build: 7601

melloj · 02-01-2012

Attached jgriff system analysis. The system health report kept saying invalid path.

melloj · 02-01-2012

Just for the sake of it, I restored my BIOS defaults (i.e. removed the overclocking) and tried to boot windows normally, but same issue arose.

My suspicion is that something got messed up last night when the Windows update was doing its thing - unfortunately I did not stick around to see what the update was.

writhziden · 02-01-2012

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [K:\BSODDmpFiles\melloj\Windows_NT6_BSOD_jcgriff2\013112-28267-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0381c000 PsLoadedModuleList = 0xfffff800`03a61670
Debug session time: Tue Jan 31 15:31:03.099 2012 (GMT-7)
System Uptime: 0 days 0:00:26.911
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800ba8b960, fffffa800ba8bc40, fffff80003b9c8b0}

Probably caused by : wininit.exe

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800ba8b960, Terminating object
Arg3: fffffa800ba8bc40, Process image file name
Arg4: fffff80003b9c8b0, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa800ba8b960

IMAGE_NAME:  wininit.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: wininit

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  wininit.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000135 - The program can't start because %hs is missing from your computer. Try reinstalling the program to fix this problem.

BUGCHECK_STR:  0xF4_C0000135

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`0301b9c8 fffff800`03c235e2 : 00000000`000000f4 00000000`00000003 fffffa80`0ba8b960 fffffa80`0ba8bc40 : nt!KeBugCheckEx
fffff880`0301b9d0 fffff800`03bd099b : ffffffff`ffffffff fffffa80`0ba89b60 fffffa80`0ba8b960 fffffa80`0ba8b960 : nt!PspCatchCriticalBreak+0x92
fffff880`0301ba10 fffff800`03b50448 : ffffffff`ffffffff 00000000`00000001 fffffa80`0ba8b960 0000007f`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`0301ba60 fffff800`03897ed3 : fffffa80`0ba8b960 00000000`c0000135 fffffa80`0ba89b60 000007ff`fffd9000 : nt!NtTerminateProcess+0xf4
fffff880`0301bae0 00000000`77cb15da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0014f398 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77cb15da


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_C0000135_IMAGE_wininit.exe

BUCKET_ID:  X64_0xF4_C0000135_IMAGE_wininit.exe

Followup: MachineOwner
---------

If you believe it is related to Windows Update, use the Advanced Boot Options and select Repair Your Computer to get into the System Recovery Options. Then select System Restore and run through OPTION TWO of System Restore to restore to a time before the updates were installed.

The fact that your crash was related to a critical system file crashing supports the hypothesis that it was update related; sometimes if updates do not install correctly, they can corrupt system files. Reverting to a restore point and then re-installing may fix the problem. If not, do the system restore again and install the updates one at a time until you determine which is the culprit for your blue screen crashes.

melloj · 02-01-2012

Hi - thanks for the reply.

I did try the system restore. Unfortunately, for whatever reason, the last restore point was back in September. Nonetheless, I started the restore, but upon reboot when windows was starting up, the BSOD again occurred.

Starting up in safe mode I am greeted with the message that the system was restored to the selected restore point. So it seems to have worked, but the issue has not been resolved.

I suspect that at this point all that is left to me is a fresh install of windows.

Do the dump/report files indicate that there could be anything else I could try (eg removing a driver?)

Thanks.

writhziden · 02-01-2012

Before doing a fresh install of Windows and having the aggravated hassle of doing so, you may try the following steps.

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.

melloj · 02-03-2012

I haven't been able to find time to have the chkdsk run on my C: drive yet - I started it this morning but had to leave and I assume after it completed, it tried to reset and then crashed - in any event the event checker does not show the wininit entry to the c: drive chkdsk run. Will likely have to try tomorrow evening.

However, I did run the chkdsk on my d: drive and attach the report. FYI, I have one 2 TB hard drive partitioned into 2 drives c: (500GB) and d: (1.5TB), so if there were issues with the drive it likely would have found something in the chkdsk for drive d: as well.

I also ran the system file checker - first run did not report any integrity violations.

I attach the report for the d: chkdsk for now.

writhziden · 02-03-2012

D: came up clean. I still recommend running for C:. If you cannot run normally, try running through the recovery environment.

Use Advanced Boot Options to select Repair Your Computer and get to the System Recovery Options. Then select the command prompt. Do the following:

chkdsk /r c:
chkdsk /r d:
chkdsk /r e:
chkdsk /r f:

.etc until you get the message that the volume could not be found. For any drives that do not give the message:
"Windows has checked the file system and found no problems"
run chkdsk again as above.

I realize you may only have one disk show up in Windows explorer, but you may have more than one disk through recovery options. This is because the system creates a hidden boot partition (which will be C: in recovery), you may have a recovery partition for your PC that is hidden (which will be D: in recovery), and you will have your primary Windows partition (which may be E: in recovery). A custom PC will likely have at least C: and D: to scan.

If you only want to run your C: drive, check disk management (Start Menu -> Right Click Computer -> Manage -> Disk Management from the list on the left) and see if you have a partition before (to the left of) the C: partition for the Disk # layout. For instance, my layout has a hidden recovery partition to the left of C:, and the recovery partition would be C: in the recovery environment, and then C: would be D: in the recovery environment. The partition furthest to the left is C:, the next one D:, then E:, and so on in the recovery environment.

melloj · 02-04-2012

Hello,

The C: drive scheduled chkdsk ran its course.

I attach the log file for the event. Interested to see if there is anything else that could still be done.

Many thanks for your help

writhziden · 02-04-2012

Alright, looks clean, so if it is Windows related, you may have to do a Repair Install to fix it. If you prefer, you can also proceed to Clean Install Windows 7.

Any update on whether re-installing helped?

Windows 7 - Windows 7 machine - BSOD at startup - ntoskrnl.exe and ntkrnlmp.exe

Windows 7 machine - BSOD at startup - ntoskrnl.exe and ntkrnlmp.exe problems?