Windows 7 - BSOD in Startup

ramdom · 04-23-2010

Hello. Can someone help me. I am experiencing a BSOD upon startup.
Please Help.. It occurs upon loading windows.

Thanks in Advance

Attached is my Dump File..

zigzag3143 · 04-23-2010

Quote: Originally Posted by ramdom

Hello. Can someone help me. I am experiencing a BSOD upon startup.
Please Help.. It occurs upon loading windows.

Thanks in Advance

Attached is my Dump File..

This crash was caused by Mpfilter.sys which is a part of the win 7 malware protection. Since it is an OS file I would run a system file check to verify and repair your OS files

To do that type cmd in search>right click and run as admin>sfc /scannow

let us know the results

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\042310-17300-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c65000 PsLoadedModuleList = 0xfffff800`02ea2e50
Debug session time: Fri Apr 23 21:39:31.725 2010 (GMT-4)
System Uptime: 0 days 0:00:16.083
Loading Kernel Symbols
...............................................................
................................................................

Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff87fffdc9350, 0, fffff88000de52c0, 5}

Unable to load image \SystemRoot\system32\DRIVERS\MpFilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys

Could not read faulting driver name
Probably caused by : MpFilter.sys ( MpFilter+202c0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff87fffdc9350, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88000de52c0, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0d0e0
 fffff87fffdc9350 

FAULTING_IP: 
MpFilter+202c0
fffff880`00de52c0 ff158a40fefe    call    qword ptr [fffff87f`ffdc9350]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  services.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88006913cb0 -- (.trap 0xfffff88006913cb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000007 rbx=0000000000000000 rcx=fffffa8004d74a90
rdx=fffffa8004d74900 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000de52c0 rsp=fffff88006913e40 rbp=fffff8a0032af330
 r8=0000000000000015  r9=fffffffffd128ef0 r10=fffff8a0032af3a8
r11=00000000000002bc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
MpFilter+0x202c0:
fffff880`00de52c0 ff158a40fefe    call    qword ptr [fffff87f`ffdc9350] ds:9540:fffff87f`ffdc9350=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d54b91 to fffff80002cd6f00

STACK_TEXT:  
fffff880`06913b48 fffff800`02d54b91 : 00000000`00000050 fffff87f`ffdc9350 00000000`00000000 fffff880`06913cb0 : nt!KeBugCheckEx
fffff880`06913b50 fffff800`02cd4fee : 00000000`00000000 00000000`00000080 fffff880`06913f00 fffff800`02e4fe80 : nt! ?? ::FNODOBFM::`string'+0x40f5b
fffff880`06913cb0 fffff880`00de52c0 : 00000000`00000238 00000000`00000001 fffff8a0`032af330 fffff880`00dcb128 : nt!KiPageFault+0x16e
fffff880`06913e40 00000000`00000238 : 00000000`00000001 fffff8a0`032af330 fffff880`00dcb128 00000000`006a0000 : MpFilter+0x202c0
fffff880`06913e48 00000000`00000001 : fffff8a0`032af330 fffff880`00dcb128 00000000`006a0000 00000000`000007ff : 0x238
fffff880`06913e50 fffff8a0`032af330 : fffff880`00dcb128 00000000`006a0000 00000000`000007ff 00000000`00000000 : 0x1
fffff880`06913e58 fffff880`00dcb128 : 00000000`006a0000 00000000`000007ff 00000000`00000000 00000000`0000000b : 0xfffff8a0`032af330
fffff880`06913e60 00000000`006a0000 : 00000000`000007ff 00000000`00000000 00000000`0000000b 00000000`000002c4 : MpFilter+0x6128
fffff880`06913e68 00000000`000007ff : 00000000`00000000 00000000`0000000b 00000000`000002c4 00000000`00000000 : 0x6a0000
fffff880`06913e70 00000000`00000000 : 00000000`0000000b 00000000`000002c4 00000000`00000000 fffff8a0`00000030 : 0x7ff


STACK_COMMAND:  kb

FOLLOWUP_IP: 
MpFilter+202c0
fffff880`00de52c0 ff158a40fefe    call    qword ptr [fffff87f`ffdc9350]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  MpFilter+202c0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MpFilter

IMAGE_NAME:  MpFilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49adab31

FAILURE_BUCKET_ID:  X64_0x50_MpFilter+202c0

BUCKET_ID:  X64_0x50_MpFilter+202c0

Followup: MachineOwner
---------

ramdom · 04-23-2010

@ZIGZAG3143
Thanks for your reply. I did try SFC /scannow as you advised but it returned no errors
[WINDOWS RESOURCE PROTECTION DID NOT FIND ANY INTEGRITY VIOLATIONS]

Any more suggestions? Is there anyway I can fix this without re installing windows 7?

Thanks..

Attached are more dumpfiles..

ramdom · 04-23-2010

anyone? please help

zigzag3143 · 04-23-2010

Quote: Originally Posted by ramdom

anyone? please help

How often does it BSOD?

ramdom · 04-23-2010

@ZIGZAG3143

every start up

zigzag3143 · 04-23-2010

Quote: Originally Posted by ramdom

@ZIGZAG3143

every start up

Eek

Ok lets take a look in event viewer (type eventvwr in search). You need to go to windows logs>application tab.

Look for critical errors (they have red in the left column).

You want to look for anything that relates t o start up, or app hang, or app crash. When you find them note the Event ID and source codes and relay them to us.

If there is nothing there we should get more agressive by using driver verifier. Driver verifier will make your machine crash so you should have a restore point set and a backup made. You will also need a win 7 DVD

Ken

ramdom · 04-24-2010

these are criticals error i found (red).
please help thanks

1. Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
The content source <csc://{S-1-5-21-1381740123-1315006925-455402831-1000}/> cannot be accessed.

2. Faulting application name: svchost.exe_BFE, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: RPCRT4.dll, version: 6.1.7600.16385, time stamp: 0x4a5be035
Exception code: 0xc0000005

3. Faulting application name: iw3mp.exe, version: 0.0.0.0, time stamp: 0x4859a219
Faulting module name: iw3mp.exe, version: 0.0.0.0, time stamp: 0x4859a219
Exception code: 0xc0000005

4. The winlogon notification subscriber <GPClient> failed

5. Faulting application name: svchost.exe_Winmgmt, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1

6. Faulting module name: wmiutils.dll, version: 6.1.7600.16385, time stamp: 0x4a5be104
Exception code: 0xc0000005
Fault offset: 0x000000000001873c
Faulting process id: 0x4f8
Faulting application start time: 0x01cadc9acf70f313
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\system32\wbem\wmiutils.dll
Report Id: 0f5666d5-488e-11df-a749-40618697e387

Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070005, Access is denied.
.
Faulting application name: reader_sl.exe, version: 9.0.0.332, time stamp: 0x4850ee71
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005

Faulting application name: MsMpEng.exe, version: 2.0.5612.0, time stamp: 0x49c933c7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0000000000000000

ramdom · 04-24-2010

please help

Windows 7 - BSOD in Startup

BSOD in Startup problems?