BSOD upon every Windows boot

RickZarber · 23 Mar 2011

Hi there. I'm running Win7 Professional 64 (self installed from--I think--an OEM system builder disk) on a year-old, self-built computer, and about a month ago it crashed while I was surfing the web; I haven't been able to use it since.

I get a BSOD every single time I try to run Windows. In normal mode, I get as far as my desktop and icons loading before it goes blue. In all other modes (ie, safe mode, last known good config, etc) it crashes just before the desktop appears.

I've found the BSOD is different nearly every time this happens. I've gotten everything from an IRQL_NOT_LESS_OR_EQUAL, to MEMORY_MANAGEMNT, to BAD_POOL_CALLER, to the latest, which had no title and simply pointed to a fault with the iaStorV.sys file... (Which I think I read is related to RAID control, but my Windows is not on a RAID drive--though there is one in my build.)

I'd include a dump file as specified, but I don't know how to provide that info if I can't even get into at least Safe Mode.

I've tried about every hardware ka-jiggering I can think of (unplugging, rewiring, swapping components) and nothing seems to change. I've run MemTest86 for 8 passes and found no errors. I've run chkdsk on all my drives and turned up nothing (that I can tell, anyway.) My internal temperatures seem to be okay. I'm inclined to think the problem is software based, but I have no idea what to do about it, or how to be absolutely sure.

Software-wise, System Restore only shows my latest restore point for some reason, and it fails every time I attempt it (while inside the Repair Tools menu, that is. If I try to load Windows immediately after, it tells me the restore is successful just prior to the BSOD. O.o) I've updated my BIOS as well.

I know I've tried other things that I can't remember at the moment--I've been troubleshooting this for a month now, and I'm starting to lose hope and patientce. If anyone has any suggestions for me, they would be most welcome and appreciated.

Jonathan_King · 23 Mar 2011

Hello,

I suspect a malware infection, honestly. A particular rootkit has been wreaking havoc for us lately, showing symptoms exactly as you described.

To complete the rest of these instructions, you will need a Windows installation DVD or a repair disc. If you have neither, create a repair disc.

Boot to the disc, and select "repair my computer". Open a command prompt, and enter the following:

Code:

bootrec /fixmbr
bootrec /fixboot

Before rebooting, run a startup repair from the disc a couple of times.

There is more we can try...let's see if that works first though.

RickZarber · 23 Mar 2011

Thanks for the advice! Wish I'd come here sooner... but then, I still probably would have had to check against those other possibilities...

Anyways, I did everything you suggested. Startup Repair (from the disc) detected no problems all 4-5 times I ran it. I then restarted my computer, and it crashed immediately after the Windows logo (no BSOD, just an instant reboot). I was then immediately sent to the hard drive-based Startup Repair, which did detect a problem, which it attempted to fix with a System Restore. Which, of course, failed.

I then booted from the disc again to run Startup Repair once more. It didn't find a problem, but when I looked into the full readout I did find this:

Code:

Root cause found:
 
Unknown Bugcheck: Bugcheck 7e. Parameters = 0xffffffffc0000005, 0xfffff880012e49b7, 0xfffff880039169778, 0xfffff880039161e0.
 
Repair action: System Restore
Result: Failed. Error code = 0x1f
Time taken = 67658 ms
 
Repair action: System files integrity check and repair
Result: Failed. Error code = 0x490
Time taken = 418488 ms

I'm crossing my fingers that any of that is helpful...

Jonathan_King · 24 Mar 2011

Just to make sure, you have run those bootrec commands, right?

If not, please do so; if you have, our next course of action is trying the Kaspersky TDSS Killer Tool from the command prompt.

Download the tool here: How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Extract the TDSSKiller.exe to a USB drive, right on the root directory (F:\, G:\, whatever the letter is).

Boot up the DVD or repair CD again, and open the command prompt as before. Enter the following:

Code:

f:\tdsskiller.exe

If you can an error about not finding that file, replace F with G, E or even H (if you have a lot of drives!)

RickZarber · 24 Mar 2011

Thanks Jonathan. I did run the bootrec commands the first time.

When I try to run tdsskiller.exe, the command prompt tells me: "The subsystem needed to support the image type is not present."

Jonathan_King · 24 Mar 2011

Let's try something new; you'll be my guinea pig here.

Attached is a copy of atapi.sys from my own system. Extract that file to the USB drive, and then boot up to the command prompt as before.

Code:

copy /y f:\atapi.sys c:\windows\system32\drivers

Replace F with the letter of your USB drive (should be the same as before), and if you still get an error saying cannot find file, replace C with D.

The rootkit I am suspecting modifies the atapi.sys file; manually replacing it may or may not help.

I suspect you are using a 64-bit Windows DVD, which may be the cause of the error "The subsystem needed to support the image type is not present." You might try downloading the 32-bit repair disc and running the Kaspersky TDSSKiller tool from there. Here's the tutorial for creating such a disc: System Repair Disc - Create

RickZarber · 24 Mar 2011

Well, copying the atapi.sys file went smoothly enough, but it didn't seem to make a difference.

I have three Windows discs on me: a 64bit OEM system builder disc (which I borrowed from a friend, and is what I used to install my OS originally), and both 64bit and 32bit store-bought Win7 upgrade discs (which I used to activate my software). I tried to use the system repair tools on the 32bit upgrade disc, but it told me that that version of the tools was incompatible with my installed OS, and to switch discs.

Should I go ahead and make a System Repair disc? (That'll have to wait for my roommate to get home; the notebook I'm on doesn't have a CD drive...)

As a seperate note, my PC is no longer showing a BSOD; it simlpy restarts seconds after the Windows logo appears every time, ever since I ran the bootrec commands....

Jonathan_King · 25 Mar 2011

If you have a 32-bit DVD, there is no need to create a repair disc. Bear in mind that while the tools such as startup repair and system restore may be specific to their respective OS versions (32,64-bit), the command prompts work on either.

You may also try running Startup Repair a few more times now from the DVD, see what happens.

RickZarber · 25 Mar 2011

I can't get to the command prompt on the 32bit DVD, though, since it's under the System Recovery Options, and that's what refuses to load. If there's another way to get to the command prompt, I don't know it.

I ran the startup repair several more times, off the 64bit DVDs and off my hard drive. The DVD version can never detect a problem, but the PC's version does--it just can't fix the problem... (I get the same error message as that bugcheck a couple of posts back.)

Jonathan_King · 25 Mar 2011

I'd feel so stupid if we went through all the effort of treating this as a malware problem, when it was really hardware. Run these tests real quick, just to get them out of the way.

RAM - Test with Memtest86+

SeaTools for DOS | Seagate