Windows 7 Pro - BSOD at Welcome screen

executi0n said:

Hi,

So I have a laptop here that is giving a BSOD after the 'Welcome' screen. It loads fine into safe mode, and stays there for as long as I leave it, so I'm still able to access the system. The only thing that goes wrong in safe mode is when I right-click on anything, explorer freezes and then crashes.

I have tried system restores, but they all fail saying that file X is unable to be extracted/restored. (Various files for each restore point).

Attached is the MiniDump folder and the files which will hopefully shed some light on it.

System Information
The laptop itself is a Toshiba Satellite L300 running Windows 7 Professional 32bit. Windows 7 was installed on the 11th of April, 2011.

Intel T3400
2GB RAM
Win7Pro SP1

BSOD Information
STOP: 0x0000007e (0xC0000006, 0x82E5AF85, 0x807F9930, 0x807F9510)

I hope that this is enough information. I have tried installing Speccy on the laptop, but the install freezes and closes off, so I couldn't get any more details for that.

Thanks,
executi0n

[Edit]: Attached a quick (bad quality) video showing when the BSOD occurs.

Virtually all of these were related to disk hardware. Please start by running a chkdsk


A- CHKDSK /R /F:

Run CHKDSK /R /F from an elevated (Run as administrator) Command Prompt.

Do this for each hard drive on your system.

When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter.

Then reboot and let the test run.

It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors.

See "CHKDSK LogFile" below in order to check the results of the test.


B- Elevated Command Prompt:

Go to Start and type in "cmd.exe" (without the quotes)

At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"


C-CHKDSK LogFile:

Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter

Expand the Windows logs heading, then select the Application log file entry.

Double click on the Source column header.

Scroll down the list until you find the Chkdsk entry (wininit for Win7) (winlogon for XP).

Copy/paste the results into your next post.

I ran the CHKDSK and there were a few files that windows fixed, including some that I replaced after they came up during the sfc /scannow test, so they still must not have been working even after replacing them.

After it completed, it restarted and loaded into windows straight away, so that seems to have fixed that for now. I'll keep having a play around with it for now though, install the updates,etc remove any unwanted programs and just do some general clean up before letting them know its good to go.

Cheers.

Here is the paste from the chkdsk event:

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
103168 file records processed. File verification completed.
199 large file records processed. 0 bad file records processed. 2 EA records processed. 44 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
131540 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
103168 file SDs/SIDs processed. Cleaning up 774 unused index entries from index $SII of file 0x9.
Cleaning up 774 unused index entries from index $SDH of file 0x9.
Cleaning up 774 unused security descriptors.
Security descriptor verification completed.
14187 data files processed. CHKDSK is verifying Usn Journal...
35693632 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc000009c at offset 0x3d6f000 for 0xb000 bytes.
Read failure with status 0xc000009c at offset 0x3d78000 for 0x1000 bytes.
Windows replaced bad clusters in file 11788
of name \Windows\Fonts\angsa.ttf.
Read failure with status 0xc000009c at offset 0x7e24000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x7e26000 for 0x1000 bytes.
Windows replaced bad clusters in file 11798
of name \Windows\Fonts\angsaub.ttf.
Read failure with status 0xc000009c at offset 0x80c1000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x80c6000 for 0x1000 bytes.
Windows replaced bad clusters in file 11871
of name \Windows\Fonts\calibri.ttf.
Read failure with status 0xc000009c at offset 0x8a70000 for 0x3000 bytes.
Read failure with status 0xc000009c at offset 0x8a72000 for 0x1000 bytes.
Windows replaced bad clusters in file 12434
of name \Windows\Fonts\trebucit.ttf.
Read failure with status 0xc000009c at offset 0x70ba000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x70c9000 for 0x1000 bytes.
Windows replaced bad clusters in file 12757
of name \Windows\rescache\rc0004\Segment1.cmf.
Read failure with status 0xc000009c at offset 0x6eac000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x6eba000 for 0x1000 bytes.
Read failure with status 0xc000009c at offset 0x6edb000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x6eea000 for 0x1000 bytes.
Read failure with status 0xc000009c at offset 0x6f9b000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x6faa000 for 0x1000 bytes.
Windows replaced bad clusters in file 16687
of name \Users\Mark\AppData\Local\MICROS~1\Windows\Explorer\THUMBC~4.DB.
Read failure with status 0xc000009c at offset 0x5533000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x5541000 for 0x1000 bytes.
Windows replaced bad clusters in file 17379
of name \Windows\winsxs\X8D176~1.163\d3d10.dll.
Read failure with status 0xc000009c at offset 0x55f9000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x5600000 for 0x1000 bytes.
Windows replaced bad clusters in file 17467
of name \Windows\winsxs\X87491~1.163\difxapi.dll.
Read failure with status 0xc000009c at offset 0x7fcc000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x7fd6000 for 0x1000 bytes.
Windows replaced bad clusters in file 17486
of name \Windows\winsxs\x86_microsoft-windows-displayswitch_31bf3856ad364e35_6.1.7600.16385_none_ec98071c85cf09eb\DISPLA~1.EXE.
Read failure with status 0xc000009c at offset 0x3f51000 for 0xd000 bytes.
Read failure with status 0xc000009c at offset 0x3f57000 for 0x1000 bytes.
Windows replaced bad clusters in file 17881
of name \Windows\System32\DRIVER~1\FILERE~1\USBSTO~1.INF\usbstor.PNF.
Read failure with status 0xc000009c at offset 0x3d43000 for 0x5000 bytes.
Read failure with status 0xc000009c at offset 0x3d45000 for 0x1000 bytes.
Windows replaced bad clusters in file 20178
of name \Windows\System32\catroot\{F750E~1\prnsv003.cat.
Read failure with status 0xc000009c at offset 0x7dee000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x7df7000 for 0x1000 bytes.
Windows replaced bad clusters in file 32012
of name \Users\Mark\AppData\LocalLow\MICROS~1\CRYPTN~1\Content\A8FABA~1.
Read failure with status 0xc000009c at offset 0x1989b4000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x1989bf000 for 0x1000 bytes.
Windows replaced bad clusters in file 41353
of name \hiberfil.sys.
Read failure with status 0xc000009c at offset 0x7659000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x7659000 for 0x1000 bytes.
Windows replaced bad clusters in file 49688
of name \Windows\winsxs\X89192~1.164\ieapfltr.dll.
Read failure with status 0xc000009c at offset 0x8981000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x8983000 for 0x1000 bytes.
Windows replaced bad clusters in file 53845
of name \Windows\Fonts\kokilabi.ttf.
Read failure with status 0xc000009c at offset 0x86a5000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x86b4000 for 0x1000 bytes.
Windows replaced bad clusters in file 58564
of name \PROGRA~1\AVG\AVG2012\AVGDEC~1.DLL.
Read failure with status 0xc000009c at offset 0x403b000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x4046000 for 0x1000 bytes.
Windows replaced bad clusters in file 59834
of name \PROGRA~1\McAfee\SITEAD~1\saplugin.dll.
Read failure with status 0xc000009c at offset 0x7568000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x7569000 for 0x1000 bytes.
Windows replaced bad clusters in file 61103
of name \PROGRA~2\AVG2012\log\avgemc.log.
Read failure with status 0xc000009c at offset 0x81b3000 for 0x3000 bytes.
Read failure with status 0xc000009c at offset 0x81b5000 for 0x1000 bytes.
Windows replaced bad clusters in file 61109
of name \PROGRA~2\AVG2012\log\avgns.log.
Read failure with status 0xc000009c at offset 0x5631000 for 0x1000 bytes.
Read failure with status 0xc000009c at offset 0x5631000 for 0x1000 bytes.
Windows replaced bad clusters in file 67190
of name \PROGRA~2\AVG2012\log\AVGRSL~1.2.
Read failure with status 0xc000009c at offset 0x7747000 for 0x2000 bytes.
Read failure with status 0xc000009c at offset 0x7748000 for 0x1000 bytes.
Windows replaced bad clusters in file 77150
of name \Windows\System32\catroot\{F750E~1\PAE32B~1.CAT.
Read failure with status 0xc000009c at offset 0x879f000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x87a4000 for 0x1000 bytes.
Windows replaced bad clusters in file 101266
of name \Windows\winsxs\X8697D~1.175\twext.dll.
Read failure with status 0xc000009c at offset 0x4245000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x4248000 for 0x1000 bytes.
Windows replaced bad clusters in file 102181
of name \Windows\winsxs\X8C94A~1.175\MMDevAPI.dll.
103152 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
69669386 free clusters processed. Free space verification is complete.
Adding 27 bad clusters to the Bad Clusters File.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

312466431 KB total disk space.
33528908 KB in 57895 files.
44424 KB in 14188 indexes.
120 KB in bad sectors.
215443 KB in use by the system.
65536 KB occupied by the log file.
278677536 KB available on disk.

4096 bytes in each allocation unit.
78116607 total allocation units on disk.
69669384 allocation units available on disk.

Internal Info:
00 93 01 00 9e 19 01 00 fb 31 02 00 00 00 00 00 .........1......
1b 38 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 .8..,...........
48 8c 1f 00 50 01 1e 00 70 19 1e 00 00 00 1e 00 H...P...p.......

Windows has finished checking your disk.
Please wait while your computer restarts.

With that many read errors I would get the mfr's test utility and ckeck the HD. It is suspect