Windows won't go past welcome screen!

ElieJK90 · 03 Mar 2012

Hey! The scan now command said windows resource protection did not find any integrity violations.

writhziden · 03 Mar 2012

That is good news, at least. If you could upload the crash reports, hopefully they will provide more substantial information and give an idea to the cause of the crashes.

ElieJK90 · 03 Mar 2012

Ok i'm doing the BSOD thing now.

ElieJK90 · 03 Mar 2012

Ok so when I get to where I type "perfmon /report". I get an error saying "An error occured while attempting to generate this report". I followed the steps to check if it's manual and it already is.. When I right clicked performance logs & alerts and hit start, it said it doesn't run in safe mode... what to do?

writhziden · 03 Mar 2012

Just omit the perfmon report; it cannot be generated in Safe Mode. It would be nice to have, but it is not as necessary as some of the other files.

ElieJK90 · 03 Mar 2012

Ok. So what do I do then?

writhziden · 03 Mar 2012

Just generate the folder using the executable contained in the instructions, compress (zip) the contents into a zip file, and upload the zip file to your next post.

ElieJK90 · 03 Mar 2012

There it is!

writhziden · 03 Mar 2012

Problem Devices:

Code:

Security Processor Loader Driver	ROOT\LEGACY_SPLDR\0000	This device is not present, is not working properly, or does not have all its drivers installed.

Code:


Loading Dump File [D:\Kingston\BSODDmpFiles\ElieJK90\Windows_NT6_BSOD_jcgriff2\030312-24882-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03057000 PsLoadedModuleList = 0xfffff800`0329c670
Debug session time: Sat Mar  3 12:10:43.810 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:59.309
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 160, fffffa80067e8270, fffff880042305a9}

Unable to load image \SystemRoot\system32\DRIVERS\SFEP.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SFEP.sys
*** ERROR: Module load completed but symbols could not be loaded for SFEP.sys
Probably caused by : SFEP.sys ( SFEP+15a9 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000160, Handle value being referenced.
Arg3: fffffa80067e8270, Address of the current process.
Arg4: fffff880042305a9, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  SPMgr.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000355d3dc to fffff800030d3c40

STACK_TEXT:  
fffff880`07248578 fffff800`0355d3dc : 00000000`000000c4 00000000`000000f6 00000000`00000160 fffffa80`067e8270 : nt!KeBugCheckEx
fffff880`07248580 fffff800`03572ae4 : 00000000`00000160 fffffa80`067e8270 00000000`00000002 00000000`00000100 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`072485c0 fffff800`0332b210 : 00000000`00000000 fffff880`072487f0 00000000`00000000 fffff980`03dcef00 : nt!VfCheckUserHandle+0x1b4
fffff880`072486a0 fffff800`033ae375 : fffff880`07242000 fffff880`000f0001 00000000`00000000 00000000`00000200 : nt! ?? ::NNGAKEGL::`string'+0x212ce
fffff880`07248770 fffff800`03572878 : 00000000`00000000 fffffa80`00000000 00000000`00000248 fffffa80`0671f488 : nt!ObReferenceObjectByHandle+0x25
fffff880`072487c0 fffff880`042305a9 : fffff980`0d584db0 00000000`0001c0fb fffff980`03dceff0 fffff980`03dceff0 : nt!VerifierObReferenceObjectByHandle+0x48
fffff880`07248810 fffff980`0d584db0 : 00000000`0001c0fb fffff980`03dceff0 fffff980`03dceff0 fffff880`07248850 : SFEP+0x15a9
fffff880`07248818 00000000`0001c0fb : fffff980`03dceff0 fffff980`03dceff0 fffff880`07248850 00000000`00000000 : 0xfffff980`0d584db0
fffff880`07248820 fffff980`03dceff0 : fffff980`03dceff0 fffff880`07248850 00000000`00000000 00000000`00000000 : 0x1c0fb
fffff880`07248828 fffff980`03dceff0 : fffff880`07248850 00000000`00000000 00000000`00000000 fffff880`04230711 : 0xfffff980`03dceff0
fffff880`07248830 fffff880`07248850 : 00000000`00000000 00000000`00000000 fffff880`04230711 fffff980`0e002fb8 : 0xfffff980`03dceff0
fffff880`07248838 00000000`00000000 : 00000000`00000000 fffff880`04230711 fffff980`0e002fb8 fffffa80`0671f488 : 0xfffff880`07248850


STACK_COMMAND:  kb

FOLLOWUP_IP: 
SFEP+15a9
fffff880`042305a9 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  SFEP+15a9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SFEP

IMAGE_NAME:  SFEP.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  46b2beb9

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRF_SFEP+15a9

BUCKET_ID:  X64_0xc4_f6_VRF_SFEP+15a9

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\ElieJK90\Windows_NT6_BSOD_jcgriff2\030312-48422-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0305d000 PsLoadedModuleList = 0xfffff800`032a2670
Debug session time: Sat Mar  3 12:04:20.408 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:36.907
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000006, fffff8000315c2a3, fffff88005456698, fffff88005455ef0}

Probably caused by : hardware_disk

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000006, The exception code that was not handled
Arg2: fffff8000315c2a3, The address that the exception occurred at
Arg3: fffff88005456698, Exception Record Address
Arg4: fffff88005455ef0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

FAULTING_IP: 
nt!XpressDecodeCreate+73
fffff800`0315c2a3 0fb702          movzx   eax,word ptr [rdx]

EXCEPTION_RECORD:  fffff88005456698 -- (.exr 0xfffff88005456698)
ExceptionAddress: fffff8000315c2a3 (nt!XpressDecodeCreate+0x0000000000000073)
   ExceptionCode: c0000006 (In-page I/O error)
  ExceptionFlags: 00000000
NumberParameters: 3
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000000020d0000
   Parameter[2]: 00000000c0000185
Inpage operation failed at 00000000020d0000, due to I/O error 00000000c0000185

CONTEXT:  fffff88005455ef0 -- (.cxr 0xfffff88005455ef0)
rax=0000000000000004 rbx=00000000020cfffd rcx=0000000000000004
rdx=00000000020d0000 rsi=fffff8a0027daf90 rdi=0000000000000001
rip=fffff8000315c2a3 rsp=fffff880054568d8 rbp=0000000000010000
 r8=0000000000ce3f56  r9=fffff8a0027daf90 r10=00000000fffff000
r11=0000000000ce3af2 r12=00000000000a7d09 r13=fffff8a0027dd078
r14=0000000000000007 r15=00000000020cf3a4
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
nt!XpressDecodeCreate+0x73:
fffff800`0315c2a3 0fb702          movzx   eax,word ptr [rdx] ds:002b:00000000`020d0000=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000000020d0000

EXCEPTION_PARAMETER3:  00000000c0000185

IO_ERROR: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.

BUGCHECK_STR:  0x7E

EXCEPTION_STR:  0xc0000006_c0000185

FOLLOWUP_IP: 
+73
00000000`020d0000 ??              ???

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware_disk

IMAGE_NAME:  hardware_disk

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  kb

FAILURE_BUCKET_ID:  X64_0x7E_VRF_IMAGE_hardware_disk

BUCKET_ID:  X64_0x7E_VRF_IMAGE_hardware_disk

Followup: MachineOwner
---------

Update SFEP.SYS using the link I provided in post #10 ASAP. That is what is keeping you from starting Windows with Verifier running. See if that helps resolve the issue.
Points to possible hard disk fault.

The second crash is what is preventing you from entering Windows without Verifier running. Use HD Diagnostic to determine your hard disk manufacturer and find the manufacturer diagnostics. Run all diagnostic tests available on your hard disk to determine whether it is failing. Also, make sure your hard disk is properly connected to your system by doing the following steps:

Shut down and turn off the computer.
Remove the AC adapter, and then remove the battery.
Open the panel covering the hard disk.
Pull the hard disk out of the system and then replace it snugly by sliding the connector into the appropriate slot.
Replace the panel to the computer.
Replace the battery, and then replace the AC adapter.
Turn on the system and see how it responds. Post back your results.

ElieJK90 · 03 Mar 2012

Ok I downloaded sfep.sys and restarted my laptop. Still crashing
I don't understand step two.. How do I find out who the manufacturer is and how do I run diagnostic tests?