BSOD after restart 0x0000007f

20 Jan 2013

Hi all,

First time post on this forum so hope some kind soul can help.

Short story, PC was fine then started to BSOD a few weeks back after each restart, not straight away but after a period. So I tried taking windows back to a previous restore point and all was fine until it started happening again. I went through a process of selective start up and thought I'd narrowed it down to a few things as I could now run my sysytem without the BSOD and most services were up and running. Well a couple of days ago, I couldn't access itunes (it just wouldn't open) so I rolled back my system again, iTunes was fine but this morning the BSOD is back.

I'm in a bit of a mess really and don't want the above to be a distraction but there might be something in there that helps.

I've uploaded the SF diagnostic results as requested

Thanks in advance

Mark

Golden · 20 Jan 2013

Code:

#
# Copyright (c) 2007 F-Secure Corporation 
# 
# This is a HOSTS file created during malware removal. 
#
# Your original HOSTS file was infected and it was replaced 
# by this file containing only clean default entries. 
# The original HOSTS file may be restored from the product's
# quarantine feature.
#
127.0.0.1	localhost
::1			localhost

Mark, was your system completed cleaned of malware? Did you perform a format and re-installtion after the malware infection?

Lets start with a scan using this:
Windows Defender Offline

and also this

http://support.kaspersky.com/5350

20 Jan 2013

Hi Golden, I've done both of the above as asked and they've returned no issues. after the Malware infection I didn't perform a format and re-installation unless it's relating to a long time ago.

20 Jan 2013

OK so noy sure if this additional information helps but I managed to stop my PC blue screening using system configuration and the 50/50 principle of disabling and enabling batches to see if I could isolate the offending item. Well I've not managed to get it down to one thing but the system seems stable and BSOD for a long while if I disable;

Symantec SymSnap VSS Provider
SymSnapService
Superfetch
Tablet PC Input Service
Telephony
TPM Base Service
Remote Desktop Services
Themes
Thread Ordering Server
TomTomHOMEService
Distributed Link Tracking Client
Windows Modules Installer
Interaction Services Detection
UPnP Device Host
Desktop Windows Manager Session Manager
Credential Manager
Virtual Disk

To clarify these have all bee unticked. I can continue the process of elimination but wanted to make you aware in case it helped.

Thanks

Mark

koolkat77 · 20 Jan 2013

Hi, sorry to chip in but I just wanted to know.

You're using the 32 Bit version of windows where as you have 6 GB of RAM installed.

Code:

System Type	X86-based PC
Installed Physical Memory (RAM)	6.00 GB
Total Physical Memory	2.99 GB

Any particular reason for doing so? If not, I would recommend a clean install of Windows by downloading the 64 Bit ISO with Service Pack 1 from the tutorial below:

Clean Reinstall - Factory OEM Windows 7

64 Bit windows will allocate and let you use all 6 GB ram.
In addition I would recommend against the following programs:

Code:

Start Menu\Programs\McAfee	Public:Start Menu\Programs\McAfee	Public
Start Menu\Programs\McAfee Online Backup	Public:Start Menu\Programs\McAfee Online Backup	Public
Start Menu\Programs\McAfee Security Scan Plus	Public:Start Menu\Programs\McAfee Security Scan Plus	Public
Start Menu\Programs\Norton Ghost	Public:Start Menu\Programs\Norton Ghost	Public

..This tutorial should be helpful.

Backup Complete Computer - Create an Image Backup

Hope this helps.

Code:

1. Unable to load image \SystemRoot\system32\drivers\mfefirek.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfefirek.sys
*** ERROR: Module load completed but symbols could not be loaded for mfefirek.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, 86551cf0, 86551e60, 82e0021}

*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
Probably caused by : mfefirek.sys ( mfefirek+2e8c2 )

Followup: MachineOwner
---------
2.*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, 0, 0, 0}

*** WARNING: Unable to verify timestamp for RapportCerberus32_43926.sys
*** ERROR: Module load completed but symbols could not be loaded for RapportCerberus32_43926.sys
*** WARNING: Unable to verify timestamp for symsnap.sys
*** ERROR: Module load completed but symbols could not be loaded for symsnap.sys
*** WARNING: Unable to verify timestamp for MOBK.sys
*** ERROR: Module load completed but symbols could not be loaded for MOBK.sys
Probably caused by : RapportCerberus32_43926.sys ( RapportCerberus32_43926+2f7f2 )

Followup: MachineOwner
---------

20 Jan 2013

Just to clarify, are you suggesting that I create an image back up of my c: drive on one of my spare disks and then do a clean install of the 64bit OS on the original drive.

Does this mean it might correct the BSOD issue, also will the 32bit back up be OK to transfer back to the original drive? My main concern about a clean install was losing everything.

Apologies if these all seem very basic questions but I just want to be sure before I do something drastic and unrecoverable.

Thanks

20 Jan 2013

From the link above - how to create a system Image backup in Windows 7

You cannot restore a 64-bit Windows 7 backup image on a 32-bit system.
You cannot restore a 64-bit Windows 7 backup image with a 32 bit Windows 7 installation DVD or recovery partition, or the other way around. You must use the same 32-bit or 64-bit Windows 7 installation DVD or recovery partition as the backup image is.

Reading this it seems to say that if I create a back up of mu current 32bit system I woun't be able to restore it to the new 64bit OS, unless I am misunderstanding or blending both points (?)

20 Jan 2013

Also received this message (see attached zip) whilst looking into creating a system image. Probably to do with some of the disabled services but I'm not sure what to enable and also this is likely to start the whole BSOD process.

20 Jan 2013

One final question if I uninstall the McAfee products what AV product do you think is best?

koolkat77 · 20 Jan 2013

Mark, I would not take a back up of your current installation as had been/is infected.

I would just copy and paste all the data from the users/download/pictures etc to another partition and reinstall the OS.

My reason for linking to windows back up was because Norton and McAfee products are bloated.
Plus their antivirus - tend to cause BSOD-s.

If you search our forum you'll see various threads solved by removing McAfee and a few solved by removing Norton.

I use this quote on most of the BSOD threads.

Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-

Microsoft Security Essentials - Free Antivirus for Windows
- Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
  - Good and Free system security combination.
  - How to Scan Your Computer With Multiple Antivirus Programs - How-To Geek

Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

If MSE does not suit your purposes, you can use the free version of Avast! antivirus.

Perform a System File Check:

Click on the start
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

SFC /SCANNOW Command - System File Checker

Reduce items at start-up. Nothing except anti-virus is required plus improves the time for logging in windows.

Disk Check on your hard drive for file system errors and bad sectors on it:

Disk Check