BSOD 5 mins after starting PC.

marcomax · 28 Jun 2013

Hello, I am new here I hope I am posting according to your rules.

I decided to post in "software" section as I tested my PC hardware for 2 days and found nothing wrong with it, I also replaced RAM, GPU, tested HDD extensively with no errors.

I am a software engineer and never before encountered such a resilient problem. I'd like to ask for your help and avoid to reformat my PC because I am currently working abroad and I don't have with me all the tools I need to continue my work, if I cannot fix it, I'll have to fly back home.

Thanks for your assistance. Here goes the problem description.

BSOD started a week ago, first randomly and now BSOD every 4 to 6 minutes after PC boot. STOP 0x00000050

BSOD happens when PC is idle or using it both.

scanned for malware with malware bytes found a Shuriken which has been removed and did not fix the problem.

Tried a system restore did not fix the problem, unfortunately the oldest restore point available was on the 26, 3 days ago.

If I boot in safe mode, PC won't go BSOD.

However, today I was scanning with Malware Byte in safe mode (since I can't perform a scan in normal mode as system crashes after 5 mins). Strangely, 10 mins after started scanning, I got the BSOD.

I tried to scan again (set in full scan) and it did again. So the BSOD happens in safe mode just while scanning the system with malware bytes.

I removed every device except mouse and keyboard, disabled sound and using now on board GPU.

My system configuration is:

MB Gigabyte g41m-combo
CPU q6600 2.4
GPU Nvidia GeForce 650Ti OC (factory OCed)
HDD Hitachi JPt41B 1Tbyte
RAM 2 sticks of 4G DD3 GEIL 10660 1333 9-9-9-24

no overclocking, bios at default.

I tried to put install another w7 using another hard disk, to make sure it wasn't hardware problem and to check if the system would crash again even with a new OS installed: with a new OS installed there is no BSOD so it's no hardware fault.

I can see the dump file points at a memory fault, however, if it was the RAM, the error would occur also with the new OS.

I also manually monitored the processes running up to the crash, BSOD occurs immediately after an instance of svchost.exe come up.

Thanks a lot for any help you can provide, I hope I did not forget any important info but ask me of course if you need to know more.

Arc · 29 Jun 2013

Your crash dump is not showing any finite probable cause.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If memtest comes free from errors, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any. Post it following the Blue Screen of Death (BSOD) Posting Instructions.

**Install Service pack 1 and all other windows updates. Otherwise the system will remain vulnerable to threats.

Code:

OS Name    Microsoft Windows 7 Ultimate
Version    6.1.7600 Build 7600

Learn how to install Windows 7 Service Pack 1 (SP1)
Service Pack Center - Microsoft Windows
________________________________________________________________________________
BSOD ANALYSIS:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a0215c2000, 0, fffff80002140079, 0}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiCompressRelocations+70 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a0215c2000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002140079, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800020b20e0
GetUlongFromAddress: unable to read from fffff800020b2198
 fffff8a0215c2000 Paged pool

FAULTING_IP: 
nt!MiCompressRelocations+70
fffff800`02140079 410fb701        movzx   eax,word ptr [r9]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  mbam.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800377b5d0 -- (.trap 0xfffff8800377b5d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002140079 rsp=fffff8800377b760 rbp=000000000008fc28
 r8=000000007ffff960  r9=fffff8a0215c2000 r10=000000000006ed2c
r11=0000000000000008 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!MiCompressRelocations+0x70:
fffff800`02140079 410fb701        movzx   eax,word ptr [r9] ds:fffff8a0`215c2000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001efb1e4 to fffff80001e7bf00

STACK_TEXT:  
fffff880`0377b468 fffff800`01efb1e4 : 00000000`00000050 fffff8a0`215c2000 00000000`00000000 fffff880`0377b5d0 : nt!KeBugCheckEx
fffff880`0377b470 fffff800`01e79fee : 00000000`00000000 00000000`00000003 fffff8a0`214fd000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x42907
fffff880`0377b5d0 fffff800`02140079 : 00000000`01000000 fffff800`02140461 fffffa80`062c4450 fffff800`021405a4 : nt!KiPageFault+0x16e
fffff880`0377b760 fffff800`0213e932 : 00000000`000d56a0 00000000`01000000 00000000`00000001 00000000`00000004 : nt!MiCompressRelocations+0x70
fffff880`0377b7b0 fffff800`021745d1 : fffff8a0`09800000 fffff880`0377b9c0 00000000`00000095 00000000`00000000 : nt!MiRelocateImage+0x4a2
fffff880`0377b920 fffff800`02169893 : fffff880`0377bb80 00000000`00000000 00000000`00000000 00000000`00000001 : nt!MmCreateSection+0x825
fffff880`0377bb30 fffff800`01e7b153 : fffffa80`05441760 00000000`0008e2c8 fffff880`0377bbc8 00000000`00000000 : nt!NtCreateSection+0x162
fffff880`0377bbb0 00000000`7731035a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e2a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7731035a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiCompressRelocations+70
fffff800`02140079 410fb701        movzx   eax,word ptr [r9]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiCompressRelocations+70

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiCompressRelocations+70

BUCKET_ID:  X64_0x50_nt!MiCompressRelocations+70

Followup: MachineOwner
---------

marcomax · 29 Jun 2013

I tested RAM as instructed with no errors.

I activated the driver verifier as instructed, system was unable to start, BSOD stop 0x0000000A while booting.

Awaiting instructions.

Thanks for your support.

Arc · 30 Jun 2013

Do some Disc checks.

Reseat the sata and power.
Run chkdsk /f/r, following the option two of the tutorial Disk Check
Seatool for dos: SeaTools | Seagate download
Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

Scan the system for possible virus infection with the following programs.

And which antivirus do you use? AVG I guess? Uninstall AVG using AVG Remover. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results.

marcomax · 30 Jun 2013

Hello again,

Before posting this thread I extensively tested all the hardware, including the hard disk, with several utilities including those you mentioned, plus the Hitachi fitness test (drive is Hitachi). No problems were found.

I tried putting a new Windows 7 on a spare hard disk, and then run again all the stress tests: I also tested the CPu with Prime95, the GPU with FurMark, memory etc... no errors or BSOD with the new OS so the fault must rely with that installation of Windows.

About malware, in my original post I mentioned

"scanned for malware with malwarebytes found a Shuriken which has been removed and did not fix the problem."

I uninstalled AVG and run Microsoft essential, did not find anything.

It is curious that the BSOD always happens 5 mins. after boot and always after the svchost.exe comes up. I managed to take a screenshot just before the BSOD:

Attachment 274498

Did the crash dump of the x20 stop code I attached in my previous reply, when enabled the driver verifier, point at anything particular?

Any idea what can cause this BSOD exactly 5 mins after boot? what could be behind that svchost.exe process that seems to be responsible?

I will recap here all the major points of this problem for your convenience:

1. BSOD happens exactly 5 mins after boot
2. just before BSOD svchost.exe comes up in the process list at goes on top as CPU usage
3. hardware has been extensively tested with no faults, I also changed RAM with a single DDR2 2 G block (my Mb can use either kind) and took off GPU, running with video on board, crash anyway.
4. a new installation ow Windows on another hard disk works fine even under stress programs
5. when I enabled driver verifier system couldn't boot and returned stop 0x000000020 (I attached the dump in previous reply)
6. booting in safe mode doesn't produce the BSOD after 5 minutes, but it does eventually sometime produce a BSOD if running some program for a while, not all the times tho.
7. I tried disabling all non Microsoft process (msconfig) but BSOD persists.

Any idea?

I know this is an hard one. If I were in my home country I would just re-install everything.

Thanks for your support.

Arc · 30 Jun 2013

In this situation, the best and the easiest option for you will be to do a Clean Reinstall - Factory OEM Windows 7 .

marcomax · 30 Jun 2013

The problem is that I do not have with me the software I need to do my work and I am currently abroad, if I have to do a clean install, I'll have to fly back home (12,000 km.) and install it there.

But I understand this issue is maybe too complicated.
Please let me know if anyone in your team has any idea.

Thanks anyway for your support.

gregrocker · 01 Jul 2013

Run a bootable AV scan, check the System Files from the installer or Repair CD - System Repair Disk Command Line, run a few Startup Repairs to check over the boot files and configuration, from Troubleshooting Windows 7 Failure to Boot.

Establish a Clean Boot and check the logs and System Resources for clues if you can stay booted long enough, from Troubleshooting Steps for Windows 7

Back up a Win7 image externally or to another primary partiiton you shrink on the HD (since you are traveling) so you can run a Repair Install

Post back a screenshot of your Disk Management - Post a Screen Capture Image so we can check the configuration is correct.

essenbe · 01 Jul 2013

In post #5 item 4, you said "a new installation ow Windows on another hard disk works fine even under stress programs". If a new installation on another hard drive works, you have found the solution to your problem, unless I didn't understand correctly.

Could you download the Windows ISO and the installer programs to the software you need? You should be able to find the activation numbers on your computer with Belrac advisor. Or have someone email you the numbers , if you prefer.

marcomax · 02 Jul 2013

I cannot download the development tools I need, they are custom made by my company. I had to give up anyway, this problem just won't fix. I am marking this problem as "solved" as I am going to fly back home and do a clean install.

Thanks all of you for the support.:)