SYSTEM_SERVICE_EXCEPTION BSOD after PC rebuild

So everything went smooth until you tried to install IRST, correct?
You should have a system restore point you can go back to if the OS is buggy again.

• http://www.sevenforums.com/tutorials/700-system-restore.html

Please upload an up to date version of the MSINFO32 file:

rb:Start → Run → type MSINFO32 then hit Enter.
In MSINFO32 go to, File → Save → name it your user-name.
Once the file is saved right click it and choose Send to → Compressed (zipped) folder.

Attach the file in your next post.

Hey,

I did as you asked and I don't think it's the IRST driver!

After retrieving the MSINFO32 save from Safe Mode, called "Polygone - MSINFO32 before System Restore", I booted into Windows normally. After about 10 minutes of reaching the desktop, a "Windows Explorer has stopped working" error appeared shortly followed by SYSTEM_SERVICE_EXCEPTION BSOD with a driver reference. The crash dump is attached to this post.

I then ran System Restore from the Windows 7 installation disc and successfully took my PC back to before the Etron USB 3.0 driver was installed. This was the last driver installed before I ran the IRST install. Thinking that the errors were now all gone, I ran MSINFO32.exe. As its information was saving, another BSOD appeared. Its crash dumps are called SYSTEM_SERVICE_EXCEPTION 2! They're still happening! And I was so hopeful that we had found the cause!

I ran MSINFO32 from Safe Mode and its save is called: "Polygone - MSINFO32 after System Restore".

I installed the Etron USB 3.0 driver in the same boot-up as my attempted install of the IRST driver. Do you think that could be the culprit?

What do you make of all of this?

I'm glad you like a challenge because my PC is a never ending supply of errors!

I've tried to complete the tutorial that you posted but I've had problems!

Here's what has happened:

I downloaded the SURT on another PC and transferred it to a USB stick. I inserted this flash drive whilst my PC was booting into Safe Mode. Shortly after my PC auto-restarted. I was AFK at the time, so I'm not sure what happened. The next time, I was able to boot into Safe Mode successfully. My flash drive was still connected. As the SURT install was transferring from the flash drive to my PC, it auto-restarted. I don't know what happened as, again, I was AFK.

I booted into Safe Mode again. After reaching the desktop, I tried to run the installer. The error message below appeared when I did.

Windows Update Standalone Installer
Installer encountered an error: 0x8007000d

The data is invalid

Suspecting that the install did not download completely before my PC restarted, I downloaded it again from the USB stick. This is when I found that SURT wouldn't run in Safe Mode. I restarted my PC and booted up my PC normally. On reaching the desktop a CACHE_MANAGER BSOD flashed onscreen. The crash dumps are attached to this post. I then booted my PC normally again so as to find a stable boot that would allow me to run the SURT. Just before reaching the desktop, at around the "Welcome" and "Please wait..." stages of Windows starting up, the stop error message below appeared:

WerFault.exe - Application Error
The instruction at 0xf9108620 referenced memory at 0xf9132240. The memory could not be read.

A BSOD then appeared. Its attached to this post as "SF_24-11-2013 - 2 Maybe MEMORY_MANAGEMENT" as I didn't get a good look at the title before my PC auto-restarted. On the next attempt at booting up normally a stop error appeared with the title along the lines of: iusb3mon.exe. I didn't get a good look at the message as a MEMORY_MANAGEMENT BSOD appeared shortly afterwards. Its crash dumps are attached to this post as "SF_24-11-2013 - 3 MEMORY_MANAGEMENT".

On the fifth time I booted my PC normally in this session, it seemed fine when it reached the desktop. As such I started to run the SURT. Within the space of a minute or so, a PAGE_FAULT_IN_NON-PAGED_AREA BSOD appeared and my PC restarted. Like normal, I booted into Safe Mode to retrieve those crash dumps. As the SF_Diagnostic_Tool was retrieving the crash dumps, a SYSTEM_SERVICE_EXCEPTION BSOD appeared. My PC then restarted. This surprised me as I don't normally get blue-screens in Safe Mode.

I have been having trouble with the Seven Forums crash dump retrieval tool though. In this session of PC usage especially, when I run the tool after booting in to Safe Mode, it seems to stop retrieving parts of the crash dumps after a while. If I stop the tool running in Task Manager and delete the part file, the tool retrieves the crash dumps successfully on my next try. I have found though that a while after the second crash dump retrieval attempt, the first retrieval of the crash dumps starts up again. This is the first time that the SF_Diagnostic_Tool has ever generated a BSOD though.

Anyway, after my PC auto-restarted, I booted into Safe Mode again. I've attached to this post the part of the PAGE_FAULT BSOD that was collected by the Seven Forums tool. I was then able to successfully retrieve the SYSTEM_SERVICE_EXCEPTION BSOD that it had just generated.

As I couldn't find a stable boot, I decided to skip the SURT and run the "sfc /SCANNOW" utility. At 39% verification, the utility stopped and the message below was displayed:

View attachment 294867

I started the scan and this what appeared on-screen:

View attachment 294872

I stopped the "sfc /scannow" utility to see what you all thought of it. I've attached the Windows logs that you wanted.

Please let me know what you make of all of this!

SFC shows the following errors...

There's also this error...

Which I have to admit I have no understanding of.

I'll post a fix for the file errors later - if we're lucky it may fix the other error as well

Cool. Thank you

I've uploaded a file - plgaa.zip - to my SkyDrive at Noel's SkyDrive
Please download and save it.
Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)
Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.
Pick the option to use a Command Prompt
At the prompt type
DIR C:\plgaa
hit the enter key - if you get a 'Not Found' error try
DIR D:\plgaa
or
DIR E:\plgaa

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\plgaa <drive>:\windows\winsxs /y /i /s /v /h

(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

run the command (it should take almost no time)and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.
Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link
Also run a new MGADiag report, and post the result.

Hey,

I did as you asked but I'm still having problems. They don't seem as bad as they were though. Progress! Thanks

Here's what's happened:

When I initially turned my PC on yesterday, it got stuck at the POST screen. SO, I rebooted and performed your "plgaa" fix in Safe Mode. Afterwards I booted into Windows normally. And it was stable!

The sfc /scannow utility completed successfully. At 100% verification I was told:

Windows Resource Protection found corrupt files and successfully repaired them.

I then rebooted my PC as you instructed and, again, it seemed stable. I copied the CBS.log folder from Windows' logs but it's not attached here as more errors occurred since then. I didn't realise that MGADiag.exe wasn't pre-installed on my PC so turned my PC off whilst I downloaded it using another computer. I booted my PC up normally, whilst copying MGADiag.exe from my USB stick to the desktop, a "Windows Explorer has stopped working" message briefly flashed onscreen. The cursor turned into the spinning blue loading circle and after a minute an error message appeared saying:

Windows Explorer is not responding
If you restart or close the program, you might lose information

• Restart the program
• Close the program
• Wait for the program to respond

I chose to restart the program and a "Windows Explorer is not responding" message appeared without further options. Then, the only thing visible on the desktop was the wallpaper and the cursor.

After manually rebooting my PC, I booted into Safe Mode and ran MGADiag.exe on the desktop. The program crashed when I first pressed "Copy" but ran fine after closing the initial run with Task Manager. I copied its log to a text document. I then copied the CBS.log folder. It, like the MGADiag.exe text log, is attached to this post. This is because I've never used SkyDrive before.

Please let me know what you make of them!

The MGADiag doesn't tell us much because it was run an Safe Mode - doesn't matter, as I don't think it's likely to tell us that much more in normal mode.

The SFC log shows that it successfully replace the damaged font, and the other files were also successfully replaced.

There's no repeat of the error message since that original one, so it may have been a one-off, or we haven't hit the conditions which caused it - or we may have cured it.

I think I've done as much as I can for the moment - it's back to the BSOD guys

Ok, thanks for your help!

I managed to get MGADiag.exe to run in normal Windows mode. I'd rather be safe than sorry!

MGADiag.exe was ran after I used System Restore to make my PC back to before I installed a USB 3.0 hub controller. And your font fix! But I ran the font fix again and it successfully replaced the font. When I ran sfc /scannow again today it didn't find any integrity errors whereas it did last time. Do you think System Restore could have reversed the error?

I also retrieved a copy of the CBS.log file after the last sfc /scannow utility scan and it's attached to this document.

Here's a full list of what happened since my last post:

26.11.2013

After turning my PC on it hung after the POST screen. It lingered on a black screen with a white flashing underscore cursor where I normally hammer F8 to enter Safe Mode. I hadn't pressed anything since turning it on and my USB stick wasn't plugged in. I rebooted my PC manually. As it booted up normally, it reached the "Starting Windows" screen with the black background when it suddenly auto-restarted. It also auto-restarted when I tried to boot into Safe Mode after that last attempt.

I booted up my PC again and I ran Startup Repair from the prompt on the screen saying that my PC did not start successfully last time. I actually chose to use System Restore but Startup Repair said that it fixed the problem without loading it. I restarted the PC as prompted, so the changes could take effect. During this boot-up my PC got as far as the Windows "Welcome" screen where it hung. After 5 minutes of this a SYSTEM_SERVICE_EXCEPTION BSOD appeared. Its crash dump has the number 1 and is attached to this post.

I booted up my PC and entered the Repair Environment by pressing F8 after the POST screen. I followed the Repair My Computer option and started System Restore. I successfully restored my PC to 18.11.2013 before I first installed the Etron USB 3.0 Hub Controller. I restarted my PC as prompted and it booted up to the desktop. To test how stable the boot was I decided to wait for any errors and played around on Paint to see if any appeared. After a few minutes, Paint temporarily froze and the title bar said that it wasn't responding. A PAGE_FAULT_IN_NONPAGED_AREA BSOD then flashed onscreen.

I booted into Safe Mode as my PC auto-restarted and retrieved the blue-screen's crash dump. I ran the sfc /scannow utility and at 100% verification I was told:

Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log

I performed your plgaa file fix again and it said that it repaired the damaged font. I then restarted my PC and booted it up normally. After a minute at the desktop a SYSTEM_SERVICE_EXCEPTION blue-screen error appeared. I think a driver was named but it could have been that win32k.sys thing.

I have a copy of the CBS.log folder from this point if you want it, I haven't attached it to this post though.

27.11.2013

I booted my PC up normally. At the desktop, the boot seemed stable. I ran MGADiag.exe but it wouldn't let me copy the log to a .txt file. When I tried, the error message below appeared:

View attachment 295301

I rebooted my PC and on booting up normally, this boot also seemed stable. I ran MGADiag.exe again and this time the "Copy" button worked without generating an error. This is the text file that I mentioned at the start of this post.

I started my PC up normally again as I'd forgotten to run sfc /scannow since performing the plgaa fix. As it booted up, a BSOD appeared. Its crash dump is named "SF_27-11-2013 - 4 - fltmgr.sys BSOD" and is attached to this post.

When I booted up Windows normally again it successfully reached the desktop. I ran the sfc /scannow utility and at 100% verification I was told: Windows Resource Protection did not find any integrity violations. I ran the utility again to make sure there were no errors. During the scan another BSOD appeared. Its crash dump is named "SF_27-11-2013 - 5 - ntfs.sys BSOD". I also copied the CBS.log folder. This is the folder that I mentioned at the beginning of this post.

Could you please let me know what you make of all this?

None your recent folders have any dump files, please navigate to this directory:


Any dump files present?

Also, check the Kernel Memory dump folder, if there is any Kernel Memory dumps then please compress and upload to a free hosting service such as Dropbox or Skydrive.

Hey,

Sorry about that. I've been having problems with the SF_Diagnostic_Tool. I looked in the minidump folder and it was empty! I've uploaded the MEMORY.DMP using SkyDrive. The link is here: http://sdrv.ms/1caM8t2 Please let me know if it works as this is the first time I've used it.

Please let me know what you make of the file!

Just downloading the file now, I'll post analysis when it's complete.

I don't seem to be even to be able to get a stack trace, this is most likely because context information about the stack wasn't stored in the ebp and esp registers.

The best I could gather was a access violation, potentially from the memcpy C function call, which is used to copy data between two memory buffers.

The ax register is used to store strings, therefore I assume the edx and ecx registers, contain string data.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Ok, I'll run Driver Verifier.

Would it be worth installing the Etron USB 3.0 Hub Controller driver? This was removed when I used System Restore and so this hub controller isn't registered as being installed in Device Manager. The Intel one is though. I found an up-to-date install on the Etron website for the chip in my motherboard Etron Technology, Inc.

As the past two BSODs have mentioned updating drivers, do you think I should install the hub controller before running Driver Verifier?

Install the USB hub driver, and then run Driver Verifier.

Thanks,

I installed the USB 3.0 Hub Controller and ran Driver Verifier. So far, it has spawned 8 BSODs but none appear to have named a driver. In total, Driver Verifier has been running for about 6 hours.

Do you want me to keep waiting for blue-screens to generate or post what I've aleady collected?

I've also been running "sfc" a lot, primarily to trigger BSODs, but it has found an error that it can't correct.

When it comes to the time for me to post the crash dumps, would you want a copy of the MEMORY.DMP file too?

Hey,

Here are the crash dumps for the BSODs that Driver Verifier has produced so far. At the rate it's producing them I'd probably need to post multiple times anyway and my PC has only been running it for about 7 hours in total.

Here's what's happened so far:
Please note that the numbers next to references to BSODs in the post, e.g. [1], refer to the number of its associated crash dump that is attached to this post


29.11.2013

I installed the Etron USB 3.0 Hub Controller before your confirmation as I figured it couldn't do any harm. The installer wouldn't run in Safe Mode though. When I tried, I got the following error message:

Etron USB3.0 Host Controller
Error 1719. Windows Installer service could not be accessed. Contact your support personnel to verify that it is properly registered and enabled.

I even tried installing it by selecting the location of the driver through Device Manager but it wouldn't recognise the install. However, it installed successfully in normal Windows mode.

It was after this that I enabled Driver Verifier. I restarted my PC as prompted and it booted up fine. The boot seemed stable so I played games in Windows for a bit whilst I waited for an error. By games, I mean Solitaire, Minesweeper etc. After about 10 minutes a "Windows Explorer has stopped working" message popped up shortly followed by a "Windows Explorer is restarting" message. This last message kept appearing and disappearing in quick succession. After about 30 seconds of this, a MEMORY_MANAGEMENT BSOD [1] appeared.

After reaching the desktop after booting up Windows normally, I played Solitaire for about 10 minutes. I exited the game and just as I was about to start an elevated command prompt to run sfc, a SYSTEM_SERVICE_EXCEPTION BSOD [2] popped-up.

I booted my PC up normally and left it unused at the desktop for about 15 minutes before running an elevated command prompt. I did this as I thought a running process would generate more blue-screens than Solitaire could. Just as I started running sfc /scannow, a SYSTEM_SERVICE_EXCEPTION BSOD [3] appeared.

I booted to the normal Windows desktop. Within the space of an hour, I ran sfc /scannow four times with no errors found, played Windows games, used Paint and left it unused for about half an hour. I restarted my PC as no errors were generated.

In this boot, I ran sfc /scannow twice with no results then played on Solitaire for a bit before exiting it. When I left my PC on the desktop, a PAGE_FAULT_IN_NONPAGED_AREA BSOD [4] appeared.

On the next boot-up, I ran sfc /scannow after playing some games. This first scan found no results. However, at 100% verification, the second scan produced this:

Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log... etc...

The system file repair changes will take effect after the next reboot

When I tried to scan my PC again, I was told that "there is a system repair pending which requires reboot to complete. Restart Windows and run sfc again." Then this error message appeared:

Desktop Windows Manager stopped working and was closed
A problem caused the application to stop working correctly. Windows will notify you if a solution is available

I closed the window and decided to restart my computer. Just as it was closing it down a BSOD appeared. I turned my PC off and then back on. As it booted into Safe Mode and after loading the list of drivers, I was told that Windows was "Logging Off" then "Shutting Down". My PC then auto-restarted and seemed to miss the point after the POST screen where I could boot into Safe Mode. I retrieved the previous crash dump, called UNNAMED BSOD [5] from the Desktop.

I then ran sfc /scannow. At 100% verification, I was told: "Windows Resource Protection found corrupt files and successfully repaired them. Details are included...etc..." I ran the scan again and when completed, I was told that: "Windows Resource Protection found corrupt files but was unable to fix some of them. Details...etc" It said the same when I ran the scan again. As I used the snipping tool to take a screen capture of the command prompt window, a MEMORY_MANAGEMENT BSOD [6] appeared. This time I was able to retrieve the crash dump from Safe Mode.


30.11.2013

My PC began to boot-up normally. At the "Starting Windows" screen, a BSOD appeared. Write To Read-Only Memory BSOD [7].

After 10 minutes of booting my PC into normal Windows mode, another blue-screen appeared. Check for Adequate Disk Space BSOD [8].

After 45 minutes of inactivity following the last boot-up, the Ribbons screensaver was interrupted by the following error message:

Ribbons: Ribbons.scr - Application Error
The instruction at 0xf1b9c3ea referenced memory at 0x0000c028 (I think). The memory could not be read.

As I closed down the message window, the screensaver closed down too. A few minutes later, I right-clicked on the desktop and the spinning blue loading circle on the mouse cursor span for about 30 seconds before the menu appeared. From here I opened the "Personalisation" panel. As it did, the following error message was produced:

dllhost.exe - Application Error
The instruction at 0x77a9dfa0 referenced memory at 0x03aa8978. The memory could not be read.

I clicked Ok to clear the message and it appeared again. I kept pressing Ok and the message kept appearing and disappearing repeatedly for about 15 times. After the 15th time this error message appeared:

explorer.exe - Application Error
The application was unable to start correctly (0xc0000005). Click Ok to close the application.

After about a minute, a BSOD popped-up. Check for Adequate Disk Space BSOD [9]

I booted my PC up normally and left it for a few hours. When I came back it was in hibernation. When I tried to bring it out, at the "Resuming Windows" screen there was no animation for the Windows logo. Then a black screen with grey writing appeared on-screen.

Windows Boot Manager

Your computer can't come out of hibernation

Status: 00xc0000242

Info: A fatal error occurred processing the restoration data

File: \hiberfil.sys

Any information that was not saved before the computer went into hibernation will be lost

I pressed enter to continue. The "Starting Windows" screen was visible briefly before a Check for Adequate Disk Space BSOD [10] appeared.


01.12.2013

Booted up PC. From the Advanced Boot Options menu, I selected the Safe Mode option. Then an IRQL_NOT_LESS_OR_EQUAL BSOD appeared on-screen. I booted up my PC again with the intention to retrieve the crash dump files. I was greeted by the Windows Error Recovery screen and I chose to start my PC normally. On reaching the desktop, a SYSTEM_SERVICE_EXCEPTION BSOD - win32k.sys [12] appeared. I was able to retrieve this crash dump from Safe Mode but, unfortunately, not the IRQL_NOT_LESS_OR_EQUAL one.

I've attached the CBS.log to this post and I'll give you a link to the MEMORY.DMP file for SkyDrive in the next post.

Please let me know what you make of them!

Here's the link on SkyDrive for the MEMORY.DMP file http://sdrv.ms/1hqZ4PB.

I checked the MiniDump folder in the Logs directory and it was empty.

I'll look at the files for you now