Several Different BSOD Before Getting Into Windows

Page 1 of 2 12 LastLast

  1. Posts : 7
    Windows 7 Home Premium 64 Bit
       #1

    Several Different BSOD Before Getting Into Windows


    I've been having a problem with my bootup sequence with my Toshiba Laptop for a few months. I can usually figure out these things on my own, but this has stumped me. Every time I boot up from a powered down state, I have to go through 8 to 11 BSOD before I can get into Windows. It doesn't happen when I restart, only when it's shut off. I tried resetting to factory defaults, but it still happens. I've also done memory diagnostics, check disk, and virus scanning. Based on my own investigation of the dump files, there are a few causes for these blue screens. I don't know how to solve the problems, though.

    I'm attaching my BSOD dump files, as per the instructions on how to post about a BSOD issue.

    Thanks in advance for any assistance anyone can provide.
      My Computer


  2. Posts : 4,161
    Windows 7 Pro-x64
       #2

    Check to see if there's an update for your Symantec/Norton AV. It's the cause of your BSODs.

    For test purposes, you might uninstall it and use Microsoft Security Essentials.
      My Computer


  3. Posts : 7
    Windows 7 Home Premium 64 Bit
    Thread Starter
       #3

    Thanks for the reply.

    Unfortunately, I tried updating and uninstalling Norton, but the BSOD still happens at the same frequency. I did install Microsoft Security Essentials, too. Are there any other causes?
      My Computer


  4. Posts : 4,161
    Windows 7 Pro-x64
       #4

    Rerun the BSOD utility and use the Grab All button. Let the utility complete. This can take five minutes or more. Then upload a fresh zip file of all the files.

    Forgot to ask: Did you reboot after the uninstall?
      My Computer


  5. Posts : 7
    Windows 7 Home Premium 64 Bit
    Thread Starter
       #5

    Here's the new zip file.

    And yes, I restarted after the uninstall.
      My Computer


  6. Posts : 4,161
    Windows 7 Pro-x64
       #6

    Sorry to be late getting back. Interruptions on the home front.

    There's no dumps in the zip file. I checked the system log and the last dump shows a Bug Check of 0x50. This can be hardware or software including malware.

    To ensure your system drivers are clean, run SFC /scannow from an elevated command prompt. Use option Two. If it won't run, continue with the items below then run this last. (After reboots on the clean.)

    There's numerous suspicious programs running and one hidden at start up (Image below).
    You should start in safe mode, with internet, then download and run AdwCleaner.

    Run a full scan with MSE.

    Forgot the image.
    Last edited by carwiz; 13 Feb 2014 at 21:26. Reason: Addition
      My Computer


  7. Posts : 7
    Windows 7 Home Premium 64 Bit
    Thread Starter
       #7

    Strange. I wonder why there wasn't a dump file...

    I did the scannow, but it didn't find anything. I also did the Adwcleaner and security scan. The Adware cleaner found two files, which I removed, but the security scan didn't find anything. The BSOD still happen, regardless.

    I'm going to post my files again. This one has a dump file in it.
      My Computer


  8. Posts : 4,161
    Windows 7 Pro-x64
       #8

    Did you rerun the utility or just re-zip. The files still include questionable programs.

    Did you load another scanner of some type? I don't have a clue what "TobuActivation.exe" might be but it was running at the time of the dump. This could be associated with a "fix all" program that does nothing but infect your machine or it could be a Toshiba backup program that shouldn't be running while debugging.

    Uninstall any scan (scam) or fixit programs you've installed recently except those noted above.

    Start your PC in Safe Mode with Networking.

    Download and install MBAM Free and run it. Don't activate the "Trial" or any other options. Allow it to update and run a full scan. If it comes out clean, reboot to get out of Safe Mode.

    Click on the ORB (Start) and type msconfig in the search box and press Enter. (If prompted, click on Continue for the UAC prompt.) Click on the Startup tab and post a snip of that window. Don't change anything at this point. This is to check for the blank entry. We may change some later for a Clean Boot.

    Exit msconfig then post that snip .


    Code:
     
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 50, {fffffa804b7ce6b8, 0, fffff80003f0ff0a, 5}
     
    Could not read faulting driver name
    Probably caused by : memory_corruption ( nt!MiGetNextNode+2e )
    Followup: MachineOwner
    ---------
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffa804b7ce6b8, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff80003f0ff0a, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 0000000000000005, (reserved)
    Debugging Details:
    ------------------
     
    Could not read faulting driver name
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004115100
     fffffa804b7ce6b8 
    FAULTING_IP: 
    nt!MiGetNextNode+2e
    fffff800`03f0ff0a 488b4908        mov     rcx,qword ptr [rcx+8]
    MM_INTERNAL_CODE:  5
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    BUGCHECK_STR:  0x50
    PROCESS_NAME:  TobuActivation
    CURRENT_IRQL:  0
    TRAP_FRAME:  fffff8800a2ce680 -- (.trap 0xfffff8800a2ce680)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa804b7ce6b0 rbx=0000000000000000 rcx=fffffa804b7ce6b0
    rdx=fffffa800a222b2a rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80003f0ff0a rsp=fffff8800a2ce818 rbp=fffffa800b5e9660
     r8=000000000000000b  r9=0000000000006f8c r10=0000000000000000
    r11=fffff8800a2ce700 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe nc
    nt!MiGetNextNode+0x2e:
    fffff800`03f0ff0a 488b4908        mov     rcx,qword ptr [rcx+8] ds:fffffa80`4b7ce6b8=????????????????
    Resetting default scope
    LAST_CONTROL_TRANSFER:  from fffff80003f5a5b3 to fffff80003eddbc0
    STACK_TEXT:  
    fffff880`0a2ce518 fffff800`03f5a5b3 : 00000000`00000050 fffffa80`4b7ce6b8 00000000`00000000 fffff880`0a2ce680 : nt!KeBugCheckEx
    fffff880`0a2ce520 fffff800`03edbcee : 00000000`00000000 fffffa80`4b7ce6b8 00000000`00000000 fffffa80`0beb4a00 : nt! ?? ::FNODOBFM::`string'+0x43801
    fffff880`0a2ce680 fffff800`03f0ff0a : fffff800`04278490 00000000`00000001 fffffa80`0beb4a00 00000000`00000080 : nt!KiPageFault+0x16e
    fffff880`0a2ce818 fffff800`04278490 : 00000000`00000001 fffffa80`0beb4a00 00000000`00000080 00000000`000007ff : nt!MiGetNextNode+0x2e
    fffff880`0a2ce820 fffff800`04137ac8 : fffffa80`0befd990 fffff880`0a2ce900 00000000`00000000 00000000`000000d0 : nt!MmEnumerateAndReferenceImages+0x160
    fffff880`0a2ce8a0 fffff800`041960fe : fffffa80`0befd990 00000000`00000000 fffffa80`0beb4a00 fffffa80`0befdaf0 : nt! ?? ::NNGAKEGL::`string'+0x204c9
    fffff880`0a2cea40 fffff800`041b20d9 : 00000000`7efdb000 00000000`00000001 00000000`00000000 00000000`00000000 : nt!PspExitProcess+0x4e
    fffff880`0a2ceaa0 fffff800`041966b8 : 00000000`00000000 00000000`00000001 00000000`7efdb000 00000000`00000000 : nt!PspExitThread+0x4e9
    fffff880`0a2ceba0 fffff800`03edce53 : fffffa80`0befd990 00000000`00000000 fffffa80`0beb4a00 00000000`005e2dd8 : nt!NtTerminateProcess+0x138
    fffff880`0a2cec20 00000000`7700157a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0008dcb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7700157a
     
    STACK_COMMAND:  kb
    FOLLOWUP_IP: 
    nt!MiGetNextNode+2e
    fffff800`03f0ff0a 488b4908        mov     rcx,qword ptr [rcx+8]
    SYMBOL_STACK_INDEX:  3
    SYMBOL_NAME:  nt!MiGetNextNode+2e
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: nt
    DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035
    IMAGE_NAME:  memory_corruption
    FAILURE_BUCKET_ID:  X64_0x50_nt!MiGetNextNode+2e
    BUCKET_ID:  X64_0x50_nt!MiGetNextNode+2e
    Followup: MachineOwner
      My Computer


  9. Posts : 19,383
    Windows 10 Pro x64 ; Xubuntu x64
       #9

    TobuActivation.exe is the Toshiba Online backup executable.

    Follow carwiz's advice, and then also run this (based on the BugCheck 50):

    Run a minimum of 8 passes of MemTest86+, preferably overnight, or until errors occur using.

    Use this tutorial to help you use MemTest86+:
    RAM - Test with Memtest86+
      My Computer


  10. Posts : 7
    Windows 7 Home Premium 64 Bit
    Thread Starter
       #10

    I reran the utility when I posted those last files.

    I did the memory test, but it found nothing after 8 passes. I also did MBAM in Safe Mode with Networking, but that came up blank, too. I don't have any fixit programs installed and really don't do that. Unless System Mechanic counts? I don't see why that would, though.

    I want to post the snip, but I'm not sure how to do that on this forum. Did you mean attach it or put on the post itself?
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 04:50.
Find Us