BSOD after Recuva 1.51 install and required reboot, cng.sys listed

First off, let me apologize for not having any attached files from the DM Log Collector or the SF Diagnostic Tool as my machine will not boot, be it in normal or safe mode and there does not appear to be any files in the minidump folder as the BSOD happened on reboot before the system was up and running.

Machine specs: Lenovo SL500 laptop with T9800 2.93GHz CPU, 8GB RAM, 320GB hard drive with factory restore partition, Windows XP Pro partition (with Ubuntu 13.04 also installed within a folder on this partition) and Windows 7 Pro partiton which is default boot partiton.

So, here is what has led to my issue but I don't know if it is really related. I had just updated my Piriform Recuva from version 1.4x to the newest version which is 1.51. When the install was finished, it said a reboot was required so I rebooted. Prior to this, the machine has been running fine.

Upon reboot, the machine got as far as the colored swirling patterns that form the Windows 7 logo. The swirling pattern stops and then the BSOD flashes very briefly and the machine reboots. I was able to get a picture of the screen and the following is displayed at the bottom:

STOP: 0x0000007E (0xFFFFFFFFC0000005, 0xFFFFF88001750659, 0xFFFFF880009A8F28, 0xFFFFF880009A8780)
cng.sys - Address FFFFF88001750659 base at FFFFF880001745000, DateStamp 50194fb7

I have tried booting in Safe Mode which also produces the BSOD. I have tried to do Startup Repair but it informs me that a device or something is inaccessible.

Last Known Good Configuration will not boot either. Produces same BSOD. I tried the option to not have the machine restart after error and that BSOD screen had IRQL_NOT_LESS_OR_EQUAL with STOP 0x0000000A (0xFFFFFFFFFFFFFFC0, 0x0000000000000002, 0x0000000000000000, 0xFFFFF80003A95DA2)

Here is where things get weird. I tried booting into Ubuntu and that boots up fine and it is what I am using right now to type this on the machine that wont boot the Windows 7 partition.

Gets weirder. I figured I would clone my issue drive to another drive and use the clone for trying to get things fixed before I mess up the original. Since the spare drive I was going to use has a fresh install of Windows 8.1 on it, I installed that drive to see if there are any files I might have wanted to take off the drive before I wiped the drive.

This drive, which has booted just fine every time I have put it in the laptop, freezes shortly into booting at the logo screen. So, this Windows install seems to have the same issues as my normal Windows 7. After playing with this for a bit, I got a few different BSOD screens, such as KMODE_EXECUTION_NOT_HANDLED ks.sys, SYSTEM_THREAD_EXECUTION_NOT_HANDLED, and ATTEMPTED_EXECUTE_OF_NONEXECUTE_MEMORY rdbss.sys.

So, I tried booting with just one DIMM to see if it was memory related but no matter which DIMM was used in either slot, keep getting BSOD. I even went so far as to replace the 2 DIMMS with 2 other DIMMS but still get BSOD, yet UBUNTU is able to boot just fine and displays correct CPU and RAM in machine.

So, at this point I am at a loss as to what might be going on or what I can try to get my Windows 7 to boot properly again.

I was thinking about taking note of all the BIOS settings and doing a factory restore and then putting the settings back the way I had them on the off chance the settings somehow got corrupt.

Any and all help greatly appreciated.

Thanks.

Dan

ICit2lol,

Thanks for chiming in. I created a bootable CD from the Kaspersky Rescue Disk 10 iso and ran it on the Windows 8 hard drive. Scanningthe Disk Boot Sectors, Hidden startup objects and the complete C:\ drive found nothing. I fear this is what I will find when scanning my Windows 7 drive as well.

Before I saw your message, I had attempted to boot with a Windows 8 CD to see if that would blue screen as well but it booted all the way to the beginning of the Install Process and as you can see from the above message, the Rescue Disk booted fine as well so I am baffled as to what is causing the Windows 7 and 8 to be failing on bootup.

I didn't see anywhere in the rescue disk if it was able to scan the BIOS or CMOS for any hidden gremlins? Is it possible to get infections in these locations? But then again, with UBUNTU booting up, I just don't understand what the Windows installations are seeing that is generating the BSOD.

Any other thoughts are greatly welcome.

Dan

John,

THanks for helping out when you can. I am attempting to clone the drive and work on the clone but I am running into some snags. I have a cheap duplicator made by Cavalry Storage and although it cloned the drive, it did not correctly clone the Windows 7 partition. The partition shows up as having no files.

I am attempting to clone through software using HDCLone, but for some reason, HDCLone wont see my Seagate 320GB SATA drive unless I change my BIOS settings for SATA to Compatibilty mode instead of AHCI mode. This produces copy speeds that are way to slow. It would take a day to copy the drive. So, I am looking into seeing if there is a highly recommended free UBUNTU or Windows cloning software so I can have another attempt at getting the clone done. I hate to work on the original drive until I know I can find a way to fix it while working on a cloned copy.

Do you know much about the bootrec, bootsect and bcdedit commands? Is it possible that I need to do something like the following:

bcdedit /export C:\BCD_Backup
ren c:\boot\bcd bcd.old
bootrec /rebuildbcd

or maybe

bootrec /FixMbr
bootrec /FixBoot
bootrec /Rebuildbcd

bootsect /nt60 all /force

I found these commands while googlling to try and find fixes for my problem. I don't know anything about the commands and I am a bit leary of tyring them because of the partition scheme I currently have. I don't know if it would ruin the XP partition or not along the way.

Thanks again for helping out any way you can.

Dan

John,

Downloaded and installed Macrium Reflect onto a USB stick so I could boot with it and have one drive in the normal bay and one drive in the CD-ROM bay (I have a holder shaped like the CD-ROM but you can insert a HD in it to use for more storage). Problem is, everytime I try to clone my problem drive, it says it cant and complains about partition on the drive I want to clone to. I even tried to delete the partitions that are on the drive first and then clone but get the same issue.

Could the problem be that I am trying to clone my Seagate HD to an OCZ SSD drive? I had not given it much thought but being that the HD uses spinning platters and the SSD uses memory only, maybe this is why I am having issues cloning - the two devices use different ways of storing/fecthing info.

Any other thoughts before I say the heck with it and just try and repair the original drive?

Dan

John,

Sorry to have been away from this thread for so long. I decided to order another hard drive to use for cloning. While waiting for it to arrive, I followed your directions for prepping the SSD and gave it another go with Macrium and this time it seemed to clone my original drive. It booted with the same BSOD at the same point.

So, here is what I have attempted on the cloned copy so far with no luck.

Booted from Windows 7 DVD and ran the Startup Repair - results below.

Startup Repair cannot repair this computer automatically
Problem Details:

Problem signature:
Problem Event Name: StartupRepairOffline
Problem Signature01: 6.1.7600.16385
Problem Signature 02: 6.1.7600.16385
Problem Signature 03: unknown
Problem Signature 04: 1648
Problem Signature 05: ExternalMedia
Problem Signature 06: 1
Problem Signature 07: NoRootCause
OS Version: 6.1.7601.2.1.0.256.1
Local ID: 1033

Diagnosis and repair details:
Startup Repair diagnosis and repair log
-------------------------------
Last successful boot time: 4/25/2014 3:45:12 PM (GMT)
Number of repair attempts: 1

Session details
-------------------------------
System Disk = \Device\Harddisk0
Windows directory = D:\Wndows
AutoChk Run = 0
Number of root causes = 1

Test Performed:
-------------------------------
Name: Check for updates
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: System disk test
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: Disk failure diagnosis
Results: Completed successfully. Error code = 0x0
Time taken = 31 ms

Test Performed:
-------------------------------
Name: Disk metadata test
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: Target OS test
Results: Completed successfully. Error code = 0x0
Time taken = 31 ms

Test Performed:
-------------------------------
Name: Volume content check
Results: Completed successfully. Error code = 0x0
Time taken = 110 ms

Test Performed:
-------------------------------
Name: Boot manager diagnosis
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: System boot log diagnosis
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: Event log diagnosis
Results: Completed successfully. Error code = 0x0
Time taken = 156 ms

Test Performed:
-------------------------------
Name: Internal state check
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: Boot status test
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: Setup state check
Results: Completed successfully. Error code = 0x0
Time taken = 405 ms

Test Performed:
-------------------------------
Name: Registry hives test
Results: Completed successfully. Error code = 0x0
Time taken = 1888 ms

Test Performed:
-------------------------------
Name: Windows boot log diagnosis
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: Bugcheck analysis
Results: Completed successfully. Error code = 0x0
Time taken = 749 ms

Test Performed:
-------------------------------
Name: Access control test
Results: Completed successfully. Error code = 0x0
Time taken = 9656 ms

Test Performed:
-------------------------------
Name: File system test (chkdsk)
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: Software installation log diagnosis
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Test Performed:
-------------------------------
Name: Fallback diagnosis
Results: Completed successfully. Error code = 0x0
Time taken = 0 ms

Root cause found:
-------------------------------
Unspecified changes to system configuration might have caused the problem.

Repair action: System files integrity check and repair
Result: Failed. Error code = 0x490
Time taken = 410455 ms

So, I then tried running CHKDSK /F and here are the results;

CHKDSK is verifying files (stage 1 of 3)…
379904 file records processed.
File verification completed.
1047 large file records processed.
0 bad file records processed.
2 EA records processed.
74 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)…
468366 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 3)…
379904 files SDs/SIDs processed.
Security descriptor verification completed.
44232 data files processed.
CHKDSK is verifying Usn Journal…
37524808 USN bytes processed.
Usn Journal verification completed.
CHKDSK discovered free space marked as allocated in the master file table (MFT) bitmap.
Windows has made corrections to the file system.

201053474 KB total disk space.
136151700 KB in 239216 files.
131956 KB in 44233 indexes.
0 KB in bad sectors.
493378 KB in use by the system.
65536 KB occupied by the log file.
64276440 KB available on disk.

4096 bytes in each allocation unit.
5026336 total allocation units on disk.
1606911 allocation units available on disk.
Failed to transfer logged messages to the event log with status 50.

So, I then tried running sfc using the following command -
Sfc /verifyonly /offbootdir=d:\ /offwindir=d:\windows

Results:

Beginning system scan. This process will take some time.
Windows Resource Protection did not find any integrity violations.

When the BSOD shows up it is displaying the following info:

IRQL_NOT_LESS_OR_EQUAL

STOP: 0x0000000A (0xFFFFFFFFFFFFFFC0, 0x0000000000000002, 0x0000000000000000, 0xFFFFF80003AB0DA2)

When booting from the Windows 7 DVD, I also tried to do a System Restore but it told me there was no restore points. I find this odd because I know there was at least 7-10 restore points prior to my BSOD problem.

Any other thoughts greatly appreciated.

Dan