BSOD 10~ Seconds After Startup | Multiple Possible Reasons


  1. Posts : 3
    Windows 7 Home Premium 64bit
       #1

    BSOD 10~ Seconds After Startup | Thanks koolkat77!


    Sorry that I couldn't put my believed reasons why I believe my PC is bluescreening above, but WhoCrashed and BlueScreenView have said different things,

    ntoskrnl.exe+f0017 FLTMGR.sys | klflt.sys klif.sys

    The first two are from BSV, which if I am correct that should have to do with my hard drive and kernel systems and the other two, which I know have to do with Kaspersky, are from WhoCrashed, not that it entirely matters I just wanted to lay everything down so for less confusion later on.

    Information on what I was doing before hand, dusting my PC and taking out my sound card, and yes I have unplugged and plugged back in my hardware such as my HDD, cables, etc.

    First off, I have checked with sfc /scannow just to make sure it is not a integrity violation which after 4 tries I am supposedly clean. Next, I made sure it wasn't my ram since I was greeted by the BSOD with PAGE_FAULT_IN_NONPAGED_AREA even though so far every BSOD said the culprit was klif.sys. No luck. Then I've tried SeaTools (Because, ya' know FLTMGR.sys) fast and long, both said I was fine.

    So what's next?


    Bug Check Code from BSV - 0x00000050
    I'll also provide WhoCrashed and BSV files along with the usual zip just to be safe and sound.

    Good luck my friend!
    Last edited by yerboi; 23 Oct 2015 at 14:30. Reason: Crediting!
      My Computer


  2. Posts : 15,026
    Windows 10 Home 64Bit
       #2

    Code:
    Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\KOOLKAT\Downloads\DAN-PC-Thu_10_22_2015_175504_79\102215-35677-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.19018.amd64fre.win7sp1_gdr.150928-1507
    Machine Name:
    Kernel base = 0xfffff800`0324d000 PsLoadedModuleList = 0xfffff800`03494730
    Debug session time: Fri Oct 23 01:44:31.965 2015 (UTC + 6:00)
    System Uptime: 0 days 0:01:59.775
    Loading Kernel Symbols
    .
    
    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.
    
    ..............................................................
    ................................................................
    ...................................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 50, {fffffffffffffff0, 0, fffff8800499eb2f, 0}
    
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    
    Could not read faulting driver name
    *** WARNING: Unable to verify timestamp for win32k.sys
    *** ERROR: Module load completed but symbols could not be loaded for win32k.sys
    Probably caused by : klif.sys ( klif+d2b2f )
    
    Followup: MachineOwner
    ---------
    
    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffffffffffff0, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff8800499eb2f, If non-zero, the instruction address which referenced the bad memory
    	address.
    Arg4: 0000000000000000, (reserved)
    
    Debugging Details:
    ------------------
    
    
    Could not read faulting driver name
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fe100
    GetUlongFromAddress: unable to read from fffff800034fe1c0
     fffffffffffffff0 
    
    FAULTING_IP: 
    klif+d2b2f
    fffff880`0499eb2f 483913          cmp     qword ptr [rbx],rdx
    
    MM_INTERNAL_CODE:  0
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0x50
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
    
    TRAP_FRAME:  fffff880047c5600 -- (.trap 0xfffff880047c5600)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800e9eaa90
    rdx=00000000010ae200 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8800499eb2f rsp=fffff880047c5790 rbp=00000000010ae200
     r8=fffffa800e9eaa70  r9=fffff880047c5840 r10=fffff8800494d420
    r11=fffff880047c57b8 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe cy
    klif+0xd2b2f:
    fffff880`0499eb2f 483913          cmp     qword ptr [rbx],rdx ds:00000000`00000000=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff8000333d017 to fffff800032c1200
    
    STACK_TEXT:  
    fffff880`047c5498 fffff800`0333d017 : 00000000`00000050 ffffffff`fffffff0 00000000`00000000 fffff880`047c5600 : nt!KeBugCheckEx
    fffff880`047c54a0 fffff800`032bf32e : 00000000`00000000 ffffffff`fffffff0 fffff880`047c5700 ffffffff`fffffff0 : nt! ?? ::FNODOBFM::`string'+0x4174f
    fffff880`047c5600 fffff880`0499eb2f : fffff8a0`04173110 00000000`00000001 fffff8a0`04173110 00000000`00004200 : nt!KiPageFault+0x16e
    fffff880`047c5790 fffff8a0`04173110 : 00000000`00000001 fffff8a0`04173110 00000000`00004200 00000000`00000000 : klif+0xd2b2f
    fffff880`047c5798 00000000`00000001 : fffff8a0`04173110 00000000`00004200 00000000`00000000 fffff880`0499e5eb : 0xfffff8a0`04173110
    fffff880`047c57a0 fffff8a0`04173110 : 00000000`00004200 00000000`00000000 fffff880`0499e5eb fffffa80`0e9eaa70 : 0x1
    fffff880`047c57a8 00000000`00004200 : 00000000`00000000 fffff880`0499e5eb fffffa80`0e9eaa70 00000000`010ae200 : 0xfffff8a0`04173110
    fffff880`047c57b0 00000000`00000000 : fffff880`0499e5eb fffffa80`0e9eaa70 00000000`010ae200 fffff880`047c57e0 : 0x4200
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    klif+d2b2f
    fffff880`0499eb2f 483913          cmp     qword ptr [rbx],rdx
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  klif+d2b2f
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: klif
    
    IMAGE_NAME:  klif.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5603f1b7
    
    FAILURE_BUCKET_ID:  X64_0x50_klif+d2b2f
    
    BUCKET_ID:  X64_0x50_klif+d2b2f
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0x50_klif+d2b2f
    
    FAILURE_ID_HASH:  {02ce2f3e-294b-ab95-919a-576e9e005b60}
    
    Followup: MachineOwner
    ---------
    
    4: kd> lmvm klif
    start             end                 module name
    fffff880`048cc000 fffff880`049b7000   klif     T (no symbols)           
        Loaded symbol image file: klif.sys
        Image path: \SystemRoot\system32\DRIVERS\klif.sys
        Image name: klif.sys
        Timestamp:        Thu Sep 24 18:51:03 2015 (5603F1B7)
        CheckSum:         000F1790
        ImageSize:        000EB000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Uninstall Kaspersky and see if that helps.

    Revo Uninstaller:

    Use Revo Uninstaller to uninstall stubborn software.


    Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

    Also uninstall your existing Antivirus software before you install MSE.

    Good and Free system security combination.

       Warning
    Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.


     Clean boot


    Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:
      My Computer


  3. Posts : 3
    Windows 7 Home Premium 64bit
    Thread Starter
       #3

    Ah yes, thank you, hopefully this wasn't too time consuming to pinpoint seeing as the only really, necessary step in this is uninstalling Kaspersky! :)

    Also great minds think alike I see! (I did this overnight)
    https://gyazo.com/252711a5a5d7bf18e1f628154052d4a8

    But don't worry, I'll use your recommended uninstaller right after a quick restart for Kaspersky! Thanks again!
      My Computer


  4. Posts : 3
    Windows 7 Home Premium 64bit
    Thread Starter
       #4

    Hey I know you haven't replied back yet, but the Kaspersky dedicated uninstall got rid of the bsod, now I'm doing your steps to install MSE and the Revo Uninstaller! Very grateful! (Also sorry for multiple posts!)
      My Computer


  5. Posts : 15,026
    Windows 10 Home 64Bit
       #5

    You're welcome.

    Post if you have any further issues.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 03:10.
Find Us