BSOD on boot up and factory reset

[paul1149]

Hi guys, I've got a strange one.

I have a Gateway netbook that blue screens out on booting. I checked the BIOS and it's set to achi, which is correct for Win7 (Starter).

The blue screen is abbreviated, and essentially says Stop: c0000145 Application error. Fail to initialize 0xc000005.

Safe Mode blue screened. The last file shown loaded was disk.sys.

I ran the recovery environment three times. I also ran SFC offline. It found corrupt files that it couldn't repair.

So finally I decided to do a factory reset using the recovery partition. It too blue screened.

That made me suspect hardware. I ran the short self test, the conveyance test and the extended self test on the drive. All passed. I'm now running memtest86. Almost done with Pass 2, no errors. I'll let it go all night, but this error is so blatant I would expect it to surface quickly - probably.

Next step is to restore from disks, or from an external image. That's for tomorrow. But I'm looking for thoughts on what might be going on. Thanks!

 

[Arc]

Can you post a camera snap of the Blue scree? May be we can have some ideas from the parameters.

Also, within the time, scan the system for possible virus infection with the following programs.

• Windows Defender Offline

And, follow it:

• Troubleshooting Windows 7 Failure to Start

Let us know how it goes.

 

[paul1149]

Thank you, Arc. I did have malware in mind at the beginning, but then I abandoned that idea when the Reset blue screened also. But I guess the malware could reside in the Restore Partition as well, right? I have the drive tethered to my desktop now, so I'll run a scanner on it. I already tried replacing the recovery partition with a known-good one (it faulted out too, but not with a blue screen error), so it's too late to check the original store that was on the drive. I'll also read that other page.

Meanwhile the drive has passed Seagate's extended self test. I think my next step is to clone an entire working drive from a similar unit, then try a Reset from it.

 

[Arc]

But I guess the malware could reside in the Restore Partition as well, right?

Malware can reside in the system reserved partition, called bootkit.
Malware can reside within the BIOS. called rootkit.

Better you scan with WDO.

I already tried replacing the recovery partition with a known-good one

What does it mean?

 

[paul1149]

Thanks. You've reminded me that I should flash the bios.

I meant I replaced the recovery partition with a clone from a similar machine.

 

[paul1149]

The trail got a little complicated, but the bottom line is it was a software problem of some type. When I ran the factory recovery partition it wiped the C drive before it faulted out (not a blue screen). That means that WDO could not operate on the drive.

So I decided to go ahead restoring a full disk clone. That booted up fine. But I didn't trust the activation state of it, and since I don't have the full COA for this machine, I ran the eRecovery again. Everything worked fine.

It's possible that WDO could have saved me a lot of aggravation. But that would imply that the malware resided in the FRP as well as the C drive, which I discounted.

So I'm not sure what the problem was. Next time I'll try to be more circumspect. Thanks much for your input!

 

[gregrocker]

Clean Up Factory Bloatware

 

[paul1149]

After rebooting several times, then running WSUS, I then ran WU. This morning I booted to a blinking cursor. Sys Restore won't work from a WinRe disk. The drive still tests fine from a linux environment. Great job, MS. I cut a new winRE disk with a repair patch installed. Hopefully it will work.

 

[gregrocker]

Since you have the bloated factory preinstalled Win7, all bets are off. Did you check that sufficient disk space is apportioned in System Protection - Change Disk Space Usage? Try again from System Recovery Options as sometimes it will report failure but work after several tries.

There is a way to export your factory SLP activation file for reinstalling after a Clean Reinstall - Factory OEM Windows 7 but unfortunately it is not supported here by decision of the Admin, so you'd have to research it yourself so you can get the superior reinstall without a readable COA key.

Sometimes boot code can even interfere with Updates efficacy so I would wipe the HD this time before install using Diskpart Clean Command.

If you can get it to Restore from System Recovery Options then this time install Updates in Small groups with confirmed Restore Point for each. This allows you to pinpoint failing Updates, but more often will install them without issue.

 

[paul1149]

This install wasn't so bloated, and I uninstalled Norton immediately. Yes, Sys Restore was working fine. I even deleted several RPs. And when I accessed SR in WinRe there were numerous candidates.

Thank you for the reminder about exporting activation. That's something I need to look into.

The factory recovery does wipe the hard drive, except for itself of course. That is not the issue. And I had rebooted a good dozen times before this mess.

Currently am doing the Win AIK RE hotfix for error 8000ffff. One might think MS would incorporate this patch into the OS, so that the user could simply make a new RE disk. Apparently too much to ask.

 

[paul1149]

This remains a strange problem. With the WinRE patch I got Sys Restore working. But several restores did not fix the problem. I guess it's just an amazing coincidence, because every bit of software has been rewritten on the drive, and I can't come up with a hardware problem that would do this. Next I'll probably do a restore from factory disks.

 

[paul1149]

I wrote zeros to the drive (DBAN) and then installed from factory disks. I then did 150 restarts and there has been no problem. The image I had used before is known good. I can't figure this out.

Now the updating. If it manifests again, it's got to be in the updates.