Solved BSOD 10~ Seconds After Startup | Multiple Possible Reasons

[yerboi]

BSOD 10~ Seconds After Startup | Thanks koolkat77!

Sorry that I couldn't put my believed reasons why I believe my PC is bluescreening above, but WhoCrashed and BlueScreenView have said different things,

ntoskrnl.exe+f0017 FLTMGR.sys | klflt.sys klif.sys​

The first two are from BSV, which if I am correct that should have to do with my hard drive and kernel systems and the other two, which I know have to do with Kaspersky, are from WhoCrashed, not that it entirely matters I just wanted to lay everything down so for less confusion later on.

Information on what I was doing before hand, dusting my PC and taking out my sound card, and yes I have unplugged and plugged back in my hardware such as my HDD, cables, etc.

First off, I have checked with sfc /scannow just to make sure it is not a integrity violation which after 4 tries I am supposedly clean. Next, I made sure it wasn't my ram since I was greeted by the BSOD with PAGE_FAULT_IN_NONPAGED_AREA even though so far every BSOD said the culprit was klif.sys. No luck. Then I've tried SeaTools (Because, ya' know FLTMGR.sys) fast and long, both said I was fine.

So what's next?


Bug Check Code from BSV - 0x00000050
I'll also provide WhoCrashed and BSV files along with the usual zip just to be safe and sound.

Good luck my friend!

 

[koolkat77]

Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\KOOLKAT\Downloads\DAN-PC-Thu_10_22_2015_175504_79\102215-35677-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.19018.amd64fre.win7sp1_gdr.150928-1507
Machine Name:
Kernel base = 0xfffff800`0324d000 PsLoadedModuleList = 0xfffff800`03494730
Debug session time: Fri Oct 23 01:44:31.965 2015 (UTC + 6:00)
System Uptime: 0 days 0:01:59.775
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffffffffffff0, 0, fffff8800499eb2f, 0}

*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys

Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : klif.sys ( klif+d2b2f )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffffffffff0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8800499eb2f, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fe100
GetUlongFromAddress: unable to read from fffff800034fe1c0
 fffffffffffffff0 

FAULTING_IP: 
klif+d2b2f
fffff880`0499eb2f 483913          cmp     qword ptr [rbx],rdx

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME:  fffff880047c5600 -- (.trap 0xfffff880047c5600)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800e9eaa90
rdx=00000000010ae200 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800499eb2f rsp=fffff880047c5790 rbp=00000000010ae200
 r8=fffffa800e9eaa70  r9=fffff880047c5840 r10=fffff8800494d420
r11=fffff880047c57b8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe cy
klif+0xd2b2f:
fffff880`0499eb2f 483913          cmp     qword ptr [rbx],rdx ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000333d017 to fffff800032c1200

STACK_TEXT:  
fffff880`047c5498 fffff800`0333d017 : 00000000`00000050 ffffffff`fffffff0 00000000`00000000 fffff880`047c5600 : nt!KeBugCheckEx
fffff880`047c54a0 fffff800`032bf32e : 00000000`00000000 ffffffff`fffffff0 fffff880`047c5700 ffffffff`fffffff0 : nt! ?? ::FNODOBFM::`string'+0x4174f
fffff880`047c5600 fffff880`0499eb2f : fffff8a0`04173110 00000000`00000001 fffff8a0`04173110 00000000`00004200 : nt!KiPageFault+0x16e
fffff880`047c5790 fffff8a0`04173110 : 00000000`00000001 fffff8a0`04173110 00000000`00004200 00000000`00000000 : klif+0xd2b2f
fffff880`047c5798 00000000`00000001 : fffff8a0`04173110 00000000`00004200 00000000`00000000 fffff880`0499e5eb : 0xfffff8a0`04173110
fffff880`047c57a0 fffff8a0`04173110 : 00000000`00004200 00000000`00000000 fffff880`0499e5eb fffffa80`0e9eaa70 : 0x1
fffff880`047c57a8 00000000`00004200 : 00000000`00000000 fffff880`0499e5eb fffffa80`0e9eaa70 00000000`010ae200 : 0xfffff8a0`04173110
fffff880`047c57b0 00000000`00000000 : fffff880`0499e5eb fffffa80`0e9eaa70 00000000`010ae200 fffff880`047c57e0 : 0x4200


STACK_COMMAND:  kb

FOLLOWUP_IP: 
klif+d2b2f
fffff880`0499eb2f 483913          cmp     qword ptr [rbx],rdx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  klif+d2b2f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: klif

IMAGE_NAME:  klif.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5603f1b7

FAILURE_BUCKET_ID:  X64_0x50_klif+d2b2f

BUCKET_ID:  X64_0x50_klif+d2b2f

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x50_klif+d2b2f

FAILURE_ID_HASH:  {02ce2f3e-294b-ab95-919a-576e9e005b60}

Followup: MachineOwner
---------

4: kd> lmvm klif
start             end                 module name
fffff880`048cc000 fffff880`049b7000   klif     T (no symbols)           
    Loaded symbol image file: klif.sys
    Image path: \SystemRoot\system32\DRIVERS\klif.sys
    Image name: klif.sys
    Timestamp:        Thu Sep 24 18:51:03 2015 (5603F1B7)
    CheckSum:         000F1790
    ImageSize:        000EB000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Uninstall Kaspersky and see if that helps.

Revo Uninstaller:

Use Revo Uninstaller to uninstall stubborn software.

• Download and install the software
• Opt for Advance Mode while uninstalling which allows you to remove leftover registry.
• Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

Also uninstall your existing Antivirus software before you install MSE.

http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

 Clean boot

• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

• How to Change, Add, or Remove Startup Programs in Windows 7

 

[yerboi]

Ah yes, thank you, hopefully this wasn't too time consuming to pinpoint seeing as the only really, necessary step in this is uninstalling Kaspersky!

Also great minds think alike I see! (I did this overnight)
https://gyazo.com/252711a5a5d7bf18e1f628154052d4a8

But don't worry, I'll use your recommended uninstaller right after a quick restart for Kaspersky! Thanks again!

 

[yerboi]

Hey I know you haven't replied back yet, but the Kaspersky dedicated uninstall got rid of the bsod, now I'm doing your steps to install MSE and the Revo Uninstaller! Very grateful! (Also sorry for multiple posts!)

 

[koolkat77]

You're welcome.

Post if you have any further issues.