BSOD (Again)

[CarlTR6]

This crash occurred after only 25 seconds of uptime. This means it is most likely either a hard issue or a driver issue. Can you boot in the Safe mode without a BSOD? If you can, that points to a likely driver issue. If you get a BSOD in the Safe mode, it is likely a hardware issue. I see this BSOD occurred during a cold boot. A failing power supply can cause this.

Your dump blames wininit.exe for the crash. This file is a Windows system startup file. There are some viruses that disguise themselves as wininit.exe. I suggest you download and install Malwarebytes. Update it and then run a scan to make sure you don't have a nasty lurking about on your system.

I find two outdated drivers loaded on your system. The rest of your drivers look good. Update these two drivers and see if they make a difference.

LHidFilt.Sys Wed Jun 17 12:49:39 2009 - Logitech SetPoint HID Filter Driver. Downloads.

LMouFilt.Sys Wed Jun 17 12:49:43 2009 - Logitech SetPoint HID Filter Driver. Downloads.

Let me know if you can cold boot in the Safe mode without a BSOD. That will tell us what we should try next. If you can boot in the Safe mode, enable Driver Verifier. Driver Verifier will cause a BSOD if it encounters a problem driver. Upload any and all Driver Verifier enabled dumps. Follow the instructions in this tutorial precisely: Driver Verifier - Enable and Disable. If you get a BSOD in the Safe mode, run Memtest again from a cold boot after your computer has been off for a while. http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

 

[alderosa]

Hi Carl. I only seem to get BSOD (most of the time) when I boot from a real cold start, i.e. after several hours of PC downtime so the safe mode test you suggest probably won't be too useful. I did however have a problem with driver verifier. I ran it and got a BSOD on restart resulting from RTKVHD64.sys which gave a stop error code 0.0000005.

I've uploaded the dumps here too. Note that the last 2 dumps from today (12/10/2010) are the ones relevant to the driver verifier (I missed the safe mode option once so got another BSOD before I turned off driver verifier).

I did not have any malware and have updated the logitech drivers also.

 

[alderosa]

So I had left my PC alone for a couple of hours and when I tried to reboot this time I had 'disk read error' press ctrl+alt+del to restart. I did and it restarted fine. Thought I'd mention it though. I've also reduced my RAM timings and voltage to 9-9-9-25 and 1.65V on the recommendation of someone I was talking to about RAM settings.

 

[CarlTR6]

I see that you successfully updated the Logitech drivers. Very good. Your RTKVHD64.sys driver is up to date. The 0.0000005 error code means memory corruption. One of the two Driver Verifier enabled dumps contained no data; it is corrupt. Make sure Driver Verifier is turned off for now.

Run Memtest again from a cold boot after your computer has been off for at least two hours. RAM - Test with Memtest86+. I want to be as certain as we can be (Memtest is not perfect) that RAM is not causing the problem. Post your results.

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03059000 PsLoadedModuleList = 0xfffff800`03296e50
Debug session time: Sat Dec 11 14:10:18.711 2010 (GMT-5)
System Uptime: 0 days 0:00:25.428
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D5, {fffff98002e08d60, 0, fffff8800691cef6, 0}

Unable to load image \SystemRoot\system32\drivers\RTKVHD64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RTKVHD64.sys
*** ERROR: Module load completed but symbols could not be loaded for RTKVHD64.sys

Could not read faulting driver name
Probably caused by : RTKVHD64.sys ( RTKVHD64+d9ef6 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff98002e08d60, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff8800691cef6, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800033010e0
 fffff98002e08d60 

FAULTING_IP: 
RTKVHD64+d9ef6
fffff880`0691cef6 8b4630          mov     eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD5

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003cc82b0 -- (.trap 0xfffff88003cc82b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff88003cc84d8
rdx=fffff88003cc8440 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800691cef6 rsp=fffff88003cc8440 rbp=0000000000000002
 r8=0000000000000000  r9=fffff8800691cef6 r10=0000000000000000
r11=fffff80003243e80 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
RTKVHD64+0xd9ef6:
fffff880`0691cef6 8b4630          mov     eax,dword ptr [rsi+30h] ds:3e80:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003149f14 to fffff800030c9740

STACK_TEXT:  
fffff880`03cc8148 fffff800`03149f14 : 00000000`00000050 fffff980`02e08d60 00000000`00000000 fffff880`03cc82b0 : nt!KeBugCheckEx
fffff880`03cc8150 fffff800`030c782e : 00000000`00000000 fffff8a0`0140910c fffffa80`07038000 fffff800`030fc33f : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`03cc82b0 fffff880`0691cef6 : fffff880`03cc84d8 00000000`00000000 fffff8a0`0140910c fffffa80`06d0ef40 : nt!KiPageFault+0x16e
fffff880`03cc8440 fffff880`03cc84d8 : 00000000`00000000 fffff8a0`0140910c fffffa80`06d0ef40 00000000`00000000 : RTKVHD64+0xd9ef6
fffff880`03cc8448 00000000`00000000 : fffff8a0`0140910c fffffa80`06d0ef40 00000000`00000000 fffff800`00000000 : 0xfffff880`03cc84d8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
RTKVHD64+d9ef6
fffff880`0691cef6 8b4630          mov     eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  RTKVHD64+d9ef6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: RTKVHD64

IMAGE_NAME:  RTKVHD64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c80ab93

FAILURE_BUCKET_ID:  X64_0xD5_VRF_RTKVHD64+d9ef6

BUCKET_ID:  X64_0xD5_VRF_RTKVHD64+d9ef6

Followup: MachineOwner
---------

 

[alderosa]

Hi Carl. I'll do a memtest86+ run on each stick again, I guess I'll have the results by tomorrow afternoon maybe? I'll post as soon as I get them. Today and yesterday the system has only crashed from initial startup i.e. the first time it is turned on or if it left off for few hours before power up. Weird huh?

 

[CarlTR6]

Yes it is weird and it really sounds like a power supply problem.

 

[alderosa]

Odd thing is, that wasn't how it happened before! It would BSOD in the middle of running Firefox or watching a movie!

*Sorry, ignore this. I actually had a bad RAM stick when I first had errors (it's being RMA's at the moment).

 

[alderosa]

As per usual, BSOD on first start up this morning. I'm running Memtest86+ now so I'll post the results when available. My error this time was BAD POOL HEADER Stop code 0x00000019. It also went into startup repair next boot and couldn't fix anything, thought it was a driver problem though. Do you want the dump file for this one too?

I read this post (see link below) about someone with a similar issue and they seemed to come to the conclusion it might be a hard disk issue? I only mention it because it's the same type of problem and I had that 'disk read error' yesterday. Any thoughts? I also did read another post where it was software related and clean install fixed all however...

It's all fun & games isn't it.

http://www.sevenforums.com/crashes-debugging/129280-bsod-start-up.html

 

[CarlTR6]

Run Check Disk

Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt. Please do this for each hard drive on your system.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.

Elevated Command Prompt:
Go to Start and type in "cmd.exe" (without the quotes)
At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"

CHKDSK LogFile:
Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter
Expand the Windows logs heading, then select the Application log file entry.
Double click on the Source column header.
Scroll down the list until you find the Chkdsk entry (wininit for Windows 7).

Copy/paste the results into your next post.

I also suggest that your run an SFC (System File Checker) scan. http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html.

 

[alderosa]

I tried to run a chkdsk on my secondary drive yesterday from in Windows (it's only got my work and pictures on it - no system files) and it got to the end of the scan and simply started again. I selected both the options to scan for and fix any errors. Is this usual? I also couldn't view the results of this in the event viewer. Should I have let in run through again?

I'm still on the memtest at the moment, stick 1 looks ok. I'll try stick 2 in a second then go onto the disk checking. I can also get copies of the Samsung and WD hard drive checkers for my respective drives. Should I use those too?

 

[alderosa]

So memtest86+ on the second stick came up with lots of errors. Weird cos it didn't before and I did 6 passes but I guess that's life. I guess I'll have to RMA this one too. Hopefully, if I boot with just the 1 stick it won't blue screen. Should be a good test of the RAM. I might see if the guys at Newegg will refund me and let me have other RAM, 2 defective sticks out of 4 is pretty bad.

 

[CarlTR6]

Yes, sometimes it will run twice. The log should show up in Event Viewer under Application. Look for the wininit entry.

It certainly will not hurt to run the manufacturers' hard drive checkers. These are much more thorough than Check Disk.

Indeed, two bad sticks out four is bad; but it does happen. Don't for get to test you motherboard slots with the good stick. Post back with how your computer does on the one good stick.

 

[alderosa]

I'll do some disk checks now, I'll have to RMA that RAM though. I guess the fact it didn't show errors the first time was just a fluke? It definitely seems bad now. Hopefully it was this that was the cause. I'll let you know.

 

[CarlTR6]

Memtest is not 100% perfect. It is not unusual for it to miss something the first time or even miss it altogether. We have seen this happen before.

 

[alderosa]

My chkdsk results, there are a couple of inconsistencies;



Checking file system on C:
The type of the file system is NTFS.


A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 3)...
211200 file records processed. File verification completed.
281 large file records processed. 0 bad file records processed. 2 EA records processed. 44 reparse records processed. CHKDSK is verifying indexes (stage 2 of 3)...
266716 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 3)...
The hash value 0xc2a48011 of the security descriptor entry with Id
0x15c at offset 0x5110 is invalid. The correct value is 0xc2a48019.
The hash value 0xc0e6f51d of the security descriptor entry with Id
0x246 at offset 0x10ff0 is invalid. The correct value is 0xc0eaf51d.
Repairing the security file record segment.
211200 file SDs/SIDs processed. Cleaning up 77 unused index entries from index $SII of file 9.
Cleaning up 77 unused index entries from index $SDH of file 9.
Cleaning up 77 unused security descriptors.
Security descriptor verification completed.
27759 data files processed. CHKDSK is verifying Usn Journal...
35685712 USN bytes processed. Usn Journal verification completed.
Windows has made corrections to the file system.

976657407 KB total disk space.
37704660 KB in 182952 files.
89840 KB in 27760 indexes.
0 KB in bad sectors.
342387 KB in use by the system.
65536 KB occupied by the log file.
938520520 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
234630130 allocation units available on disk.

Internal Info:
00 39 03 00 23 37 03 00 af 98 05 00 00 00 00 00 .9..#7..........
9a 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 ....,...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

 

[alderosa]

The chkdsk results for the other drive, all ok by the looks of it;

Checking file system on D:
The type of the file system is FAT32.

A disk check has been scheduled.
Windows will now check the disk.
Volume Serial Number is DD94-6957
Windows is verifying free space...
Free space verification is complete.
Windows has checked the file system and found no problems.
976513536 KB total disk space.
118496 KB in 3596 hidden files.
105984 KB in 3308 folders.
522518720 KB in 37721 files.
453770304 KB are available.

32768 bytes in each allocation unit.
30516048 total allocation units on disk.
14180322 allocation units available on disk.

 

[zigzag3143]

Alderosa

A quick question.

Why is that drive formatted FAT32??

 

[alderosa]

It's an external hard drive from about 4 years ago and the power supply to it (transformer) broke so I bunged it into this PC when I set it up. I didn't have a large drive (till I bought the main one for this PC) to transfer the stuff on it to and reformat (which I've been meaning to do) but I've got bigger fish to fry at the moment in terms of trouble shooting!

What do you think of the results for the other drive posted above the FAT32 one? Is there anything to worry about?

Hopefully it is just the RAM that's defective and been causing my problem. I should know tomorrow morning if it BSODs on the first boot of the day again. The RAM in it now (1 stick of 2Gb) has gone through 2 memtests of 6 passes each so hopefully it is actually good. I'm going to have to return it though and tbh I think I'm going to get a different brand. I'll reformat the hard disk when the other issues are sorted, unless you think it might be a problem?

 

[alderosa]

Just had results of SFC check, no problems reported.

 

[CarlTR6]

Drive C: looks fine. There were a few things wrong in the file system; but Check Disk fixed them. There are no bad sectors - that is a good thing. It is a good idea to run Check disk every now and then to keep the file system in good shape. And if you start seeing many bad sectors popping up, that may be a sign the hard drive is on its way out. A few bad sectors is normal. Drive D: is fine. I, too, was surprised to see it was FAT32.