BSOD on start, Startup Repair: Unknown Bugcheck: Bugcheck 3d

[Clonkex]

We've been getting a BSOD on one of our computers on startup recently. The exact message the BSOD gives varies but often mentions atapi.sys. Having done extensive research we've come to the conclusion that it could be a rootkit or it could be the fact that we have Daemon Tools installed on the computer. The problem is, when the BSODs first started (entirely at random - we'd done no updates and changed nothing, except perhaps to install a game or two, not sure), repeatedly trying to start the computer would eventually make it start (after 4 or 5 attempts) and it would be fine after that, but they've gotten worse and no matter how many times we tried, we've been unable to make it start, safe-mode or otherwise. If only we could get the thing to start up, we could run heaps of rootkit scans.

We'd really rather not do a format and full reinstall, so we're looking for solutions that can be done by hand.

So far, we've tried renaming atapi.sys and copying a fresh (hopefully clean) version from a different computer via Recovery Environment's cmd prompt, but the BSODs still occur. We've tried Startup Repair, but it gives this message:

Root cause found:

Unknown Bugcheck: Bugcheck 3d. Parameters = 0xfffff88002ffb020, 0x0, 0x0, 0xfffff88000e012b8.

Repair action: System files integrity check and repair
Result: Failed. Error code = 0x490

We have no USB keys plugged in when doing the Startup Repair.

Specs:

Windows 7 Home Premium x64
Intel Core 2 Quad (can't remember the exact model)
4gb Ram
GTX470
MSI MS-7528 Motherboard

We're dual-booting two harddrives. One has Windows XP on it, the other Windows 7. The XP harddrive boots fine, but the 7 drive BSODs every time.

We cannot boot into Windows, safe-mode or otherwise.

Any help would be much appreciated

 

[Golden]

Additional information is required.

1. Download this .BAT file to your desktop

Download


2. Right-click the .BAT file and then click 'Run as Administrator'
3. Locate the .ZIP file created on your desktop, and upload it here in your next reply.

 

[Clonkex]

Additional information is required.

1. Download this .BAT file to your desktop
download
2. Right-click the .BAT file and then click 'Run as Administrator'
3. Locate the .ZIP file created on your desktop, and upload it here in your next reply.

Surely this is pointless without being able to start up the computer? To be clear, we can't run anything on the problem computer that requires Windows to be running.

 

[Golden]

Have you tried a Repair Install?

http://www.sevenforums.com/tutorials/3413-repair-install.html

 

[Clonkex]

Have you tried a Repair Install?

No. I was hopeful when I read what it could do, but... have you even read my first post?

1. Start Windows 7

We cannot start Windows.

I don't mean to be rude, but you have twice asked us to perform tasks that require the computer to be running fine already.

 

[Golden]

My apologies, I missed the bit about you not being able to boot Windows 7 at all - I see you've made that bold now.

If you can boot in XP, and navigate to the Windows 7 disk/partition, see if you can locate the latest .dmp file in C:\Windows\MiniDump.

If you can, upload it here and I'll take a look....although I'm not sure what we can actually do about it until you can boot Windows 7. The only thing I can suggest is to run a Startup Repair 3 times...this multiple runs will sometimes fix the errors to allow you to boot.

Reference tutorial if you need it:
http://www.sevenforums.com/tutorials/681-startup-repair.html

 

[Clonkex]

My apologies, I missed the bit about you not being able to boot Windows 7 at all

Ok no worries

So basically, we needed (wanted) the PC going now, so we had to resort to formatting and reinstalling. We had had some weird virus-related issues from previously (such as Windows Firewall being permanently disabled and network sharing not working), so we decided it was worth the effort to simply start from scratch.

The really weird thing is - it's doing it again. It started out just fine. All going well, installed graphics drivers, Chrome, restarted several times as necessary. Then installed a few optional updates, including those related to the Microsoft mouse we use, and restarted again (it told us to). BIOS screen, Windows Logo, BSOD. BIOS screen, Windows Logo, desktop.

As a bit of extra information, we've had two hard drives in that PC for some time - one with Win7, the other with XP. Both ~350GB. Too small. So just last week we bought a brand new 1TB Seagate drive to replace the Win7 drive (XP was rarely used). To save time, we decided to simply clone the entire 350GB drive to the 1TB drive and merge the partitions (knowing full well cloning copies over any and all errors in the data). This worked a charm - except that it still got the BSODs. We now assumed it was not a failing drive and that it was corrupted/virus'd data and this is where we did the full format.

That's one reason it's so weird that we're still getting the rotten BSODs. It's a brand new hard drive with a brand new installation of Windows. We now assume it's a hardware issue (obviously). We managed to stop the most recent BSOD long enough to see the error (Disable Restart On Error or whatever it's called) and it once again referenced atapi.sys with an actual error of DRIVER_IRQL_NOT_LESS_OR_EQUAL.

We realised we still had the old 350GB Win7 drive plugged in. It was second in the boot order, with the new 1TB drive first, so we can't see how that could have affected it, but we removed it entirely from the boot list. It then started up first go, but that may well have been a fluke as we only started up once. We're about to restart a few more times to test and report back. If it BSODs again we'll try physically unplugging the old drive. Good tip about running Startup Repair three times - will do if necessary

 

[Clonkex]

Ok, so the successful boot after changing the boot order was definitely a fluke (as expected). It has, since, gotten even worse and been crashing even more, sometimes just hard resetting with no BSOD (as far as we can see).

When we bought the CPUs (the Core 2 Duos that were in them were just too slow) that now inhabit these two near-identical PCs, we got them second-hand. I got a Q9550 for mine and my brother (the other half of the "we") got a Q9505. Both Core 2 Quads, only mine's an earlier version and has a 12MB L2 cache over my brother's 6MB.

I'm a bit obsessive about fixing computers, so despite the fact that we were intending on taking the computer to an excellent local repair shop tomorrow, I just couldn't stop thinking about it. I decided that even though it would take an age, I would try to run Startup Repair three times from the Windows 7 disk. The disk booted and began loading its version of Windows, but crashed exactly as when booting from the hard drive. I unplugged everything but the disk drive and tried again. I was pretty sure at this point that it was not software-related, but when it crashed again I became utterly convinced that it was hardware.

When we bought the CPUs, we both checked carefully on the MSI website for the CPU support chart - yup, both versions of the CPU were supported. Clearly, however, we didn't check carefully enough, because there's actually two versions of our motherboard. The FSB-1600 version and the original (FSB-1333). Despite both CPUs being rated for 1333, only mine was actually listed as supported on the MSI website (if only we'd read more carefully!).

So this got me thinking. I decided that I'd just try turning down the speed of the CPU, and did so in the BIOS by turned the FSB ratio from 8.5 (2.83GHz) to 6 (2GHz). Behold, it starts.

So I tell my brother and the first thing we do is take off the cooling fan and reapply heat goo. Unfortunately, as expected, this made no difference. But we did discover that it also starts fine with the FSB ratio set down just one notch (from 8.5 to 8).

We now CAN boot into Windows

What could this be? Is it a dying motherboard or a dying CPU? It doesn't appear to be running hot: 44°C according to CPUID's HW Monitor.

 

[Golden]

I've asked Steve to stop by here and offer some suggestions.

 

[Clonkex]

I've asked Steve to stop by here and offer some suggestions.

Thanks

 

[essenbe]

Clonkex, first let me sy that even if you wer able to get it to boot into Windows, if the CPU is not supporeted by yjr motherboard, it will never run correcyly. In ome cases it is the internal arcitecture of the way the CPU works that the board has to support. That being said, if your CPU is not supported by your board, it is surprising it will boot under any circumstances. Also, If you have virus problems on your other drive, cloning it would slso transfer the virus. That plus the fact that you can get rid of a virus, but I know of almost no way to repair the filed thr virus damaged.

To try to resolve some of those problems, I would first update your bios from MSI's website. However we need to get you more stable before flashing the bios. If you BSOD during a bios update, it could brick the whole board. So, while you can still boot into windows, please run sfc/ scannow from an elevated comand prompt (click start, type cmd in the search box, right click the entry that appears and select 'run as administrator). In the window that appears after giving it admin permission you can copy/paste this sfc /scannow and press enter. (if you decide to type in the command, please notice the space between sfc and the /) If it runs and finds errors, it will attempt to correct them. When it completes reboot. Now run it again and if errors are found reboot. You may have to do this several times for it to work completely (no more than 4, I would think). What we want is for it to run and report no integrity violations were found. What you are running is the system file checker. It will check only system files and attempt to repair any damaged or corrupted files.

I would also like you to post a sreenshot of Disk management. (http://www.sevenforums.com/tutorials/274797-disk-management-post-screen-capture-image.html) In case you don't know, here is how to post a screenshot on Seven Forums http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

I would also like you to run the utility Golden requested inthe second post and upload the files wit your next post.

This next one you are not going to like. As with most hardware tests, it will take a considerable time to run. Please run memtest86 for a minimum of 8 Passes. 8 passes is important.. Each pass is a slightly different set of 9 or 10 tests. Each pass tests a different part of the ram, so it takes 8 complete passes to run a complete test. Having said that, if you get an error anytime during the tests, stop the tests by pushing the escape key. Any error is a failure, no reason to keep running it.

If you have any questions, feel free to ask away. We do not mind answering questions or giving further instructions on what we have asked.

If at any time your computer fails to boot, disconnect at least 1 cable from every hard drive except the one with windows on it and run startup repair again up to 3 times with reboot attempts between each time you run it.

EDIT: while you are at the MSI web site, see if you can update any of the other drivers they have listed. Particularly the chipset driver and sata drivers.

 

[Clonkex]

if the CPU is not supporeted by yjr motherboard, it will never run correcyly

Well for the last 5 months or so, it has worked perfectly.

Also, If you have virus problems on your other drive, cloning it would slso transfer the virus. That plus the fact that you can get rid of a virus, but I know of almost no way to repair the filed thr virus damaged.

Did you read the bit where I said we wiped the drive and did a fresh install? :huh: I guarantee there's no viruses.

However we need to get you more stable before flashing the bios

Too late Given we were only BSODing on startup we decided it was worth the (small) risk and flashed the latest version. No improvement, still BSODing if you turn speed stepping back on.

So, while you can still boot into windows, please run sfc/ scannow from an elevated comand prompt (click start, type cmd in the search box, right click the entry that appears and select 'run as administrator). In the window that appears after giving it admin permission you can copy/paste this sfc /scannow and press enter. (if you decide to type in the command, please notice the space between sfc and the /) If it runs and finds errors, it will attempt to correct them. When it completes reboot. Now run it again and if errors are found reboot. You may have to do this several times for it to work completely (no more than 4, I would think). What we want is for it to run and report no integrity violations were found. What you are running is the system file checker. It will check only system files and attempt to repair any damaged or corrupted files.

I doubt this is necessary given it's a fresh install of Windows and we've basically proven it's a hardware issue.

I would also like you to post a sreenshot of Disk management. (Disk Management - Post a Screen Capture Image) In case you don't know, here is how to post a screenshot on Seven Forums Screenshots and Files - Upload and Post in Seven Forums

I would also like you to run the utility Golden requested inthe second post and upload the files wit your next post.

Again, we've proven it's a hardware issue, but if you insist...

This next one you are not going to like. As with most hardware tests, it will take a considerable time to run. Please run memtest86 for a minimum of 8 Passes. 8 passes is important.. Each pass is a slightly different set of 9 or 10 tests. Each pass tests a different part of the ram, so it takes 8 complete passes to run a complete test. Having said that, if you get an error anytime during the tests, stop the tests by pushing the escape key. Any error is a failure, no reason to keep running it.

We know it's a hardware issue but we're 99.9% certain it's not ram. We've replaced the ram with known-good ram and it still fails to boot when speed stepping is enabled or the CPU's FSB ratio is set to 8.5 (full speed). However we're certainly willing to leave memtest running overnight (we've already memtested for an hour or so, but we'll do a full overnight test this time).

If at any time your computer fails to boot, disconnect at least 1 cable from every hard drive except the one with windows on it and run startup repair again up to 3 times with reboot attempts between each time you run it.

Did that first thing. Tried different SATA cables and ports as well. Also tested by disconnecting everything except the disk drive and trying to boot from the Win7 install disk and it still crashed (this was before I tried lowering the CPU speed).

Thanks for your help so far, I'll get back to you with the results of those tests

 

[essenbe]

Clonkex, I detect some resentment in your response to some of my suggestions. I came here to try to help. If you would prefer, I will be more than happy to find someone else to help you. I suggested certain tests in order to get a direction on which hardware may be the issue. The simple act of having a BSOD can cause corrupted system files. A good percentage of the hardware issues we see here are caused by ram problems or ram incompatibilities with certain motherboards. If you don't already have it, a good suggestion may be to install CPUz and post screenshots of the SPD tab for each slot that has ram installed and the Memory tab.Also, the next time you go to bios check the values of the +12V, +5V and the +3.3V. ATX standards are +/- 5%. That will show what your PSU is putting out at idle although it won't show what it puts out under stress. Cupid Hardware Monitor will show those values, but it is software and not 100% reliable. Also, I was hoping that the tests Golden requested would show from the dump files what crashed and give us an indication of where the problem may lie.

 

[Clonkex]

AAAAAAAAHHH!!! GRRRG!! STUPID THING!! I just hit Post and it said "Your submission could not be processed because the token has expired." AAAAAAAAAAH!! The ONE time I didn't copy the text before hitting Post!! Hhhh.... time to rewrite...

Clonkex, I detect some resentment in your response to some of my suggestions.

No, no! I just re-read what I'd written, and it did indeed seem resentful. I didn't mean that at all. I just forget sometimes that you can't see my face

I came here to try to help.

And it is much appreciated! You're taking precious time out of your own life to help me, just some random guy on the internet. I apologise if I seemed ungrateful.

We took the PC to a really excellent local repair shop yesterday (we were going to town anyway). Darren (the owner) did a whole heaps of tests. He tried new ram, a new graphics card, even a new PSU. He said the fact that it booted as far as the Windows logo then crashed told him it was probably a software incompatibility with hardware, probably chipset drivers. He asked us if we'd done any Windows updates since reinstalling Windows, and when we answered yes, he suggested we uninstall all the updates. When we got it home, we checked update history, but there were no updates listed. We rebooted into the BIOS and turned SpeedStep back on. It booted fine :shock: We have no idea why, except maybe Daniel (the other guy at D-Tech) had tried uninstalling updates and Darren didn't know?

Attached is the result of SF Debug (quite a tool!). Here's what happened when I tried to open Disk Management (the service isn't running, maybe? It seems as though Darren has disabled a lot of services and hasn't re-enabled them):

View attachment 304944

Here's a variety of screenshots from CPUZ and HWMonitor (both of which we like to have installed on every computer ):

View attachment 304945
View attachment 304946
View attachment 304947

The HWMonitor screenshots may be a bit useless because the voltages could be spiking and not showing in the shots (I'll do more thorough testing via the BIOS later) but you may see something that I can't or haven't:

View attachment 304948
View attachment 304949

 

[Clonkex]

Ok, we started the VDS service and Disk Management worked fine:

View attachment 304950

 

[essenbe]

Clonkex, don't worry about the other stuff. I'm not that easily offended. It is easy to be taken wrong on these computers. Gestures and facial expressions are underrated.

Again, it is software and I don't really trust all readings, but it is what we have. I really see nothing that stand out. The +12V and the +3.3V are on the very high edge of being within ATX standards but they are within standards. I see no temp problems either. The ram seems to be fine although personally I would make sure and set the dimm voltage in bios by hand to 1.8V. CPUZ is the one piece of software I do trust.

I do notice you installed without the 100MB partition, which I do also. The 'D' drive is almost completely full and has 9GB of space to the left of it unallocated. You can regain that space if you want to, but Disk Management can't do it. We'll tell you how if you want to. You can stop, start or make delayed startup on any service by holding the windows key down and pushing the R key to get a run box. Type services.msc in the run box and hit enter. Right click the service and select properties. In the properties of any service you can set it how you want to. Just be sure you know which ones to set and which to leave alone. I would run windows update and install updates. IN Windows Update in the left hand column, click change settings and set the drop down box to check for updates but let me decide what to install. It will cause you some grief, but you will know what you are installing. I install all updates for the OS but not for the hardware until I have checked it myself, by going to the motherboard manufacturer's site or the hardware manufacturer's site to see what the most recent WHQL driver is. You mentioned the Chipset driver. To me, that is the most important driver and make sure you have the latest version installed.

Just to be certain, I would check the hard drive for errors by running Seatools for DOS and chkdsk. That will check the disk for any errors. Another possibility when the bios hands off to the disk during bootup, is hard drive errors. Besides, any time I buy a new disk, I always run those first thing to make sure. you may be surprised at how many come new with errors. But, your repair shop guy was right also. When the drive starts, that's when Windows starts loading drivers.