BSOD upon every Windows boot

[RickZarber]

Hi there. I'm running Win7 Professional 64 (self installed from--I think--an OEM system builder disk) on a year-old, self-built computer, and about a month ago it crashed while I was surfing the web; I haven't been able to use it since.

I get a BSOD every single time I try to run Windows. In normal mode, I get as far as my desktop and icons loading before it goes blue. In all other modes (ie, safe mode, last known good config, etc) it crashes just before the desktop appears.

I've found the BSOD is different nearly every time this happens. I've gotten everything from an IRQL_NOT_LESS_OR_EQUAL, to MEMORY_MANAGEMNT, to BAD_POOL_CALLER, to the latest, which had no title and simply pointed to a fault with the iaStorV.sys file... (Which I think I read is related to RAID control, but my Windows is not on a RAID drive--though there is one in my build.)

I'd include a dump file as specified, but I don't know how to provide that info if I can't even get into at least Safe Mode.

I've tried about every hardware ka-jiggering I can think of (unplugging, rewiring, swapping components) and nothing seems to change. I've run MemTest86 for 8 passes and found no errors. I've run chkdsk on all my drives and turned up nothing (that I can tell, anyway.) My internal temperatures seem to be okay. I'm inclined to think the problem is software based, but I have no idea what to do about it, or how to be absolutely sure.

Software-wise, System Restore only shows my latest restore point for some reason, and it fails every time I attempt it (while inside the Repair Tools menu, that is. If I try to load Windows immediately after, it tells me the restore is successful just prior to the BSOD. ) I've updated my BIOS as well.

I know I've tried other things that I can't remember at the moment--I've been troubleshooting this for a month now, and I'm starting to lose hope and patientce. If anyone has any suggestions for me, they would be most welcome and appreciated.

 

[Jonathan_King]

Hello,

I suspect a malware infection, honestly. A particular rootkit has been wreaking havoc for us lately, showing symptoms exactly as you described.

To complete the rest of these instructions, you will need a Windows installation DVD or a repair disc. If you have neither, create a repair disc.

Boot to the disc, and select "repair my computer". Open a command prompt, and enter the following:

bootrec /fixmbr
bootrec /fixboot

Before rebooting, run a startup repair from the disc a couple of times.

There is more we can try...let's see if that works first though.

 

[RickZarber]

Thanks for the advice! Wish I'd come here sooner... but then, I still probably would have had to check against those other possibilities...

Anyways, I did everything you suggested. Startup Repair (from the disc) detected no problems all 4-5 times I ran it. I then restarted my computer, and it crashed immediately after the Windows logo (no BSOD, just an instant reboot). I was then immediately sent to the hard drive-based Startup Repair, which did detect a problem, which it attempted to fix with a System Restore. Which, of course, failed.

I then booted from the disc again to run Startup Repair once more. It didn't find a problem, but when I looked into the full readout I did find this:

Root cause found:
 
Unknown Bugcheck: Bugcheck 7e. Parameters = 0xffffffffc0000005, 0xfffff880012e49b7, 0xfffff880039169778, 0xfffff880039161e0.
 
Repair action: System Restore
Result: Failed. Error code = 0x1f
Time taken = 67658 ms
 
Repair action: System files integrity check and repair
Result: Failed. Error code = 0x490
Time taken = 418488 ms

I'm crossing my fingers that any of that is helpful...

 

[Jonathan_King]

Just to make sure, you have run those bootrec commands, right?

If not, please do so; if you have, our next course of action is trying the Kaspersky TDSS Killer Tool from the command prompt.

Download the tool here: How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Extract the TDSSKiller.exe to a USB drive, right on the root directory (F:\, G:\, whatever the letter is).

Boot up the DVD or repair CD again, and open the command prompt as before. Enter the following:

f:\tdsskiller.exe

If you can an error about not finding that file, replace F with G, E or even H (if you have a lot of drives!)

 

[RickZarber]

Thanks Jonathan. I did run the bootrec commands the first time.

When I try to run tdsskiller.exe, the command prompt tells me: "The subsystem needed to support the image type is not present."

 

[Jonathan_King]

Let's try something new; you'll be my guinea pig here.

Attached is a copy of atapi.sys from my own system. Extract that file to the USB drive, and then boot up to the command prompt as before.

copy /y f:\atapi.sys c:\windows\system32\drivers

Replace F with the letter of your USB drive (should be the same as before), and if you still get an error saying cannot find file, replace C with D.

The rootkit I am suspecting modifies the atapi.sys file; manually replacing it may or may not help.

I suspect you are using a 64-bit Windows DVD, which may be the cause of the error "The subsystem needed to support the image type is not present." You might try downloading the 32-bit repair disc and running the Kaspersky TDSSKiller tool from there. Here's the tutorial for creating such a disc: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html

 

[RickZarber]

Well, copying the atapi.sys file went smoothly enough, but it didn't seem to make a difference.

I have three Windows discs on me: a 64bit OEM system builder disc (which I borrowed from a friend, and is what I used to install my OS originally), and both 64bit and 32bit store-bought Win7 upgrade discs (which I used to activate my software). I tried to use the system repair tools on the 32bit upgrade disc, but it told me that that version of the tools was incompatible with my installed OS, and to switch discs.

Should I go ahead and make a System Repair disc? (That'll have to wait for my roommate to get home; the notebook I'm on doesn't have a CD drive...)

As a seperate note, my PC is no longer showing a BSOD; it simlpy restarts seconds after the Windows logo appears every time, ever since I ran the bootrec commands....

 

[Jonathan_King]

If you have a 32-bit DVD, there is no need to create a repair disc. Bear in mind that while the tools such as startup repair and system restore may be specific to their respective OS versions (32,64-bit), the command prompts work on either.

You may also try running Startup Repair a few more times now from the DVD, see what happens.

 

[RickZarber]

I can't get to the command prompt on the 32bit DVD, though, since it's under the System Recovery Options, and that's what refuses to load. If there's another way to get to the command prompt, I don't know it.

I ran the startup repair several more times, off the 64bit DVDs and off my hard drive. The DVD version can never detect a problem, but the PC's version does--it just can't fix the problem... (I get the same error message as that bugcheck a couple of posts back.)

 

[Jonathan_King]

I'd feel so stupid if we went through all the effort of treating this as a malware problem, when it was really hardware. Run these tests real quick, just to get them out of the way.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

SeaTools for DOS | Seagate

 

[RickZarber]

Nope, nothing showing up on either of those. (8 clean passes on MemTest86, 4 passes on SeaTools.)

 

[Jonathan_King]

I am a real person, and I will be the first to admit I don't know everything. I try not to be like support technicians for companies like Dell and your ISP, who follow rigid procedures dictated by the higher-ups. All that to say, change of tactic!

Create a Linux live CD, and boot to that. I recommend Ubuntu because it I have a bit of experience with it, and it seems simple enough newcomers to it shouldn't have a problem getting around.

Here is the link to Ubuntu; instructions are included: Download | Ubuntu

Boot to the disc, and select "Try Ubuntu without any changes to my computer". Once it's all loaded, find the equivalent of C:\Windows\Minidump, and copy all the .dmp files out to a USB drive. Zip them up, and attach them here.

 

[RickZarber]

Okay, I've finally had some free time to fiddle with this again. (I got both very sick and very busy for a while there.)

I did everything you advised--got Ubuntu running from the CD just fine--but I hit an unexpected roadblock: my Minidump folder is empty!

Anything else I might try while I've access to my files and folders?

I really appreciate your help and patience. It is keeping me sane.

 

[Jonathan_King]

You might use Ubuntu as a tool to backup your data to an external hard drive; then perform a "clean all" and reinstall.

http://www.sevenforums.com/tutorials/52129-disk-clean-clean-all-diskpart-command.html

 

[RickZarber]

The only reason I haven't done that yet is that I have several programs (such as Photoshop) installed where I'm on my final activation, and if I format and reinstall, I won't be able to use them afterwards. Obviously, if it comes down to a choice between those programs and having a usable computer at all, the latter will win, but if there's any way to avoid the choice, I'd like to try.

I don't suppose you know if there's any way to uninstall programs from Windows while in Ubuntu?

 

[Jonathan_King]

I'm back, apologies for the delay; I've been busy!

Do you have another hard drive, at least as big as your current one, with nothing on it? If so, start by doing a sector for sector clone of the hard drive with CloneZilla: Clonezilla - About

That's your backup drive; you can boot from that drive, or clone it back to the other of need be. Confirm it's a good backup, then go ahead with this fairly risky procedure:

Boot from the install DVD, and start installing right on top of your current installation. Do not format, delete, or otherwise modify any partitions; just start the installation. Wait for about 5 or 10 seconds, and then unplug the computer. Timing is important here.

The idea is that the installer will start writing over the boot files first, and then you unplug it before it starts on your data.

I have tried this once before on a virtual machine; I deleted the boot folder and then restored it again using this method, with great success. I have recommended this procedure only once before, but I can't remember the results.

Bear in mind the risks; make sure you keep that backup handy in case anything goes wrong!

 

[RickZarber]

Hmm. Thanks, but I don't think I trust myself (or my luck) to pull that off correctly. Also, don't have a spare drive at the moment.

A friend offered me the use of his Adobe activation codes, so I think I'm just gonna try a Clean All on this baby, now that I'm sure I've got everything backed up. I'll pop in one last time once everything's re-installed and set the thread as "problem solved" or what-have-you.

In the meantime, my most sincere gratitude for all of your time and assistance. It's a shame we couldn't lick the problem, but having the opportunity to back up everything (especially stuff like fonts and web bookmarks) was a massive help. I probably never would have thought to boot from an Ubuntu disk. So thanks again! And best wishes,

RZ

 

[Jonathan_King]

Well I genuinely hope that works out well for you Rick. I'm glad we could be of some help at least, even if we didn't complete our goals.

 

[RickZarber]

Everything seems to have gone smoothly. Going through and reinstalling everything now...

Thanks again!

 

[DaAdm1n]

Just had same Bugcheck 7e issue on windows 7 enterprise workstation BSOD, I ran startup repair, no joy there, however I was able to run system recovery and all is working again! I know this is an old thread, but I thought a bit of good news would be nice! Thanks for the post, it gave me somewhere to start!