BSOD upon login

[XaiXo]

Hey everyone.

I'm having some issues with my PC (as you'd imagine, since I'm posting in this section). Until yesterday (10th of February), my PC was working fine and dandy. During the morning and afternoon, it was working as per usual. However, when I went on it during the night, after about 30 seconds of being logged on, up popped a BSOD, and restarted the PC.

After various restarts, it was clear that this wasn't a one-off issue.

There is no recently installed hardware apart from a pair of new HDDs in RAID 0 which are used as storage, and they are working fine. They've been in for about a month, and I can hear them start up as per usual, and can access them as normal when in Safe Mode.

I'm almost certain the cause is not hardware, as I can run in Safe Mode without so much as a hiccup. However, something is causing a crash in regular mode.

Here's my system specs:

Windows 7 Home Premium x64
Intel Core i7 930
6GB Patriot RAM @ 2000MHz, 7-7-7-21
ASUS P6X58D-E
XFX HD 5870
Cosair 650W PSU
1x 60GB OCZ Vertex 2E (Boot)
2x 1TB Samsung Spinpoint F3 (RAID 0 storage)
1x 1TB Western Digital Caviar Green (Storage)



Everything works as per usual in Safe Mode, aside from the stuff that Safe Mode prevents. I've tested my RAM via Memtest and the onboard MemOK! stuff, no errors.

All 4 HDDs are accessible and working as normal as far as I can tell.

My graphics card hasn't had any issues, as it is currently displaying my screen normally. However, I cannot open the Catalyst Control Centre in Safe Mode, is that normal?



According to the crash dumps (looked at via BlueScreenView), ntoskrnl is to blame. However, from what I've read on similar forum threads is that ntoskrnl is essential for basic running, so I'd be having far worse problems than BSOD upon logging in.

Anyway, in my (amateur) opinion, I don't believe it's hardware related, as I'd be having problems in Safe Mode as well, right?



Any and all help would be appreciated, thanks in advance!

I've attached my memory dumps, hope that helps.


~Josh

 

[Maguscreed]

You are suffering a serious case of registry corruption it would appear.

The easiest fix is probably a repair install.
http://www.sevenforums.com/tutorials/3413-repair-install.html
While that should get you able to boot again, you may lose functionality with a few apps and have to reinstall them as well.

The other option is to attempt booting safe mode and try restoring to a point before the problem occurred since the registry is one of the items backed up for restore.
http://www.sevenforums.com/tutorials/700-system-restore.html

The death at login is definitely being caused by a registry problem though. Whether this is just a symptom of something worse (like hard drive failing) can also be checked by running a disk check.
http://www.sevenforums.com/tutorials/433-disk-check.html

I'll leave it at that for the moment. You have a few out of date drivers on your system as well, but there's no point in addressing that if you can't even boot properly.

Just a footnote, you may want to try those options in reverse order Repair install being the last option.

 

[XaiXo]

Thanks, I'll give those a try (well, not a repair, yet).


If the registry corruption is the case, what could have caused it? Primarily so I don't run into this problem again.

 

[Maguscreed]

Well the hard drive could have encountered a problem. Some sort of interruption during shutdown could also have resulted in registry corruption. The reason I'm suggesting disk check is because if it comes up with many bad sectors or errors, it may be time to replace the hard drive.

 

[XaiXo]

Chkdsk came up with nothing.

As for a Repair install, I'm entirely unable to do one - They cannot be done from within Safe Mode, and I'm unable to keep regular mode open for more than a few seconds. Plus, my SSD boot drive only has 6 or so gigabytes left free, which is less than a Repair install requires.

Help!

 

[Maguscreed]

Okay let me do this. I'm going to point you to another thread that offers several possible fixes for this (read the whole thing they don't all require you to be able to boot) Instead of just reprinting them here.
http://www.sevenforums.com/general-discussion/8228-corrupted-registry.html

 

[XaiXo]

Right, something odd has occurred. It seems to be working in regular mode now. Could somebody look into the crash dumps and see if they can find the cause, so I can make sure this doesn't occur again?

Thanks!

 

[Shadowjk]

I am currently Debugging your Crash Dumps this can take a while...

 

[Shadowjk]

There is some Refernece to Registry Problems but it may also be a Hardware issue

Please Test your Memory and Run a Sfc /scannow

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html?ltr=S

After that Run a full scan with your Anti-Virus

Also please check for any Errors in Device Manger and Reinstall any Drivers if necessary

See the Attachment for more information

YOU WILL NEED TO BE AN ADMINISTRATOR AND IT WILL WORK FOR WINDOWS 7 AS WELL AS VISTA

For Reference:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Josh\Desktop\021011-14929-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a15000 PsLoadedModuleList = 0xfffff800`02c52e50
Debug session time: Thu Feb 10 22:00:28.511 2011 (UTC + 0:00)
System Uptime: 0 days 0:00:46.493
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffffffffffff3, 0, fffff80002d5f43d, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CmpKcbCacheLookup+1dd )

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffffffffff3, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002d5f43d, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffffffffffff3 

FAULTING_IP: 
nt!CmpKcbCacheLookup+1dd
fffff800`02d5f43d 418b45f4        mov     eax,dword ptr [r13-0Ch]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  AAWWSC.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88006ba97b0 -- (.trap 0xfffff88006ba97b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000003ff rbx=0000000000000000 rcx=0000000000000aaa
rdx=000000000ef62637 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d5f43d rsp=fffff88006ba9940 rbp=fffff8a000b16010
 r8=0000000000000004  r9=0000000000000000 r10=0000000000000000
r11=fffff88006ba9af0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!CmpKcbCacheLookup+0x1dd:
fffff800`02d5f43d 418b45f4        mov     eax,dword ptr [r13-0Ch] ds:99c0:ffffffff`fffffff4=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b05f14 to fffff80002a85740

STACK_TEXT:  


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!CmpKcbCacheLookup+1dd
fffff800`02d5f43d 418b45f4        mov     eax,dword ptr [r13-0Ch]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!CmpKcbCacheLookup+1dd

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

FAILURE_BUCKET_ID:  X64_0x50_nt!CmpKcbCacheLookup+1dd

BUCKET_ID:  X64_0x50_nt!CmpKcbCacheLookup+1dd

Followup: MachineOwner
---------

Hope This Helps,
Josh

 

[XaiXo]

There is some Refernece to Registry Problems but it may also be a Hardware issue

Please Test your Memory and Run a Sfc /scannow

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html?ltr=S

After that Run a full scan with your Anti-Virus

Also please check for any Errors in Device Manger and Reinstall any Drivers if necessary

See the Attachment for more information

YOU WILL NEED TO BE AN ADMINISTRATOR AND IT WILL WORK FOR WINDOWS 7 AS WELL AS VISTA



Hope This Helps,
Josh

I've tested my memory via the onboard MemOK! button and Memtest86, no errors/faults.

I ran Sfc /scannow with Admin capabilities, no faults detected, though after a restart, it works in regular mode. Whether this fixed it or not, I don't know.

The only error in Device Manager is a USB controller, which has been disabled.

I'm running a full scan with Kasperksy AV, Ad-Aware and MalwareBytes (separately, of course).



Thanks!

 

[XaiXo]

After a restart following many hours of perfectly normal session on regular mode, the same problem is occurring after login.

 

[Maguscreed]

At this point I would have to blame your hard drive. Corruption should not occur this often... well it really shouldn't occur at all.

 

[Shadowjk]

After a restart following many hours of perfectly normal session on regular mode, the same problem is occurring after login.

If you can upload the New Minidump Files and I will have a look

Try and upload them in Safe mode if Normal Mode doesn't work

See http://www.sevenforums.com/tutorials/69585-safe-mode.html For More Information

Many Thanks,
Josh

 

[XaiXo]

After a restart following many hours of perfectly normal session on regular mode, the same problem is occurring after login.

If you can upload the New Minidump Files and I will have a look

Try and upload them in Safe mode if Normal Mode doesn't work

See http://www.sevenforums.com/tutorials/69585-safe-mode.html For More Information

Many Thanks,
Josh

Thanks Shadow.



Maguscreed, surely I'd be having the same issues in Safe Mode (or other issues at all) if it was the SSD?

 

[XaiXo]

It's working in regular Windows mode again, but I'm concerned about turning it off in case I end up stuck in Safe Mode again!
:huh:

 

[Maguscreed]

Xaixo, I have not personally owned a ssd at this point so my own experience with them is limited to a few friend's machines at this point. Just so you see what I'm seeing in a nutshell though. Here is what the debugger is basically saying.

REGISTRY_ERROR (51)
Something has gone badly wrong with the registry. If a kernel debugger
is available, get a stack trace. It can also indicate that the registry got
an I/O error while trying to read one of its files, so it can be caused by
hardware problems or filesystem corruption.
It may occur due to a failure in a refresh operation, which is used only
in by the security system, and then only when resource limits are encountered.
Arguments:
Arg1: 0000000000000001, (reserved)
Arg2: fffff8a000023120, (reserved)
Arg3: 0000000000cdb000, depends on where Windows bugchecked, may be pointer to hive
Arg4: 0000000000000374, depends on where Windows bugchecked, may be return code of
HvCheckHive if the hive is corrupt.

The reason I'm pointing at the hdd is because of the I/O error that seems to be the source of your problem. It could be the drive it could be the controller. I've never heard of this error occurring repeatedly like you are experiencing it though. In a situation where it didn't turn out some piece of hardware is damaged. I suppose RAM is a possible culprit as well.
Something is interfering with your machine properly shutting down though. It's very early in the morning right now. Let me suck down some coffee and I'll have another more indepth look at this most recent dump file.

Edit:
I do see you have the old ASUS ASACPI.sys

It is possible this could be causing the problem. Considering how badly out of date it is. This is about the last software item on the list I can point too though.

You are fortunate you motherboard is one of the boards ASUS apparently decided to provide win 7 support for. http://www.asus.com/product.aspx?p_id=gfbkfnyhppw9tdbb&templete=2 If you click on the downloads ta and choose win 7 64bit you'll find a number of updated system drivers for you system. I would suggest installing as many of them as you can. Chipset, audio, and SATA especially. If there are multiple items for one update type look at the dates on them and choose the most recent. we'll leave the bios update alone for the moment as I don't see a update specific to your problem. And flashing a bios improperly can kill a system dead. On second thought you should probably start with the SATA since that seems to be the source of our current issue.

 

[XaiXo]

I seem to have fixed this issue as of yesterday - I booted from my old boot drive (the 1TB WD Caviar Green drive, now used as storage), and then updated the firmware of the SSD. I then booted back on the SSD in Safe Mode and used MSConfig and removed everything apart from Catalyst Control Centre from startup. Used SFC /SCANNOW and then rebooting seems to have done the trick!

Things are back on startup now and are working as they used to.


Thanks for the help, I've updated the related drivers as well. Much appreciated! I'll be back if it dies on me again!

 

[Maguscreed]

Nice too know I will file away firmware updates as a possible fix for future ssd issues.