BSOD while windows is loading - ntoskrnl.exe

[goku93]

Hello everybody!

Sometimes (almost always) when windows 7 starts, the icon of internet is stuck loading, the computer is slow and everything is freezing. After a while a BSOD appear. I have looked at dmp file and it says that is caused by ntoskrnl.exe. After the computer reboot caused by the BSOD it just start normally without any problem. I have done a scan with memtest and everything is ok.

 

[koolkat77]

Welcome to the forum.

Please remove BitDefender for testing purpose. Replace with MSE.

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

Also uninstall your existing Antivirus software before you install MSE.

http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

 Clean boot

• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

• How to Change, Add, or Remove Startup Programs in Windows 7

Your BSOD was caused by Realtek Semiconductor Corp USB Mass Storage Driver. Check for an update :ar: Driver Reference Table

Sometimes drivers remain and do not get completely uninstalled.

 Driver Removal Process:

• Download Driver Sweeper to the desired location.
• Extract the files from the zip.
• Uninstall the driver Program & Features - Control Panel.
• Run Driver Sweeper, check the drivers you want to uninstall or clean registry leftovers of.

Link to full tutorial: http://www.sevenforums.com/tutorials/83814-drivers-clean-left-over-files-after-uninstalling.html

Revo Uninstaller:

Use Revo Uninstaller to uninstall stubborn software.

• Download and install the software
• Opt for Advance Mode while uninstalling which allows you to remove leftover registry.
• Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\Compressed\SF_01-01-2015\SF_01-01-2015\123014-56472-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff8a0`03915702?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff8a0`00230342?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff8a0`0343e042?
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff800`04e013c0?
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`03214000 PsLoadedModuleList = 0xfffff800`03457890
Debug session time: Wed Dec 31 03:06:20.857 2014 (UTC + 6:00)
System Uptime: 0 days 0:47:11.700
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800c284060, fffff80004e013d8, fffffa800f3cac10}

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: USBHUB!_DEVICE_EXTENSION_PDO                  ***
***                                                                   ***
*************************************************************************
*** WARNING: Unable to verify timestamp for RTSUVSTOR.sys
*** ERROR: Module load completed but symbols could not be loaded for RTSUVSTOR.sys
Probably caused by : usbhub.sys

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800c284060, Physical Device Object of the stack
Arg3: fffff80004e013d8, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: fffffa800f3cac10, The blocked IRP

Debugging Details:
------------------

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: USBHUB!_DEVICE_EXTENSION_PDO                  ***
***                                                                   ***
*************************************************************************

DRVPOWERSTATE_SUBCODE:  3

DRIVER_OBJECT: fffffa800ae1aab0

IMAGE_NAME:  usbhub.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52954dd0

MODULE_NAME: usbhub

FAULTING_MODULE: fffff880052b2000 usbhub

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

TAG_NOT_DEFINED_c000000f:  FFFFF80004E07FB0

STACK_TEXT:  
fffff800`04e01388 fffff800`032f98d2 : 00000000`0000009f 00000000`00000003 fffffa80`0c284060 fffff800`04e013d8 : nt!KeBugCheckEx
fffff800`04e01390 fffff800`0329485c : fffff800`04e014c0 fffff800`04e014c0 00000000`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x33af0
fffff800`04e01430 fffff800`032946f6 : fffffa80`0f305148 fffffa80`0f305148 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`04e014a0 fffff800`032945de : 00000006`97d32fb5 fffff800`04e01b18 00000000`0002c50e fffff800`03407448 : nt!KiProcessExpiredTimerList+0xc6
fffff800`04e01af0 fffff800`032943c7 : 00000001`9b3369ca 00000001`0002c50e 00000001`9b3369f8 00000000`0000000e : nt!KiTimerExpiration+0x1be
fffff800`04e01b90 fffff800`032818ca : fffff800`03404e80 fffff800`03412cc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`04e01c40 00000000`00000000 : fffff800`04e02000 fffff800`04dfc000 fffff800`04e01c00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_3_IMAGE_usbhub.sys

BUCKET_ID:  X64_0x9F_3_IMAGE_usbhub.sys

Followup: MachineOwner
---------

0: kd> lmvm RTSUVSTOR
start             end                 module name
fffff880`0298a000 fffff880`029da000   RTSUVSTOR T (no symbols)           
    Loaded symbol image file: RTSUVSTOR.sys
    Image path: \SystemRoot\System32\Drivers\RTSUVSTOR.sys
    Image name: RTSUVSTOR.sys
    Timestamp:        Tue Sep 04 09:00:45 2012 (50456EDD)
    CheckSum:         00053038
    ImageSize:        00050000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[goku93]

Thanks you very much, I have done everything let me test it.