I need HELP - BSOD on start up unless F8 LAST KNOWN GOOD CONFIGURATION

[Zappastixs]

Hi

My machine (Windows 7 64 bit) keeps crashing with BSOD on start up.

-------------------------------------------------------------------------------------------------------------------------

BSOD

A device driver attempting to corrupt the stack has been caught.
The faulty driver currently on the kernel stack must be replaced
with a working version.

STOP: 0x000000C4 (0x000000000000005, 0xFFFFFA80075B9BD0,
0xFFFFFA8007F8A950, 0x0000000000000000)

-------------------------------------------------------------------------------------------------------------------------

I've tried System Restore, but that didn't help.

Bottom line - I cannot use this machine unless I F8 and opt for "Last Known Good Configuration"
every time I start up.

BUT what I don't understand is why it doesn't throw up BSOD when using
"Last Known Good Configuration" because it stills starts from scratch (albeit F8).

How can this Last Known Good Configuration - option bypass the problem with what seems
to be a regular start-up?

I've checked Device Manager (Hidden View) everything seems fine with no yellow icons.

-------------------------------------------------------------------------------------------------------------------------

I'm not sure what "stacks" do - so I don't know if there’s a link - but when BSOD mentions about
faulty driver currently on the kernel stack must be replaced with a working version, is there a link
here, when on 6 April I installed this?

2019-03 Servicing Stack Update for Windows 7 for x64-based Systems (KB4490628)

Installation date: ‎06/‎04/‎2019 14:53

Installation status: Successful

Update type: Important

-------------------------------------------------------------------------------------------------------------------------

By now I know I must be losing the room . . . BUT another point about (KB4490628)

When I tried to install (KB4490628) (and others) it didn't go to well. It seemed stuck,
so I left it over night.

The next day, all seemed okay.

It was only today (11 April) that I noticed that the update that was stuck maybe wasn't
installed correctly because of this - the;

2019-03 Servicing Stack Update for Windows 7 for x64-based Systems (KB4490628)
[March 2019 update] {that wasn't installed until 6 April 2019}

Has UPLOADED TWICE at 12:57 and 14:53 [KB4490628 - Has UPLOADED TWICE]

Even if MS allowed it I didn't upload KB4490628 twice.

So in case there was a clash I was going to delete the 12:57 upload - but then I thought
I might cause even more problems.

-------------------------------------------------------------------------------------------------------------------------

Finally, I have gone through Event Viewer.

Event Viewer shows a real problem with Intel Queencreek that from what I can gather is not important.

Basically Event Viewer shows that there has been a problem most days going back to 2016.

Today I stopped ESRV_SVC_QUEENCREEK in Services then disabled it.

But that didn't seem to help with problem, although just a thought, could this be the Stack Issue?

Could a stack be full up after being added to most days since 2016.

If this is the case, how can this be flushed out back to zero?

Log Name: ESRV_SVC_QUEENCREEK
Source: ESRV_SVC_QUEENCREEK
Date: 10/04/2019 20:25:44
Event ID: 2
Task Category: (1)
Level: Warning
Keywords: Classic
User: N/A

Description: The description for Event ID 2 from source ESRV_SVC_QUEENCREEK cannot be found.
Either the component that raises this event is not installed on your local computer or the installation
is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:

Error [2]: [ERROR_APPLICATION_UNABLE_TO_INIT_INPUTS][0x7a].
Problem: [Input Library [11]:

[C:\Program Files\Intel\SUR\QUEENCREEK\intel_turbo_input.dll] -
[5c128892-c41b-4dcf-b725-ded756c59830]
Failed To Initialize.].
Solution: [Please Check the Input Library.].
Occurred: [Wed Apr 10 20:25:44 2019].
In file: [intel_modeler_open_device.c].
At line: [7558].The specified resource type cannot be found in the image file

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="ESRV_SVC_QUEENCREEK" />
<EventID Qualifiers="16384">2</EventID>
<Level>3</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2019-04-10T19:25:44.000000000Z" /> <EventRecordID>3521</EventRecordID>
<Channel>ESRV_SVC_QUEENCREEK</Channel>
<Computer>Just a Name</Computer>
<Security />
</System>
<EventData>
<Data>Error [2]: [ERROR_APPLICATION_UNABLE_TO_INIT_INPUTS][0x7a].
Problem: [Input Library [11]:
[C:\Program Files\Intel\SUR\QUEENCREEK\intel_turbo_input.dll] - [5c128892-c41b-4dcf-b725-ded756c59830]
Failed To Initialize.].
Solution: [Please Check the Input Library.].
Occurred: [Wed Apr 10 20:25:44 2019].
In file: [intel_modeler_open_device.c].
At line: [7558].</Data>
</EventData>
</Event>
<Data Name="param1">User Energy Server Service queencreek</Data>

-------------------------------------------------------------------------------------------------------------------------

Oh I just remembered - what started all of this was when machine hit BSOD - I opted for "repair" (I think).

The report came back with clean bill of health apart from

Description: The driver detected a controller error on \Device\Harddisk1\DR - 1.

I've since found out that Repair doesn't fix this issue.


I came across this - but that didn't help.

https://answers.microsoft.com/en-us/windows/forum/all/a-patch-is-preventing-the-
system-from-starting /590fab3b-6efc-46f1-beb0-9bb1d1dc7b29

-------------------------------------------------------------------------------------------------------------------------

2019-03 Servicing Stack Update for Windows 7 for x64-based Systems (KB4490628)
Installation date: ‎06/‎04/‎2019 14:53
Installation status: Successful
Update type: Important

Install this update to resolve issues in Windows. For a complete listing of the issues that
are included in this update, see the associated Microsoft Knowledge Base article for more
information. After you install this item, you may have to restart your computer.

More information: http://support.microsoft.com/help/KB4490628

Help and Support: http://support.microsoft.com/help/4490628

HELP Update KB4490628 has installed twice on Windows 7 64bit

2019-03 Servicing Stack Update for Windows 7 for x64-based Systems (KB4490628)
Installation date: ‎06/‎04/‎2019 12:57
Installation status: Successful
Update type: Important

Install this update to resolve issues in Windows. For a complete listing of the issues that
are included in this update, see the associated Microsoft Knowledge Base article for more
information. After you install this item, you may have to restart your computer.

More information: http://support.microsoft.com/help/4490628

Help and Support: http://support.microsoft.com/help/KB4490628

-------------------------------------------------------------------------------------------------------------------------

It has been a long time since I downloaded anything with drivers.

The only other thing I have downloaded recently was Opera browser, after I deleted it for hogging
CPU/Hard Drives.

After a week I reinstalled it again because I missed the “Save as .PDF” function because if I come
across anything I might find useful to use in the future on a website - it’s so easy to do with Opera.


If you've reached this point - thanks for persevering.

If you can help . . . go easy as "Stacks and so on" I'm not familiar with.

But any help would be most appreciated.

Many thanks.

Stephen

 

[SIW2]

You would need to upload a copy of your system hive, maybe able to find out which driver is causing the problem from that.

Easiest is to use regbak to back up the registry, then zip up the sytem hive from the regbak folder, and post it here.

Will show you how in a minute or two - quite easy.

 

[SIW2]

Here is the little guy, regbak:

View attachment 407802


1.Click Options to get this window:

View attachment 407803


2. Type in the path for the Default Backup Folder - I Suggest C:\regbak\ so it is easy, then click ok.

View attachment 407804


3. Click New Backup

View attachment 407805

4. Click start

View attachment 407806

 

[SIW2]

5. Backup done

View attachment 407807


6. Look in C:\regbak\windows\system32\config folder. RT click the system hive and select Send To >compressed (zipped) folder

View attachment 407808


7. Post up the system.zip file

View attachment 407809

 

[SIW2]

For Info:
regbak is great freeware from Acelogix
Acelogix Software - Downloads

 

[Zappastixs]

Thank you so much SIW2.

I'm going to do this a soon as I can BUT stuff is going on at home, and I don't want to cock up.

I need to do this with some thinking space. So hopefully later this evening (it's 1523hrs now) or tomorrow.

I have downloaded RegBak already. After all these years that's the first time I've heard of RegBak.

Thanks again.

 

[Zappastixs]

Hi SIW2

I've tried to upload as you told me, but unfortunately the "system.zip" file is over the file limit size.

system.zip:
Your file of 9.71 MB bytes exceeds the forum's limit of 8.95 MB for this file type.

Is there any other way?

Thanks, Stephen.

 

[SIW2]

Simplest is to rename it - Change .zip to .apk

Or use 7-zip, which can give greater compression.

 

[Zappastixs]

Problem with .7z but think it's now sorted.

I'm back.

Well that was a bit of a learning curve, getting 7-Zip set up, finding what section of program
will create a .7z file.

Let alone do a simply copy/paste - to have the "system.7z" ready to load up.
I think I've copied it all correctly now. It's now 4.86 MB.

INSERT/UPDATE

Website will not accept .7z files so I HAVE CHANGED EXTENTION TO .zip

Changing it from .7z to .zip hasn't changed the size of the file.

Just hope this extension change will work.

Thanks again.

 

[SIW2]

I will take a look now.

 

[SIW2]

Bottom line - I cannot use this machine unless I F8 and opt for "Last Known Good Configuration"
every time I start up.

BUT what I don't understand is why it doesn't throw up BSOD when using
"Last Known Good Configuration" because it stills starts from scratch (albeit F8).

Your last known good is controlset005. Comparing that with controlset001 reveals an additional avast filter driver in controlset001.


View attachment 407835

There is also a driver set to start type 0 called aswARdisk

View attachment 407836

Possibly your Avast updated itself and added this new driver which is causing the problem.


1. Boot up using last known good - then use avast uninstall tool.

Avast Uninstall Utility | Download aswClear for Avast Removal

That might do the job - without having to do any manual registry editing. I don't know how effective their uninstall tool is at scouring dormant controlsets- maybe it will do a great job.



OR

2. If that doesn't work - then you will need to make some registry edits manually:

Boot up using last known good.

Then open regedit and use the find function on controlset001 to remove the extra filter, and also set the start type to 4.

You will need to check the other controlsets ( except 005 which is fine because it works)

You can then unistall avast using their tool.

 

[Zappastixs]

Hi SIW2

Sorry to trouble again about the same problem.

CAN I ASK THAT YOU READ ALL THIS POST – IT’S NOT JUST A GREAT BIG THANK YOU!

Sorry it has taken such a long time to thank you, but in between still trying to sort out this problem, I have been at the hospital with my wife (she has some serious health issues).

Firstly, my thanks for showing me how to solve the problem.

I followed what you suggested and I couldn’t believe that it worked.

Over the years I’ve warily deleted ‘this and that’ from the Registry stuff like programs to keep windows running/clean up – that are stubborn to remove all traces.

So I was really impressed that you could locate the problems from such a maze of data.

When I rebooted and she started again in regular mode I cannot tell you the relief.

Like many, I have so much on this system. The thought of reinstalling Win 7 and all the Updates from years ago fills me with horror.

UNFORTUNATELY AFTER ALL THAT – I STILL HAVE A MASSIVE PROBLEM

The system is very sluggish – the hard drive light rarely flashes. Google searches take an age.

So when I could, I have been trying to fix these problems.

But with what’s going on with my wife I'm not on the ball.

Stupid I know, but I'm sure I read there is at least one Update from April that needs deleting, that it seems has caused all this nightmare, (from what I've read this is all Microsoft’s fault) but I cannot find which one to uninstall.

I also read MS have released a fix – but can’t find it.

Fast forward to now, early hours 19 April – I managed to fit in 6 hours to try and do some more on this problem. But around two hours after getting nowhere I thought I best reboot.

AT THIS POINT THE PROBLEM RETURNED – BSOD with exact same errors as before.

And when I tried Safe Mode – it would only Boot to similar like CMD prompt.

I used to get by with MS-DOS but I was stumped with what to do now, as DOS was such a long time ago.

So I thought I’ll give option ‘Last Known Good’ a try (it had stopped working last time) but thankfully it worked.

To cut to the chase, after going through what you told me, I found that I didn't follow one section to the letter. My excuse is that I was so tired, BUT STILL SUCH A STUPID & SERIOUS MISTAKE TO MAKE.


You said to do this . . .


2. If that doesn't work - then you will need to make some registry edits manually:

Boot up using last known good.

Then open regedit and use the find function on controlset001 to remove the extra filter,
and also set the start type to 4.

You will need to check the other controlsets (except 005 which is fine because it works)

You can then unistall avast using their tool.


What I’ve gone and done is this . . .


I stupidly deleted controlset001


As a long shot - I was thinking it might be in Recycle Bin, but no.

So I’d be grateful if you could walk me through using RegBak to reinstall the Registry.

That is the file I sent you: system.zip

If it was anything else, I’d give it a go – but the registry is a different matter, after this almighty cock up I've made, I'm not sure I trust myself at the moment.

If I can get the Registry back to how it was – I can then start again and . . .


. . . Then open regedit and use the find function on controlset001 to remove the extra filter,
and also set the start type to 4.


What a numpty I am!

Just so you know, I deleted the new version of AVAST just now, after I installed it straight after I thought I had followed your advise to the letter.

So I’ll be taking a chance all the time I am online. But needs must.

I think I've covered everything.

Many thanks in advance.

Stephen

 

[SIW2]

I deleted the new version of AVAST just now, after I installed it straight after I thought I had followed your advise to the letter.

Deleted Avast? I hope you mean uninstalled. Probably you are better not using Avast. Use the free Microsoft Security Essentials instead.

I stupidly deleted controlset001

I can extract controlset001 from your zipped upload as a .reg file. You should be able to merge it just by clicking on it.

I have removed the filter and set start to 4 on aswardisk service.

View attachment 407911



If you are stuck and can't boot in, then you can restore from regbak. You need to use boot media and from there you run the RegRes.cmd

View attachment 407912

This Boot media contains windows explorer, so you can see what you are doing:

64 bit:
17514x86.iso

32 bit:
17514x64-v10.iso

 

[SIW2]

If you need /want to reinstall windows 7, it is actually quite quick and easy nowadays. Getting the updates is much easier using a tool called dism++.

It takes about 15 mins to install win 7, then about an hour for dism++ to get the updates and install them.

All easy enough so far. I have lost count of the number of times I have done it.

The tricky bit is then you have to reinstall your programs - you might not have the program installers and ( if you are using paid 3rd party software) any license keys.

 

[SIW2]

You could create another partition on your hard drive ( if you have space).

Then clean reinstall onto that. Your original installation therefore remains intact. You will have an additional entry on the boot menu - so you just select to boot into your original, or your new installation Then when you have completed updates, setting up, reinstalling your programs to your satisfaction - you just switch to using the new installation all the time.

 

[Zappastixs]

(SORRY BUT) This message meant exclusively for SIW2 (it’s a Thank You)

KNOW THIS: This is a message meant exclusively for SIW2 (it’s a Thank You).


(If anyone knows how to reach SIW2 - appreciate it if you could pass this on - thanks)


Hello SIW2 – I didn’t know how to reach you direct – hence the Post Title!


This is just a quick long overdue “THANK YOU”

Thank You for the help you gave me back in mid April 2019.

POST TITLE: I need HELP - BSOD on start up unless F8 LAST KNOWN GOOD CONFIGURATION

I had thanked you for the first part of your help, when you suggested downloading
“Registry Backup and Restore” and you subsequently repaired the registry, that part
worked seamlessly, and got me up and running again.

This was because of one of the Microsoft Window Updates in April absolutely slattered my machine.

But there were other issues connected to the problem that you also sorted, but due to the
horrendous accident my wife had at home (months of hospital and a nursing home) we are
only just getting back to normality, so I didn't get round to thanking you for that help.

After all, without your help I really don’t know what I would have done, in fact when I think
of it, if it wasn’t for guys like you, the planet would slowly start to grind to a halt – tech wise.


Stephen

 

[SIW2]

Glad to have been of help.

To notify a user you can type the @ followed by the username example:

Zappastixs

Or you can click the username and select Send Private Message ( often called PM for short )

View attachment 410807

Wishing your wife a speedy recovery.