Initial BSOD after powering down during Windows Update

[theimagineer]

Hi folks, hoping you might be able to help me out as this is causing some frustration.

My problem started on the 17th after i inadvertently powered off the laptop during a windows update. I cannot remember if it had already shutdown and i turned off the power or if it was powering up and i powered it off.

Upon windows opening up, my icons on the desktop were visible but had no text label under them, the start menu was blank and would not open, the clock was missing and the right click menu would not open. Ctrl+alt+del opened the screen but no options present. Again, text labels missing.

So, i searched for a solution, which helped slightly: safe mode > win button + r, sfc /scannow. Unfortunately, whilst this allowed me to see txt again and properly navigate windows, the blue screens kept happening randomly.

I tried uninstalling all my windows updates from the time i powered down then reinstalled them all to no avail. I've also ran full scan on my antivirus and spybot but no change.

As mentioned, they seemed to be happening randomly but on the last 2 occasions i've found a trigger point: i use MS Outlook Web Access for my company emails and i've logged into it and the very second i click on an email title, it goes straight to the BSOD.

If someone can help, i'd much appreciate it. My SF diagnostic zip is attached.

Cheers,
Ross

 

[Anak]

Hi theimagineer, welcome to 7F!

All of your dumps point to a problem with the csrss.exe (Client Server Runtime Process)

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c1c15000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff96000102344, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800022b2100
 fffff900c1c15000 

FAULTING_IP: 
win32k+22344
fffff960`00102344 44891e          mov     dword ptr [rsi],r11d

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8801fb9ac20 -- (.trap 0xfffff8801fb9ac20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000002f79ae6
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000102344 rsp=fffff8801fb9adb0 rbp=0000000000000c47
 r8=0000000002f79bde  r9=0000000002f79af2 r10=0000000000000c47
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
win32k+0x22344:
fffff960`00102344 44891e          mov     dword ptr [rsi],r11d ds:04d0:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800020f8be0 to fffff8000207ac00

STACK_TEXT:  
fffff880`1fb9aab8 fffff800`020f8be0 : 00000000`00000050 fffff900`c1c15000 00000000`00000001 fffff880`1fb9ac20 : nt!KeBugCheckEx
fffff880`1fb9aac0 fffff800`02078d2e : 00000000`00000001 fffff900`c1c15000 00000000`00000000 00000000`000018f9 : nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`1fb9ac20 fffff960`00102344 : 00000000`000018f9 fffff900`c1c15000 00000000`0000ffff fffff960`00101ca8 : nt!KiPageFault+0x16e
fffff880`1fb9adb0 00000000`000018f9 : fffff900`c1c15000 00000000`0000ffff fffff960`00101ca8 00000000`00000000 : win32k+0x22344
fffff880`1fb9adb8 fffff900`c1c15000 : 00000000`0000ffff fffff960`00101ca8 00000000`00000000 00000000`000000b7 : 0x18f9
fffff880`1fb9adc0 00000000`0000ffff : fffff960`00101ca8 00000000`00000000 00000000`000000b7 fffff880`1fb9aff0 : 0xfffff900`c1c15000
fffff880`1fb9adc8 fffff960`00101ca8 : 00000000`00000000 00000000`000000b7 fffff880`1fb9aff0 00000000`00000000 : 0xffff
fffff880`1fb9add0 00000000`00000000 : 00000000`000000b7 fffff880`1fb9aff0 00000000`00000000 fffff880`1fb9b1a0 : win32k+0x21ca8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k+22344
fffff960`00102344 44891e          mov     dword ptr [rsi],r11d

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k+22344

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5164dccc

FAILURE_BUCKET_ID:  X64_0x50_win32k+22344

BUCKET_ID:  X64_0x50_win32k+22344

Followup: MachineOwner
---------

But before we get too involved, restart your machine and tap F8 while your machine restarts, then choose the "Last Known Good Configuration" option and allow it to finish its startup.

If that doesn't help:
Try running a http://www.sevenforums.com/tutorials/433-disk-check.html Option one, Step 8, and please read the note at the beginning it will take some time.

Then run another http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html at least twice with re-boots in between, even if the sfc scan doesn't find any problems on the first run.

You could also try a System Restore to right before your unfortunate shutdown, say, from the 16th of the month.

Any of these three can be ran either in normal or safe mode.

 

[theimagineer]

Anak, thanks for getting back to me.

I've now tried all of the above as suggested but i'm still getting the BSOD unfortunately.

A couple of points:

- I've attached my sfcdetails log, which, i believe, is showing a couple of items that cannot be repaired
- My BSOD is now showing a new 'Bug Check String'. Previously it was PAGE_FAULT_IN_NONPAGED_AREA and since completing the above it is now showing as BAD_POOL_HEADER.

On BlueScreenView, the previous BCS was "Caused by Driver: ntoskrnl.exe" and now it's "Caused by Driver: win32k.sys+19415". Not sure if this helps any but thought i'd add.

 

[VistaKing]

theimagineer

Do you know or can you check what updates were downloaded ?

 

[VistaKing]

Download SystemLook below .

:ar: SystemLookX64

Drag it to your desktop . Right-click on SystemLook_x64.exe and choose

Inside SystemLook copy and paste the highlighted text below


:filefind
Wdf01000.mof


Click on the Look button . It will create a log called SystemLook.txt upload that log with your reply .

 

[theimagineer]

Cheers VistaKing, attached as requested.

 

[VistaKing]

The attachment is all boxes .

 

[Anak]

Your welcome Ross, and thank you VistaKing for coming aboard. It open okay for me, here it is:

SystemLook 30.07.11 by jpshortstuff
Log created at 19:45 on 22/06/2013 by Ross
Administrator - Elevation successful

========== filefind ==========

Searching for "Wdf01000.mof"
C:\Windows\System32\wbem\Wdf01000.mof    --a---- 8202 bytes    [10:46 23/11/2012]    [23:22 13/07/2009] C6BB46C163C1488DE03FB4A09DDD6A60
C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.1.7600.16385_none_d24809e1379d1f91\Wdf01000.mof    --a---- 8202 bytes    [23:22 13/07/2009]    [23:22 13/07/2009] C6BB46C163C1488DE03FB4A09DDD6A60
C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.1.7601.17803_none_d482f2fd34846558\Wdf01000.mof    --a---- 8202 bytes    [10:46 23/11/2012]    [23:22 13/07/2009] C6BB46C163C1488DE03FB4A09DDD6A60
C:\Windows\winsxs\amd64_microsoft-windows-wdf-kernellibrary_31bf3856ad364e35_6.1.7601.22004_none_d50d68344da151bb\Wdf01000.mof    --a---- 4495 bytes    [10:46 23/11/2012]    [14:35 02/06/2012] 309C7A9116344458026272DF77259E91

-= EOF =-

 

[tom982]

Not a problem, bugged update. MS will fix it eventually but until then it can be safely ignored

Gotta dash! Flight leaves in 8 hours and I need some sleep!


Tom

 

[VistaKing]

Thank You Tom . Have fun on your vacation .

 

[theimagineer]

So, it's a problem with Windows own update files?

Thanks for everyones help.